Privacy Notice

1. Scope and minimum age

This notice applies to the FrankenSketch web game and related features. Under our service policy, the game is intended for people aged 16 or older. This is separate from the age at which someone can consent to personal-data processing under local law.

We do not knowingly collect personal data from children under 14. In regions where the GDPR applies, our policy also excludes knowingly collecting data from children under 16, in line with our service age. If we learn that we have collected such data, we delete it without delay.

2. Data handled during a game

To create a live room and run the game, the server handles the following in memory:

• a room code and temporary room state;
• nicknames, player order and roles, host status, and comparison values for removed nicknames;
• each player's interface language (only whether the room mixes languages is shared, so the host can be told that custom prompts aren't translated);
• temporary player identifiers and reconnect tokens;
• your nickname, interface language, connection information, and queue-entry time during quick matching (removed from the queue on a match, cancellation, or disconnect; matched nicknames and related data continue as room data);
• prompts, the guesser's answer (when a guesser is enabled), drawing strokes and pieces, the guesser's doodle board, and used prompts;
• correct-answer counts and round records, and who sent and received hearts or stones and their counts.

We use this information to run the game, synchronize players, restore connections, and show results. To restrict immediate re-entry after removal, the room keeps up to 64 normalized nickname keys (names converted to a common format) in memory. Changing the nickname can bypass this restriction; it does not use an IP address or browser identifier. The data disappears when the room is deleted or the server restarts or is redeployed (see section 6). A room is deleted when the last player leaves or after an inactivity timeout.

What other people in your room can see

Depending on the game stage, people in the same room can see participant nicknames and roles, who drew each piece, the combined drawing, the guesser's doodle board, the prompt, the guess, and the result. Received heart and stone counts are shared with the room; other players are not shown who sent them. Do not put your real name, contact details, or other information you do not want to share into a nickname or drawing.

3. Data stored in this browser

For convenience and result recovery, the game may store the following locally:

Results can include participant names, prompts, guesses, drawings, and the guesser's doodle board. Leaving normally deletes your saved results for the current room. Older results can remain longer if you do not reopen the game or storage cleanup fails. Some recovery features may not work in private browsing or when your browser restricts local storage.

4. Limited analytics, error, and operational logs

To improve the game, we may record only a defined set of events and operational metrics:

• Game use: room creation and game start, players joining and being removed, round start and completion, the guesser's answer being locked in or timing out, the answer reveal, ending a collection and starting the next, quick-match entry, matching, exit and waiting time, disconnect and recovery, invite-link copy and native-share completion, result save/share actions, opening the feedback link, and reaching the end screen.
• Operation: error categories, the error code and request type of failed joins and rejected requests, active room and connection counts, memory use, timer delays, network round-trip-time ranges, and the deployed version and Node.js version when the server starts.
• Common event fields: player count, round number, game stage (a fixed value such as lobby, drawing, or results), the room creator's interface language, and the temporary analytics room ID.
• Environment: interface language, mobile/desktop layout, an allowlisted acquisition-source category, and anonymous home-page request counts by that category.
• Settings: drawing style, whether a guesser is used, prompt type (default or player-entered), the built-in topic category, and the drawing time actually applied.

Application logs do not contain the actual room code, nickname, player ID or reconnect token, raw IP address or Origin, prompt or guess, drawing strokes or coordinates, full URL or raw query, or a persistent browser ID. A temporary analytics room ID prevents duplicate room counts and is never sent to players. It can link a room's events for the log-retention period. Deleting a room does not immediately delete its existing logs. From a link's src, the game may optionally record exactly one fixed category: chzzk, twitch, youtube, instagram, threads, x, reddit, discord, itch, email, college, community, portal, invite, result, or qr. The raw value is not logged. After checking it, the browser removes src from the address and does not keep it in a cookie or browser storage or carry it into later links. A native-share completion record contains no sharing app, target, recipient, or invite link, and does not mean that another person received or opened it.

Repeat host use is sent only as a fixed bucket: first, 2–3, or 4+. The raw count stays in the browser. Reaching the end screen records a host/player role and a mobile/desktop category. Alongside visits recorded after the game connects, the server counts home-page requests, including refreshes. Limited errors can be sent before the game connects. These signals do not distinguish all clicks, pageviews, unique visitors, or share deliveries or opens; they do not measure exact user counts or return rates.

5. Security and abuse prevention

To limit automated connections, room creation, and code guessing, the server may keep a temporary key derived from connection information and request counters in memory. Once no active connections or rooms remain, this state is cleaned up about 10 minutes after the last relevant activity and has a fixed size limit. Raw IP addresses and Origins are not written to FrankenSketch application telemetry, although the hosting provider may process network information in its own security and access logs under its policies.

