Privacy Policy
Effective date: March 21, 2026
This Privacy Policy explains how Pixel Color Wars ("we", "our", "us") collects, uses, and shares information when you visit pixelcolorwars.com (the "Site") and play the game. This policy is provided as a transparency notice — it is not a consent mechanism. Where we rely on your consent to process personal data, we will ask for it separately.
0. Data Controller
The data controller responsible for your personal data is:
Pixel Color Wars
Kentucky, United States of America
Email: contact@pixelcolorwars.com
We are not established in the European Economic Area (EEA) or the United Kingdom. We process EEA and UK personal data on the basis that our processing is occasional, does not involve large-scale processing of special category data, and is unlikely to result in a high risk to individuals, such that appointment of an EU/UK representative under GDPR Article 27 is not required. If this assessment changes, we will appoint a representative and update this policy.
1. Information We Collect
1a. Account data (registered users only)
If you create an account, we collect and store:
- Username — chosen by you; publicly visible in the game.
- Email address — used for account login; never shown publicly.
- Password — stored only as a salted PBKDF2-SHA-256 hash (200,000 iterations). We never store or transmit your plain-text password.
- Game statistics — total pixels claimed, round wins, power pixels captured, and earned badges.
- Shield count — your in-game defensive resource; stored server-side.
- Account created timestamp.
- Login-attempt counter and temporary lockout timestamp — used to detect brute-force attempts and lock your account for up to 15 minutes after 10 failed logins.
1b. Session data
When you log in, we create a session token (a random 64-character hex string) stored in
Cloudflare D1 alongside your user ID and an expiry timestamp. Sessions expire after 30 days. The token is stored in your browser's localStorage under the key pcw_token and sent as a Bearer token
with authenticated requests.
1c. Browser storage (all visitors)
We do not set first-party cookies. Instead, we use your browser's localStorage to store site preferences and session state. The ePrivacy Directive treats localStorage used
for advertising-related purposes the same as cookies — our consent banner covers both. The
following keys are stored locally in your browser and (unless marked otherwise) are never
sent to our servers:
| Key | What it stores | Sent to server? |
|---|---|---|
pcw_token | Auth session token for registered users | Yes — as Bearer header on authenticated requests |
pcw_tribe | Last selected tribe ID (0–7) — UX convenience | No |
pcw_mode | Game mode preference: "local" or "online" | No |
pcw_consent | Your ad/cookie consent choice: "granted" or "denied" | No |
pcw_adfree | Flag ("1") set when you purchase ad-free access | No |
pcw_taps | Lifetime pixel-claim count (guest session stats) | No (synced to D1 on login) |
pcw_wins | Number of round wins (guest session stats) | No (synced to D1 on login) |
pcw_power_pixels | Power pixels captured (guest session stats) | No (synced to D1 on login) |
pcw_badges | JSON array of earned badge IDs | No (synced to D1 on login) |
1d. IP address
When you register an account, your IP address is recorded in a rate-limiting table
(ip_registrations) to prevent automated account creation. This record stores
your IP, the start of the current one-hour window, and a registration count. It is
overwritten each time a new hourly window begins and is not used for any other purpose.
1e. WebSocket connection state (in-memory only)
While you are connected to the online multiplayer game, the server holds ephemeral in-memory state for your connection: your selected tribe, coin balance, shield count, in-game power-up charges, and last-activity timestamp. This data exists only in RAM for the duration of your session and is not written to any database (except shields, which sync to D1 every 60 seconds and on disconnect). Local vs AI mode runs entirely in your browser — no connection state is sent to our servers.
1f. Game world data (public by design)
The online game state — which tribe owns which pixel — is shared among all players and is
public by design. There is no private game data attached to individual players in the game
grid. Local vs AI game state is stored exclusively in your browser's IndexedDB
(pcw_local database) and never transmitted to our servers.
