Privacy Policy

Pixel Rewind Player collects as little as it can. This page sets out exactly what the app stores, what leaves your device and why, who receives it, and what it never touches.

Who this applies to

This policy covers the Pixel Rewind Player application for Android, iOS and Linux (“the app”), the online game server we run for it, and this website. In this policy, “we” means the developer of Pixel Rewind Player, who is the controller of the personal data described here. Contact details are at the end of this page.

What the app stores on your device

The following is held in the app's own private storage on your device. We cannot read it, and it is only transmitted as described in the sections below.

• Game files you import. When you point the app at a game, it copies the files it needs into its own storage so it can run them. These files are never uploaded.
• Your settings. Screen orientation, layout size, control choices, language, sound and the other options on the settings screen.
• Game saves and progress. Whatever the game itself writes, kept where that game expects it.
• Your online identity. Your online name, the account identifier the server knows you by, and a random device key that proves to the server that this device may change your name, and which version of the online rules you accepted.

If you use Export saved data, the app writes your saves, records and online identity into a file and hands it to wherever you choose to keep it. That file is yours; we never see it.

On Android, the system's own backup may copy the app's storage to your Google account, if you have backup turned on. That backup is between you and Google; we have no access to it.

Crash and error reports

When the app crashes, or when something goes wrong without crashing it — the emulated game stopping, a lost connection to the server, a screen layout that fails to build — the app sends a report to Sentry, a crash-reporting service operated by Functional Software, Inc. We use Sentry's EU data region, so reports are stored in Germany.

A report can contain:

• Technical details of the failure: the error, a stack trace and the app's recent internal log, up to 32 KB of text. That log can mention the guest name you are using online, the server you connected to and the game you were running.
• Device and app details: the app version, device model, operating system version, screen size, memory use, language setting and similar technical facts.
• What was running: which game type and screen layout, and whether an online match was in progress.
• The structure of the app's screen at the time of the failure: which of the app's buttons and panels were showing. No screenshot is taken.
• A trail of recent actions (“breadcrumbs”): which screens were opened and which buttons were pressed before the failure. Text you type is not recorded.
• A random installation identifier that Sentry's library creates, so repeat problems on one device can be told apart from problems on many. It is not linked to your name or to any account.

On Android 11 and later, when the app starts, it also reads the system's record of how its previous run ended. That lets it report cases where the system closed it unexpectedly, for example for running out of memory.

Sentry's servers see your device's IP address when a report is sent, as any internet server does, but they are set not to store it. Reports are sent over an encrypted connection. The app does not measure its own performance or record how you use it beyond the trail of actions in a report.

Why: the app runs old games on a wide range of phones, tablets and TVs we will never own, and a report is often the only way to learn that something broke and why. Our legal basis is our legitimate interest in keeping the app working (Article 6(1)(f) GDPR). Sentry deletes reports automatically after at most 90 days.

To fix faults faster, the technical part of a new kind of report — the error, stack trace, device details, recent actions and log — is passed to Jules, Google's AI coding assistant, which looks for the cause in our source code and proposes a fix for us to review. IP addresses are removed first, and so is the part of the report about the user. The log can still contain the online name you were using. What Jules is given stays in our Jules account as part of that fix. The same applies to the game server's own fault reports.

You can turn crash reporting off. In the Android and iOS apps, open Settings and then Privacy, and switch off Send crash and error reports; in the Linux app, switch off Crash reports on the settings page. It is on until you do. Switching it off takes effect at once: the app stops Sentry, so nothing more is caught or sent, and it deletes any report it had kept to send later. A crash from the time it was off is not sent if you switch it on again. The settings can be opened from the game screen, so reports about the very first start of a game can be sent before you have had the chance. You also have the right to object to crash reports (see “Your rights”), and the app sends nothing while your device is offline.

Online play

If you only play on your own, the app makes no connection to the game server. Crash reports, described above, are the only thing it may send.

When you use a game's online modes, the app connects to a game server. By default that is the server we run for the app, on a cloud server rented from Hetzner in Helsinki, Finland. For games whose original servers no longer exist, this is a community-built replacement. You can also point the app at a different server, and that server's operator then decides what it records.

Your online name

There is no sign-up: you never give us an e-mail address, a password, your real name or any other contact detail. The first time you play online, your device is given a randomly generated name, which you can later change to one you choose (1 to 15 letters, digits or underscores). The server keeps a record under the name you first played with, so your matches stay together when you change it. Please do not use your real name or anything that identifies you.

Other players in your lobby, room or match see your online name, and it appears beside your results in the rankings and statistics that other players can view in the game. It is also shown to anyone who opens the replay page on this website (see “This website”). We can change a name that breaks the rules in the terms.

Rooms

Some games let you create a room and share its six-character code so friends can join. Anyone who has the code can join while the room is open, so share it only with the people you want to play with. The code, and the guest names of those in the room, pass through our server.

