Publish
Privacy Policy

Effective date: October 1, 2026 · Beta

This Privacy Policy explains what information PixelJS collects when you use pixeljs.com and its subdomains (the "Service"), how we use and share it, and the choices you have. In this policy, "PixelJS," "we," "us," and "our" mean the operator of the Service.

The short version

  • You can browse and play games without an account, and players get no tracking cookies.
  • We count plays without cookies and without storing IP addresses.
  • Games run in an isolated sandbox and are not allowed to collect personal information.
  • We collect account information only from creators, who join by invitation.
  • We do not sell personal information or share it for cross-context behavioral advertising, and there is no advertising during the beta.

Information we collect

When you browse and play

  • Server and security logs. Our servers record the IP address, user agent (a description of your browser and operating system), requested URL, and time of each request. We keep these logs for up to 90 days and use them for security, abuse prevention, and troubleshooting.
  • Play statistics. We count plays without cookies and without storing IP addresses. Our server derives a visitor key from network information in your request and a random value (a "salt") that changes every day, then discards the raw data. Because the salt changes daily, keys cannot be linked across days. We use these keys only to count plays, which appear as play counts on games.
  • Preferences. If you change a display preference, such as the theme or theater mode, we save it in a cookie (see "Cookies" below).

When you send us a report, notice, or message

  • Reports. When you use the Report button on a game page, we receive the content of your report and, if you choose to provide one, a contact email.
  • Copyright notices and counter-notices. We receive the content of your notice, including the contact details and statements the law requires.
  • Contact messages. When you use our contact page, we receive your message and the contact details you provide so we can reply.

When you are a creator

If you have a creator account, we collect:

  • Account information: your email address, display name, and password. We store your password only as a salted Argon2id hash, never in readable form.
  • Session records: the prefix of your IP address, your user agent, and session times.
  • Channel profile: your channel's name, bio, avatar, banner, and links.
  • Your content: the games and media you upload, such as thumbnails and preview videos, and their listings.
  • Records: your acceptance of our terms and policies, and moderation decisions about your content and account.

Games

Games run in an isolated sandbox on play.pixeljs.com with an opaque origin, so they cannot read the portal's cookies. Games are not allowed to collect personal information, track or fingerprint players, or make undisclosed network requests to third parties, and we review every new game version before it is published. If you think a game is collecting personal information, please report it.

How we use information

We use information to:

  • provide and operate the Service, including remembering your preferences and keeping creators signed in;
  • protect the Service and its users, prevent abuse, and fix problems;
  • show play counts on games;
  • review content, enforce our policies, and handle reports, copyright notices, and appeals;
  • communicate with creators about their accounts, their games, and changes to our terms, and respond to messages; and
  • comply with the law and respond to legal requests.

We do not use personal information for advertising or to build profiles of players. If we send creators promotional emails, they will comply with the CAN-SPAM Act and include a way to unsubscribe.

How we share information

We disclose information only in these situations:

  • Service providers. Our content is hosted on servers in North America and delivered through Cloudflare, our content delivery and security provider. These providers process information, such as IP addresses, on our behalf to run and protect the Service.
  • Public content. Anyone can see channel profiles, published games, and their listings.
  • Copyright process. We may send a copy of a copyright notice to the creator whose content it concerns, and, as the law requires, we forward counter-notices to the person who submitted the original notice. These documents include the sender's contact details.
  • Child safety. As U.S. law requires, we report apparent child sexual abuse material, along with related account information, to the National Center for Missing & Exploited Children (NCMEC).
  • Legal and safety reasons. We may disclose information when required by law or legal process, or when needed to protect the rights, property, or safety of PixelJS, our users, or others.
  • Business transfers. If PixelJS is involved in a merger, acquisition, or sale of assets, information may be transferred as part of that transaction, subject to this policy.

Cookies

Players get no tracking cookies. PixelJS sets only these cookies:

  • pjs_prefs (preference cookie, set on pixeljs.com and its subdomains): remembers display preferences, such as theme and theater mode. We set it only when you change a preference.
  • __Host-pjs_session (strictly necessary, set only on app.pixeljs.com): keeps creators signed in. It expires after a period of inactivity or after 30 days.

Our content delivery and security provider, Cloudflare, may set strictly necessary security cookies (such as __cf_bm or cf_clearance) to tell people from automated abuse; they are not used for advertising or to track you across sites. During the beta, we use no other third-party cookies and no analytics or advertising cookies.

You can block or delete cookies in your browser settings. Without pjs_prefs, your preferences will not be remembered, but you can still play games. Without __Host-pjs_session, creators cannot sign in.

Children's privacy

PixelJS is a general-audience service. Some games may be suitable for children, but we do not knowingly collect personal information from children under 13, consistent with the Children's Online Privacy Protection Act (COPPA). Players do not have accounts, and games are not allowed to collect personal information. The technical information our servers receive from every visitor, such as IP addresses in server logs, is used only to support the internal operations of the Service, such as security and troubleshooting.

If you are a parent or guardian and believe your child has given us personal information (for example, in a report), contact us through our contact page, and we will delete it.

How long we keep information

  • Server and security logs: up to 90 days.
  • Play statistics: the raw data used to derive visitor keys is discarded, and keys cannot be linked across days.
  • Creator account data: while the account is active and for up to 90 days after it is deleted.
  • Reports and messages: as long as needed to handle them.
  • Records we must keep: moderation decisions, copyright notices, and information under a legal hold, as long as needed, even after an account is deleted.

Security

Our safeguards include isolating games in a sandbox, storing passwords only as salted Argon2id hashes, limiting the session cookie to app.pixeljs.com, and keeping logs only for a limited time. No system is perfectly secure, however. To report a security issue, use our contact page, which is also listed in our security.txt file.

Your rights

You can ask us to:

  • access the personal information we hold about you;
  • correct inaccurate personal information;
  • delete your personal information; or
  • provide a copy of your personal information in a portable format.

Some U.S. state privacy laws, such as the California Consumer Privacy Act (CCPA) as amended by the CPRA, give residents these rights by law.

To make a request, use our contact page. We will verify your identity before acting, for example by asking you to confirm information we already have. You may use an authorized agent, and we may ask for proof of the agent's authority. We will respond within the time required by law. If we decline a request, we will explain why, and you can appeal through our contact page.

Because players do not have accounts, we usually hold little or no information that we can link to a particular player.

We will not discriminate against you for exercising your privacy rights.

Your privacy choices

  • No sale, sharing, or targeted advertising. We do not sell personal information, share it for cross-context behavioral advertising, or use it for targeted advertising, so there is nothing to opt out of today. If we introduce advertising, we will update this policy before it starts.
  • Global Privacy Control. We honor Global Privacy Control (GPC) signals as a request to opt out of the sale or sharing of your personal information. Because we do neither, a GPC signal does not change anything today.
  • Do Not Track. We do not track visitors across other websites, so there is no tracking for a Do Not Track signal to turn off.
  • Cookies. You can block or delete the pjs_prefs cookie and still play games.

International visitors

PixelJS is operated from the United States, and our content is hosted in North America and delivered through Cloudflare's global network. If you use the Service from elsewhere, your information will be processed in the United States and in other countries where we or our service providers operate.

Changes to this policy

We may update this policy from time to time. We will post the updated policy on this page with a new effective date and give notice on the site of any material change.

Contact us

For privacy questions or requests, use our contact page.