2. Lawful Basis for Processing (GDPR)
For users in the EEA, UK, and Switzerland, we process personal data under the following lawful bases under GDPR Article 6:
| Processing activity | Lawful basis |
|---|---|
| Account creation, authentication, and session management | Performance of contract — Art. 6(1)(b) |
| Storing game statistics and badges | Performance of contract — Art. 6(1)(b) |
| Login rate-limiting and account lockout | Legitimate interests (security) — Art. 6(1)(f) |
| IP rate-limiting on registration | Legitimate interests (preventing abuse) — Art. 6(1)(f) |
| Personalised advertising via Google AdSense | Consent — Art. 6(1)(a) |
| Non-personalised advertising (when consent is denied) | Legitimate interests — Art. 6(1)(f) |
| Aggregate, non-personal site analytics | Legitimate interests — Art. 6(1)(f) |
| Processing payments via Stripe (when available) | Performance of contract — Art. 6(1)(b) |
3. How We Use Your Information
- To operate and provide the game service (both online and local modes)
- To authenticate you and maintain your session
- To track your game statistics and award badges
- To protect account security (rate limiting, lockout on failed logins)
- To serve advertisements, subject to your consent (see Section 5)
- To improve the Site using aggregate, non-personal analytics
- To process payments for optional in-game purchases (when payment features are active)
We do not sell your personal data. We do not use your data for automated decision-making that produces legal or similarly significant effects. We do not use your data for any purpose incompatible with those listed above without first informing you and, where required, obtaining your consent.
4. Third-Party Services and International Transfers
4a. Cloudflare (infrastructure)
The Site and game server run on Cloudflare Workers and Cloudflare Pages. All traffic is routed through Cloudflare's global network. Cloudflare may process your IP address and request metadata for security (DDoS protection, bot mitigation) and reliability purposes. Your account data and game statistics are stored in Cloudflare D1 (SQLite) and online game world state in Cloudflare Durable Objects. Local vs AI game state is stored in your browser's IndexedDB only.
Cloudflare is a US-based company. Data transfers to Cloudflare from the EEA/UK are covered by Cloudflare's Standard Contractual Clauses (SCCs) and their participation in applicable data transfer frameworks. See Cloudflare's Privacy Policy for details.
4b. Google AdSense (advertising)
We use Google AdSense (publisher ID: ca-pub-5276620986793316)
to display advertisements. AdSense is operated by Google LLC, 1600 Amphitheatre Parkway,
Mountain View, CA 94043, USA.
When you visit the Site and have granted ad consent, Google AdSense may:
- Set third-party advertising cookies and use similar tracking technologies on your device
- Collect your IP address, browser type, device identifiers, and browsing behaviour
- Use that data to serve personalised ads and measure ad performance
- Share data with Google's advertising partners
We implement Google Consent Mode v2. All four consent signals
(ad_storage, ad_user_data, ad_personalization, and analytics_storage) default to denied on every page load. They are
only updated to granted if you actively click "Got it!" on the consent banner
or "Accept Ads & Play Online" on the online mode gate. If you click "Reject
non-essential" or take no action, all four signals remain denied and no
advertising cookies are set. Ad slots are not initialised until consent is granted.
Google is a US-based company. Data transfers from the EEA/UK to Google are covered by Google's Standard Contractual Clauses. See Google's Privacy Policy, Google's Advertising Technologies Policy, and Google Ad Settings (to opt out of personalised advertising across Google services).
4c. Stripe (payments)
When coin purchases and ad-free access are available for purchase, payment processing will be handled by Stripe, Inc., 510 Townsend Street, San Francisco, CA 94103, USA. Stripe will collect your payment card details, billing information, and transaction data directly. We do not store card numbers or full payment details on our servers. Data transfers from the EEA/UK to Stripe are covered by Stripe's Standard Contractual Clauses. See the Stripe Privacy Policy for details.
