Privacy Policy

pikto.fun is a free multiplayer drawing game, playable on pikto.fun and on the game platforms CrazyGames, itch.io and GameDistribution. For any question about your data: solarweb@pikto.fun.

Your player ID

On your first visit, your browser creates a random ID and the server pairs it with a secret key (we only keep a fingerprint of it). Both stay in your browser's local storage. They let us recognise you from one game to the next and stop anyone else from pretending to be you. They say nothing about who you are. If you clear the site's data, you start again with a new ID.

Nickname and avatar

The nickname and avatar you choose are shown to the other players in the room. If you don't pick a nickname, one is drawn at random (for example “SlyPencil12”). They are kept in your browser, in the room for the length of the game, and on your player record (below). Your nickname also appears with your drawings in the gallery.

Your player record

We keep one record per player ID: current nickname and the 5 previous ones, avatar, platform (website, CrazyGames, itch.io, GameDistribution), device type, game language, game version, dates of first and last visit, and counters (days played, play time, games, rounds, drawings, words guessed, wins, points). We also record each hour you are connected, each play session (start, length) and each room you join, with how you got there (invitation link, code, game list, quick play). We use this to measure how many players come and how often they return. Only the administrator can see it. Nothing on this record says who you are: no name, email address, IP address or location, only this game and technical information (unless you chose your real name as your nickname).

Your progress

On pikto.fun and CrazyGames, the game keeps track of your progress: level and experience points, Piktos (the game's coins, which cannot be bought), streak of days played, daily chest, jokers and pending bonuses. The server works it out from the games you finish. It is linked to your player ID, or to your account if you are signed in (CrazyGames account, or the pikto.fun account below): when you sign in, the account takes over the device's progress once; after signing out, the device starts again from fresh progress. Every gain and every spend is logged, to fix a mistake or spot abuse. Your level is shown to other players next to your nickname. The itch.io and GameDistribution versions have no progress.

pikto.fun account (optional)

On pikto.fun, you can create an account to keep your progress and find it on all your devices. There is no password: you sign in with Google, or with a 6-digit code sent by email (valid for 10 minutes). The account only holds your email address (with Google: the address and ID of your Google account), its creation and last sign-in dates, and the list of signed-in devices (their player ID and a sign-in key, of which we keep only a fingerprint). Your email address is never shown to other players and is only used to sign you in: no advertising, no newsletter. Sign-in emails are sent from our own mail server, with no outside sending service.

The “Continue with Google” button loads Google's sign-in service only when you open the sign-in window. If you use it, Google sends us an identity token that contains your Google account ID, its email address, and also the account's name and profile picture. We keep only the ID and the email address: the name and picture are neither stored nor shown.

From “My account”, you can download your data, sign out or delete your account: deletion is immediate and permanent (account, progress and its log). An account with no visit for 13 months is deleted automatically. In short: the account is only there to keep your progress, nobody else sees your email address, and you can erase everything whenever you like.

Weekly leaderboard

Each week (from Monday 9:00 UTC to the following Monday), players signed in to an account (a pikto.fun account on the website, a CrazyGames account on CrazyGames) are ranked by the experience they earned that week, with a single leaderboard for everyone (pikto.fun and CrazyGames accounts together), all languages combined. Other players can see your nickname, your avatar, your level and your experience for the week there. Without an account, you are not on it. For this, we keep, per week and per account: the week's experience (and the share earned in private rooms, to spot abuse), the number of games, the nickname, the avatar, the level and the player IDs of your devices, for 5 weeks. The weeks in which you finish in the top 50 stay with your progress (“Top 50” frame and title). Deleting your pikto.fun account also removes your leaderboard entries.

On CrazyGames, our server also sends your experience for the week to the CrazyGames leaderboard, along with your CrazyGames user ID; there it follows the CrazyGames privacy policy. If you have turned off leaderboards in your CrazyGames account, you appear as “Anonymous player” in our leaderboard, with no nickname or avatar.

Game statistics

To improve the game (words that are too hard, drawing tools, scoring), we keep the details of each turn, linked to the player ID: word played, guessed or not and how fast, points earned, device type, drawing tools used, size of the sheet on screen. We also keep a summary of each game (players, scores, number of rounds). These statistics do not include chat messages.

The room during a game

During a game, the server holds the state of the room: players, nicknames, avatars, scores, chat messages and the strokes of the current drawing. All of it is deleted at the latest 24 hours after the room's last activity.

Feedback and contact messages

When you send end-of-game feedback or a contact message, we attach technical details to help us understand reported problems: device type, operating system and browser, screen and window size, browser and game language, time zone and game version. End-of-game feedback also includes the words played and your player ID, to link it to that game's statistics. Only write what you are happy to share: if you leave an email address so we can reply, we keep it with the message.

Each message or piece of feedback is kept with your player ID and, if you are logged in to your CrazyGames account, your CrazyGames username: this lets the team reply to you in the game, where the reply appears on your next visit (on CrazyGames, also on another device logged in to the same account). If you are in a game room at that moment, we also attach the type of room (public or private, quick play, number of players) and its last 30 public chat messages with their authors' nicknames, so we can understand the situation; they are kept with the message.

