Privacy

Last updated 2 November 2026

Short version: we ask for your email once, to check it's really yours and to unlock the games. We only send news if you tick the box. We never sell or share your email, we don't show ads, and the games don't use cookies.

Who we are

Pinky Cloud makes small, free escape-room games for the browser. You can reach us at pinkycloud@mail.grokbot.com about anything on this page.

Your email and the 6-digit code

On a game's start screen you type your email address. Here is exactly what happens to it:

1. The game sends it over an encrypted (HTTPS) connection to our small verification service, which runs on Cloudflare Workers.
2. That service emails you a 6-digit code using our email provider, Resend. The email comes from codes@play.pinkycloud.net. The code expires after 10 minutes.
3. While a code is pending, the service keeps only a scrambled fingerprint of your address (a keyed hash, not the address itself), a hash of the code, the times codes were sent and the number of attempts. This is used to stop abuse and is deleted automatically 25 hours after it was last used.
4. When you type the right code, the service adds your email to our mailing list at Kit (ConvertKit), noting whether you ticked the news box and which room you registered from.

To limit abuse, Cloudflare counts requests per network address for a short time. We don't store your IP address ourselves.

News emails

The box “Send me news about new Pinky Cloud rooms” is optional and unticked. If you don't tick it, you won't get news from us. If you do, we'll write when a new room opens (about once a month at most). Every email has an unsubscribe link, and unsubscribing takes effect straight away.

What stays in your browser

The games save your progress and a small “registered” note in your browser's local storage, so you don't have to register again. That note records when you registered, whether you ticked the news box, which room you started in, and a signed token that proves the code was checked. It does not contain your email address. Clearing your browser's site data removes it. The games don't set cookies.

Anonymous game statistics

To learn which puzzles are too hard and where people stop, the games send anonymous events (for example “room started”, “hint used”, “puzzle solved”) to PostHog, an analytics service, using its EU servers. These events:

• never include your email address or name;
• use a random ID that lives only in memory for one visit (no cookies and no stored ID, so visits can't be linked together);
• don't build a profile of you, and we've switched off location lookup from your IP address.

This website also counts one anonymous page view per page in the same way. It skips that if your browser sends “Do Not Track” or “Global Privacy Control”. PostHog keeps these events for up to one year.

Who handles data for us

• Cloudflare: hosts this website and the verification service.
• Resend: sends the code emails.
• Kit: keeps the mailing list and sends news emails.
• PostHog (EU): anonymous game statistics.
• itch.io: hosts and serves the games. When you play on itch.io, its own privacy policy applies to what itch.io collects.

Some of these services are in the United States or other countries. They only process data to provide their service to us.

Why we use it (legal basis)

We use your email to give you the free games you asked for (registering and the code) and, only with your consent, to send news. Anonymous statistics are in our legitimate interest in making the games better, and contain nothing that identifies you.

How long we keep it

• Code check data: deleted automatically 25 hours after last use.
• Your email on our list: until you unsubscribe and ask us to delete it, or until we stop making games.
• Anonymous statistics: up to one year.

Your choices and rights

You can unsubscribe from news at any time with the link in any email. You can ask us to show, correct or delete everything we hold about your email by writing to pinkycloud@mail.grokbot.com from that address. We'll reply within 30 days. You can also complain to your local data-protection authority.

Children

The games are family-friendly, but registration is meant for people old enough to agree to it where they live (in many places, 16; in Australia and the US, 13). Younger players should ask a parent to register.

Changes

If this page changes in a way that matters, we'll update the date at the top and, if you get our news, tell you there.