Privacy Notice

1. Scope and minimum age

This notice applies to the FrankenSketch web game and features offered during its public playtest. The service is intended for people aged 16 or older. Do not use the service if you are under 16. FrankenSketch does not knowingly collect personal data from children under 14, or under 16 where the GDPR applies. If we learn that we have collected personal data from such a child, we delete it without delay.

2. Data handled during a game

To create a live room and run the game, the server handles the following in memory:

• a room code and temporary room state;
• nicknames, player order and roles, host status, and normalized keys of removed nicknames;
• temporary player identifiers and reconnect tokens;
• your nickname and interface language while you wait in the quick-match queue (dropped as soon as a room opens or you cancel);
• prompts, the guesser's answer (Normal mode), drawing strokes and pieces, and used prompts.

We use this information to apply the game rules, synchronize players, recover interrupted connections, and show results. When a host removes a participant in the Lobby, the room keeps up to 64 normalized nickname keys in memory to restrict immediate re-entry with the same normalized nickname. This is a best-effort restriction that can be bypassed by changing the nickname; it does not use an IP address or browser identifier. Room data disappears when the room is deleted after the last player leaves, or when the server restarts or is redeployed.

What other people in your room can see

Depending on the game stage, people in the same room can see participant nicknames and roles, who drew each piece, the combined drawing, the prompt, the guess, and the result. Do not put your real name, contact details, or other information you do not want to share into a nickname or drawing.

3. Data stored in this browser

For convenience and result recovery, the game may store the following locally:

Some recovery features may not work in private browsing or when your browser restricts local storage.

4. Anonymous analytics, error, and operational logs

During the public playtest, we may record only allowlisted events and operational metrics needed to understand whether the game works and is fun. Examples include room creation and successful game start, cycle completion and continuation, disconnect and recovery, invite-link copy and native-share completion, result save/share actions, reaching the end screen, error categories, active room and connection counts, memory and timer delay, aggregated network round-trip time, an allowlisted acquisition-source category, an anonymous count of home-page requests per that same category, and a mobile/desktop layout category. These records may include fixed game settings such as drawing style, whether a guesser is used, prompt type (default or player-entered), and the drawing time actually applied.

Application logs do not contain the actual room code, nickname, player ID or reconnect token, raw IP address or Origin, prompt or guess, drawing strokes or coordinates, full URL or raw query, or a persistent browser ID. For deduplicated room-level counts, the server may use a temporary analytics room ID that is never sent to the client and is discarded with the room. From a link's src, the game may optionally record exactly one fixed category: chzzk, twitch, youtube, instagram, threads, x, reddit, discord, itch, email, college, community, portal, invite, result, or qr. The raw value is not logged. After checking it, the browser removes src from the address and does not keep it in a cookie or browser storage or carry it into later links. A native-share completion record contains no sharing app, target, recipient, or invite link, and does not mean that another person received or opened it.

Repeat host use is sent only as a fixed bucket: first, 2–3, or 4+. The raw count stays in the browser. Reaching the end screen records only a host/player role. A landing event, including its source category, is sent only after the existing game connection opens, so it is not a count of all clicks, pageviews, unique visitors, or share deliveries or opens. These signals are not unique-user counts or exact retention.

5. Security and abuse prevention

To limit automated connections, room creation, and code guessing, the server may keep a temporary source-derived key and request counters in process memory. This state expires after about 10 minutes and has a fixed size limit. Raw IP addresses and Origins are not written to FrankenSketch application telemetry, although the hosting provider may process network information in its own security and access logs under its policies.

6. Retention

We may keep information longer only when necessary to meet a legal obligation, respond to a security incident, or resolve a dispute.

7. Service providers and international processing

We use the following providers to run the online game and receive support email. The game service runs on Render Starter in the Virginia, United States region. Application logs are retained for up to 7 days and are accessible only to one operator. We do not use external log forwarding or a separate long-term archive.

If you do not want your game traffic processed outside your country, you can choose not to use the online service. You do not need to send us an email unless you want support. Each provider's own retention and security obligations are governed by its policy.

8. Discord, sharing, and downloads

Discord links and operating-system share features open only when you choose them. FrankenSketch does not receive Discord account data or know whether you joined the server. Once you open an external service or share a result, that service's privacy rules apply. You are responsible for PNG, ZIP, and collage files that you download or share to another app.

9. Your choices and deleting local data

Use Delete data on this device in the Home footer to delete the nickname, last room, session, language, and tutorial-display preferences, host-usage counter, IndexedDB results, and in-memory result and reconnect state stored by FrankenSketch in the current browser. The game then returns to a clean Home URL.

This control cannot delete anonymous application logs already created, hosting infrastructure logs, support email, or files you downloaded or shared. Because anonymous logs are not linked to an account or persistent identifier, we cannot locate and selectively delete a particular person's events. You may ask us to delete a support email at the address below.

10. Safeguards

We use encrypted HTTPS/WSS connections from allowed origins, request-size and rate limits, room and connection caps, server-authoritative validation, restricted log schemas, and short retention periods. No method of internet transmission or storage can be guaranteed completely secure. Please email us if you believe you found a security issue.

11. Changes to this notice

If we add accounts, payments, advertising, a new analytics provider, or another feature that changes data handling, we will update this notice first and show its effective date. We will announce material changes in the game, the official Discord, or another appropriate place.

12. Additional information for users in the EU, EEA and UK

If you are in the European Union, the European Economic Area (EEA), or the United Kingdom, this section also applies to you.

Controller and contact

The controller is the FrankenSketch operator. You can reach us at the privacy contact email support.frankensketch@gmail.com.

Legal bases

• Providing the game and keeping the service secure and free of abuse: our legitimate interests (Art. 6(1)(f) GDPR)
• Answering your enquiry: performing your request (Art. 6(1)(b) GDPR)

We do not carry out consent-based tracking or advertising processing.

Your rights

You have the right to request access to, rectification or erasure of your personal data, restriction of or objection to its processing, and data portability. There is a technical limit: server room data exists only transiently in memory and is not linked to a persistent identifier of you, and results stored in your browser are under your own control and can be deleted by you (see section 9).

How to exercise your rights

Email us at the address above. We reply within one month. Where a request is complex or numerous, we may extend that period as the law allows and will tell you if so.

Right to lodge a complaint

You have the right to lodge a complaint with a supervisory authority. In the Republic of Korea this is the Personal Information Protection Commission (PIPC); users in the EU, EEA or UK may also contact the supervisory authority where they live or work.

International transfers

The game servers are located in the United States and the operator is in the Republic of Korea. Transfers are safeguarded by our providers' standard contractual clauses and policies; see the provider policy links in section 7.

Automated decision-making

We do not make automated decisions, including profiling, that produce legal or similarly significant effects on you.