6. Retention

We may keep information longer only when necessary to meet a legal obligation, respond to a security incident, or resolve a dispute.

7. Service providers and international processing

We use the providers below to run the game and handle support inquiries. Only one operator can access application logs. Retention follows section 6.

During play, connections and requests are sent over the network to the hosting provider. Support messages are sent to Google Gmail when you email us. If you do not want your game traffic processed outside your country, you can choose not to use the online service. You do not need to send us an email unless you want support. Each provider's own retention and security obligations are governed by its policy.

The operator may separately enable an external notification service for room creation and game start. Alerts contain only drawing style, whether a guesser is enabled, player count, the room creator's interface language, and active-room count. They exclude nicknames, room codes, player IDs, connection IPs, drawings, prompts, guesses, and analytics room IDs. This does not forward raw application logs. Retention at the receiving service is governed by that service's policy.

8. Discord, sharing, and downloads

Discord links and operating-system share features open only when you choose them. FrankenSketch does not receive Discord account data or know whether you joined the server. Opening the feedback link records only that it was opened; any feedback you leave stays only where you post it on Discord. Once you open an external service or share a result, that service's privacy rules apply. You are responsible for PNG, ZIP, and collage files that you download or share to another app.

9. Your choices and deleting local data

Use Delete data on this device in the home-page footer to delete the nickname, last room, session, language, tutorial-display, room-code visibility, and sound preferences, host-usage counter, first-play tip record, stored results, the current tab's doodle draft and in-app browser notice state, and in-memory result and reconnect state stored by FrankenSketch in the current browser. The game then returns to the home page.

This control cannot delete sessions in other tabs or data on other devices, application logs or aggregate statistics already created, hosting infrastructure logs, support email, or files you downloaded or shared. Because application logs are not linked to an account or persistent identifier, identifying a particular person's events may not be possible. You may request access, correction, deletion, or restriction of your personal data, including support email, at the address below.

Privacy officer and disclosure to third parties

The person responsible for privacy is the FrankenSketch operator, reachable at the privacy contact email above. Except for the service providers (processors) in section 7, we do not provide personal data to third parties unless required by law.

Remedies in the Republic of Korea

If you need to report or get advice about a privacy infringement, you can contact the following bodies:

• Personal Information Protection Commission (PIPC): www.pipc.go.kr
• Privacy Infringement Report Center: 118 (no area code needed in Korea), privacy.kisa.or.kr
• Personal Information Dispute Mediation Committee: 1833-6972, www.kopico.go.kr

10. Safeguards

We encrypt connections (HTTPS/WSS), check their origin, and verify permissions on the server. We also limit request size and frequency, room and connection counts, logged data, and retention periods. No method of internet transmission or storage can be guaranteed completely secure. Please email us if you believe you found a security issue.

11. Changes to this notice

If we add accounts, payments, advertising, a new analytics provider, or another feature that changes data handling, we will update this notice first and show its effective date. We will announce material changes in the game, the official Discord, or another appropriate place.

12. Additional information for users in the EU, EEA and UK

If you are in the European Union, the European Economic Area (EEA), or the United Kingdom, this section also applies to you.

Controller and contact

The controller is the FrankenSketch operator. You can reach us at the privacy contact email support.frankensketch@gmail.com.

Legal bases

• Providing the game and keeping the service secure and free of abuse: our legitimate interests (Art. 6(1)(f) GDPR)
• Answering your enquiry: performing your request (Art. 6(1)(b) GDPR)

We do not carry out consent-based tracking.

Your rights

You have the right to request access to, rectification or erasure of your personal data, restriction of or objection to its processing, and data portability. There is a technical limit: server room data exists only transiently in memory and is not linked to a persistent identifier of you, and results stored in your browser are under your own control and can be deleted by you (see section 9).

How to exercise your rights

Email us at the address above. We reply within one month. If requests are complex or numerous, we may extend that period as the law allows and will let you know.

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. Users in the EU, EEA or UK can complain to the supervisory authority where they live or work.

International transfers

The game servers are located in the United States and the operator is in the Republic of Korea. See the policies in section 7 for provider-specific international processing and safeguards. Render includes standard contractual clauses (SCCs) in its Data Processing Addendum (DPA). You can ask about applicable transfer grounds and safeguards at the email above.

Automated decision-making

We do not make automated decisions, including profiling, that produce legal or similarly significant effects on you.