Moderation

To protect players, many of them young: when a player is reported (or blocked by several players), their current drawing, recent chat messages and nickname are reviewed, partly by artificial intelligence (see section 4). These messages include wrong guesses typed in the chat. If a report is found to be unfounded, the recent messages and nickname of the players who made it may be reviewed in turn. We keep a record of the decision, the sanctions (temporary kick, warning), counters (messages hidden by the filter, reports made, sanctions received) and the list of banned nicknames. To stop a banned player from coming back under a new ID, we keep a fingerprint of your IP address: it is computed with a secret key (a keyed hash); the address itself is never stored and cannot be recovered from the fingerprint without that key. The fingerprint is linked to your player ID for 30 days after your last connection from that network. During a ban, an ID created after the ban from the same network is refused; a network shared by many players (school, mobile carrier) is never used for this. The ban history is kept for 1 year. When PiktoBot guesses a drawing, it can also flag a clearly shocking drawing, which is then reviewed like a report.

In public rooms, without waiting for a report, the artificial intelligence also reads messages that contain certain words or signs (contact details, remarks about origin or religion, insults aimed at a player, threats…) and those of a player already under watch, with the few messages before them. A message judged inappropriate is removed from the chat and its author is told; a serious case is reviewed like a report. Removed messages are kept for 90 days. Private rooms are not concerned.

Technical data

• Server access logs contain IP addresses, for security and troubleshooting. They are deleted after 7 days. Elsewhere, IP addresses are never stored in clear: they are used in the moment to limit abusive requests, and only their fingerprint is kept for 30 days for moderation (see above).
• Technical errors: when the game crashes, we receive the error message, the page, the game version, the platform, the window size and the browser (without a player ID).
• Audience measurement (Matomo): on pikto.fun and in the CrazyGames and itch.io versions, we use Matomo, installed on our own servers, to count page views and in-game actions. IP addresses are truncated and nothing is passed to third parties. Matomo is not used in the GameDistribution version.

At the end of a turn, your drawing may join the public pikto.fun gallery with the word, its category, your nickname and the turn's success rate. We keep the drawing's strokes and an image of the result. Visitors can vote on drawings. PiktoBot's drawings never appear there.

A drawing is deleted after 6 months, or 7 days after it receives more negative than positive votes. From the end-of-game score screen, the “Remove my drawings from the gallery” button deletes them immediately and permanently.

Some game features use Google's Gemini API. This is what it receives:

• PiktoBot guessing: images of your drawing during the turn. It also says whether a drawing looks clearly shocking (sexual content, gore, hateful symbol, written insult): the drawing then goes to moderation.
• PiktoBot and PiktoModo remarks in the chat: the room's latest public messages, with their authors' nicknames, and the state of the game (whether the word has been found, scores).
• Moderation: when a player is reported, their current drawing, recent messages (wrong guesses included) and nickname. If the report is found to be unfounded, also the recent messages and nicknames of the players who made it (decision kept 7 days, like the others).
• Message review (public rooms): messages spotted by certain words, with the few messages before them and their authors' nicknames.
• PiktoBot drawing: only the word to draw. No player data.
• Chat translation (international games): the text of chat messages, without nickname or identifier, to translate them into the other players' languages.

No player ID is sent. We use the paid tier of the API: under Google's terms, this content is not used to train its models and is kept only briefly, to detect abuse. Google may process it outside the European Union. On our side, we keep chat remarks and the messages that prompted them for 90 days, and moderation decisions (with the drawing reviewed) for 7 days, to check that the AI behaves well.

Deletion is automatic.

• Name, or email address (unless you create a pikto.fun account or write one in a message)
• Password
• Payment details
• Precise location
• IP address in clear linked to your player ID (only a fingerprint, see section 2)

pikto.fun sets no advertising cookies. The game uses your browser's local storage for: your player ID and its secret key, the sign-in key of your pikto.fun account if you have one, your nickname and avatar, language, sound, recent colours, your gallery votes, your quick-play settings, and whether tips and feedback requests have been shown. You can erase all of it by clearing the site's data in your browser.

Matomo sets an audience-measurement cookie, limited to the domain the game runs on.

If you choose “Continue with Google”, Google may set its own cookies on its domain, under its privacy policy.

We do not sell or rent your data. It is hosted on our servers. Only the content described in section 4 is sent to Google (Gemini).

When you play on a game platform, it may collect its own data (account, ads, statistics) under its own policy: CrazyGames, itch.io, GameDistribution. On CrazyGames, if you are logged in, we receive your account ID and username: they are used to reserve your nickname, to link your progress to your account (so you find it on your other devices), to deliver the team's replies to you and to apply a kick to the account rather than the browser. Ads shown on CrazyGames and GameDistribution are handled by those platforms.

We process this data to run, secure, moderate and improve the game (legitimate interest). Under the GDPR, you can ask to see, correct or delete the data linked to your player ID, or object to its processing. Since we don't know who you are, tell us your nickname, the platform and roughly when you played, so we can find your record.

The pikto.fun account and your progress rely on providing the service you ask for (performance of a contract). With an account, “My account” lets you download your data and delete the account yourself, immediately.

Clearing the site data in your browser also breaks the link: your old record is no longer tied to you and disappears after 13 months.

Write to us at solarweb@pikto.fun. If you believe your rights are not respected, you can lodge a complaint with the CNIL, the French data protection authority, or with the authority in your country.