5. Advertising, Consent, and Online Mode Access
The online multiplayer server is provided free of charge and is funded entirely by advertising revenue. Accordingly:
- Local vs AI mode is available to all visitors with no ad consent required. No advertising cookies are set and no ad units are displayed in this mode.
- Online multiplayer mode requires that you accept advertising cookies (by clicking "Got it!" on the consent banner or "Accept Ads & Play Online" on the online mode gate). Users who have purchased ad-free access may access online mode without accepting advertising cookies.
This is a "pay or okay" model: you may access online multiplayer either by accepting personalised advertising, or by purchasing ad-free access. Local vs AI mode is always available as a free alternative with no advertising or consent requirement.
You may withdraw your ad consent at any time by clicking the cookie settings button (accessible on every page) and selecting "Reject non-essential". Withdrawing consent will remove your access to online multiplayer mode until consent is re-granted or ad-free access is purchased. Your withdrawal does not affect the lawfulness of processing carried out before withdrawal.
California residents (CCPA): We do not sell your personal data. However, Google AdSense may constitute "sharing" of personal data for cross-context behavioural advertising under the California Privacy Rights Act (CPRA). You may opt out of this sharing by clicking "Reject non-essential" in the cookie settings. This opt-out applies regardless of whether you are in online or local mode.
6. Data Retention
| Data | Retention period |
|---|---|
| Session tokens | 30 days, then automatically deleted on logout or expiry |
| IP rate-limit records | Overwritten after each 1-hour window; not archived |
| Account data (username, email, password hash, stats, badges) | Until you request deletion (see Section 7) |
| Browser localStorage data | Until you clear your browser storage or request deletion |
| Local vs AI game state (IndexedDB) | Until you clear your browser storage or reset the game |
| In-memory WebSocket state | Duration of your active connection only |
7. Your Rights
Depending on your jurisdiction, you may have the following rights regarding your personal data:
- Access — request a copy of the personal data we hold about you
- Rectification — ask us to correct inaccurate data
- Erasure — ask us to delete your account and associated personal data
- Restriction — ask us to limit how we process your data
- Portability — receive your personal data in a portable, machine-readable format
- Objection — object to processing based on legitimate interests
- Withdraw consent — withdraw your advertising consent at any time via the cookie settings button; withdrawal does not affect prior lawful processing
EEA and UK residents have these rights under the GDPR / UK GDPR. California residents have similar rights under the CCPA/CPRA, including the right to opt out of the sharing of personal data for cross-context behavioural advertising (see Section 5).
Right to lodge a complaint: If you are in the EEA or UK and believe we have not handled your personal data in accordance with applicable law, you have the right to lodge a complaint with your national data protection supervisory authority — for example, the Information Commissioner's Office (ICO) in the UK (ico.org.uk), or the supervisory authority in your EU member state. We would, however, appreciate the opportunity to address your concern first — please contact us at the address in Section 9.
To exercise any right, contact us at contact@pixelcolorwars.com. We will respond within 30 days (or within the timeframe required by applicable law).
8. Children's Privacy
The Site is not directed to children under 13 (or under 16 in the EEA). We do not knowingly collect personal data from children below the applicable minimum age. Registered accounts require users to confirm they meet the minimum age requirement at registration. If you believe a child has provided us personal information, please contact us at contact@pixelcolorwars.com and we will delete it promptly.
9. Contact
For privacy-related questions, data subject requests, or complaints, please contact us at:
Pixel Color Wars
Kentucky, United States of America
Email: contact@pixelcolorwars.com
10. Changes to This Policy
We may update this policy from time to time. The "Effective date" at the top of this page will reflect the most recent revision. For processing based on your consent, material changes will require us to seek fresh consent — we will not rely on continued use of the Site as implied re-consent for such changes. For other processing, continued use of the Site after changes are posted constitutes acknowledgement of the updated policy. Material changes will be communicated via an in-game notice where reasonably practicable.