Privacy Policy

This Privacy Policy describes how Brightwing Systems, LLC ("we", "us", or "our") collects, uses, and protects information when you use Pixel Crawlers ("the Service") available at pixelcrawlers.com. By using the Service, you agree to the collection and use of information in accordance with this policy.

Account Information

If you create an account, we collect your email address and a display name. If you sign in with Google or GitHub, we receive basic profile information from those providers (typically your name, email address, and avatar URL) as permitted by the scopes you authorize.

Gameplay Data

When you play, we store your game sessions — the random seed and the append-only log of actions that defines each run — together with derived state (current floor, inventory, hero status). We also store exported runs ("Episodes") you create or share, lobby memberships for co-op sessions, and any runs you submit to a daily- or weekly-seed leaderboard.

Leaderboard & Public Run Data

Runs you submit on a daily or weekly seed, and Episodes you publish, are public by design. Your display name (not your email) is shown alongside those runs. If you do not want a run associated with you publicly, do not submit it to a seeded leaderboard and do not publish it as an Episode.

Usage Data

We collect standard server logs (IP addresses, browser type, pages and endpoints requested, timestamps) to operate and secure the Service. This includes logs from our HTTP and WebSocket gameplay servers. IP addresses retained for abuse prevention are automatically scrubbed after 30 days.

Cookies

We use only essential and functional cookies:

• pixelcrawlers_sessionid — session management (authenticated users only)
• pixelcrawlers_csrftoken — CSRF protection
• pc_theme — your selected colour theme (light / dark / system)
• tz — timezone detection at signup, used to align daily-seed windows

We use self-hosted Umami for analytics, which operates in cookie-free mode. We do not use third-party advertising or tracking cookies.

We process your personal information on the following legal bases:

• Contract performance: to provide the Service you have signed up for, including running and persisting your game sessions.
• Legitimate interest: to operate, maintain, and improve the Service, detect abuse, and ensure security.
• Consent: where required by applicable law, such as for optional communications.

• To run and persist your game sessions and let you resume them across devices.
• To authenticate your identity and manage your account.
• To rank submitted runs on daily- and weekly-seed leaderboards.
• To host and serve Episodes you publish.
• To deliver transactional emails (verification, password reset, security alerts).
• To respond to support requests.
• To detect and prevent fraud, abuse, cheating, or security incidents.

We do not sell your personal information. We share information only in the following circumstances:

• Publicly displayed content: your display name appears next to your submitted leaderboard runs and any Episodes you publish.
• Service providers: we use third-party processors that only access data as necessary to perform their functions and are bound by contractual obligations to protect it. Data Processing Agreements (DPAs) are in place with all third-party processors. They are:
  • Postmark (transactional email delivery) — DPA incorporated by reference.
  • Google and GitHub (optional social sign-in) — only the profile fields you authorize during sign-in are received.
  • GlitchTip (error monitoring) — self-hosted on our own infrastructure; no third-party data transfer.
  • Umami (analytics) — self-hosted; cookie-free; no third-party data transfer.
  • Cloud hosting and infrastructure (server hosting, CDN).
• Legal requirements: we may disclose information if required by law, subpoena, or other legal process.
• Business transfers: if Brightwing Systems, LLC is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction.

We retain your account information for as long as your account is active. Game sessions and their action logs are retained for as long as the associated account is active. Published Episodes and runs submitted to a daily- or weekly-seed leaderboard are retained indefinitely so other players can replay or reference them; you can request removal of a specific Episode or leaderboard entry by contacting us. If you delete your account, we will remove your personal information and associated unpublished runs within 30 days, except where retention is required by law or for legitimate business purposes (such as resolving disputes).

Our servers are located in Europe (Germany). If you access the Service from outside this region, your information may be transferred to, stored, and processed in a country other than your own. By using the Service, you consent to the transfer of your information as described in this policy. We take appropriate measures to ensure that your data is treated securely and in accordance with this Privacy Policy regardless of where it is processed.

We implement industry-standard security measures to protect your information, including encryption in transit (TLS), secure password hashing, and regular backups. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

You may:

• Access and update your account information at any time through your account settings.
• Delete your account and associated data (30-day grace period, then permanent deletion).
• Request deletion of a specific Episode or leaderboard entry by contacting us.
• Opt out of non-essential communications.

California Residents (CCPA)

If you are a California resident, you have the right to: know what personal information we collect, use, and disclose; request deletion of your personal information; and opt out of the sale of your personal information. We do not sell your personal information. To exercise these rights, contact us at pixelcrawlers@brightwingsystems.com. We will not discriminate against you for exercising any of these rights.

European Economic Area, UK, and Swiss Residents (GDPR)

If you are located in the EEA, UK, or Switzerland, you have the right to: access your personal data (Art. 15); rectify inaccurate data; request erasure of your data (Art. 17 — via account deletion); restrict or object to processing; request data portability; and lodge a complaint with your local data protection supervisory authority. To exercise these rights, contact us at pixelcrawlers@brightwingsystems.com.

The Service is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If we become aware that we have collected personal information from a child under 13, we will take steps to delete that information promptly. If you believe a child under 13 has provided us with personal information, please contact us at pixelcrawlers@brightwingsystems.com.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the Service after changes constitutes acceptance of the revised policy.

If you have questions about this Privacy Policy, contact us at pixelcrawlers@brightwingsystems.com.