Chat

Where a game has chat, you do not type messages: you pick one of a fixed list of phrases, such as “Good game!”, and the other players in your match see it in their own language. The server relays which phrase you picked, and stores it as part of the match's recording (see below), so we can replay a match to find a fault. Nothing you type is sent as chat.

What the server receives

• Your online name, the account identifier the app sends with it, and a device key that proves which device may change that name.
• Your IP address, which any internet server sees when you connect.
• Match traffic: the moves you make, the hero you pick, the results, and the chat phrases you pick.
• Rooms you create or join, and their codes.
• The version of the online rules you accepted, which the app sends each time it goes online.

What the server keeps

The server keeps a database so that it can run rankings and statistics, settle disputed results, and investigate faults and reports of abuse. It holds:

• A player record: your account identifier, your current online name, when you first and last played online, how many times you have logged in, when you last changed your name, and which version of the online rules you accepted and when.
• A one-way hash of your device key, never the key itself, so the database cannot be used to rename you.
• Every match you play: the map, the players and their online names, the heroes, the results, captures, and the fame each player won or lost.
• A recording of each match: everything the players sent during it, in order, with the time and the sender — moves, and also the chat phrases picked — plus the record of game events that the players' apps send at the end of a match.

The database does not store IP addresses. These records are kept for as long as the online service runs, because rankings are rebuilt from the full match history. The exception is an account you have never renamed: if you go online under the randomly generated name and do not go online again for 10 days, we delete the player record and its device keys, and the matches you took part in stay as described under “Deleting your data”. You can also ask us to delete yours at any time (see “Deleting your data”).

Separately, the server keeps an operational log of connections and matches so we can find and fix faults, such as a match that froze. It can include IP addresses, and when detailed logging is switched on to investigate a problem, the full content of match traffic, chat included. The log has a fixed maximum size: once it is full, the oldest entries are deleted as new ones arrive, and the whole log is erased whenever the server is updated. The server also reports its own faults to Sentry.

Match announcements on Telegram

When it is switched on, the server posts to a group on Telegram that players can join, so that someone waiting for an opponent can be found. A post says that a player, by online name, is waiting for a match, and is updated when that player leaves the queue, when the match starts with the other players' online names, and with the result. Only the online name is posted, never anything else about you. Posts stay in the group until they are deleted; we delete posts that name you if you ask.

Why: to connect you with other players, run the match and keep your rankings, which is the service you asked for (Article 6(1)(b) GDPR). We also do it to keep the service working and free of abuse, which is our legitimate interest (Article 6(1)(f) GDPR).

Please note: the online protocol these games use was designed in 2008 and does not encrypt its traffic. Your guest name, moves and chat travel between your device and the server unencrypted, as they did on the original service.

What the app does not do

• No advertising and no advertising identifiers.
• No usage analytics or behavioural profiling. Crash reports exist only to fix faults.
• No selling of personal data, and no sharing of it with anyone for marketing.
• No screenshots of your screen.
• No access to your contacts, location, camera, microphone, call logs or messages. The app does not request those permissions and cannot use them.
• No upload of the games you import.

Permissions

Android

• INTERNET — to reach the game server when you play online, and to send crash reports.
• FOREGROUND_SERVICE, FOREGROUND_SERVICE_SPECIAL_USE and WAKE_LOCK — to keep an online match, or an open-source game, running while you briefly switch to another app, so that the other players' match does not stall.
• POST_NOTIFICATIONS — to show the notification Android requires while a game keeps running in the background.

iOS

• Local network — asked for only if you set a game server on your own local network.
• Add to Photos — asked for only if you save an icon picture to your photo library. The app cannot read your photos.

Choosing a game to import uses the system's own file picker, which gives the app access only to the file or folder you pick, at the moment you pick it.

Who receives your data

• Sentry (Functional Software, Inc.) processes crash and error reports on our behalf, in its EU data region. Sentry is a US company, so some access from the United States may occur; that access is covered by the EU–US Data Privacy Framework and the European Commission's standard contractual clauses.
• Google (Google LLC, through Jules) receives the technical part of some error reports, with IP addresses removed, to help us find and fix the fault. Google is a US company; the transfer is covered by the EU–US Data Privacy Framework.
• Hetzner (Hetzner Online GmbH) hosts the game server on our behalf, in its data centre in Helsinki, Finland, so the server's data stays in the EU.
• Telegram (Telegram Messenger Inc.) carries the match announcements described above, which show online names to the members of the group.
• Other players see your online name, your chat messages, and your results in the rankings, as part of playing with you.

We do not give your data to anyone else, unless the law requires us to.

Accounts

Sign-up is not open: playing online needs no e-mail address and no password. The player record described under “What the server keeps” is the only account there is. Before any sign-up with contact details is possible, this policy will be updated to say what it collects and why.

Children

The app is not directed at children under 16. Online play needs no real name, e-mail address or other contact detail, and we do not knowingly collect personal information from children. If you believe a child has sent us personal information, contact us and we will delete it.

Your rights

Under the GDPR you have the right to ask for access to the personal data we hold about you, and to ask us to correct it, delete it, restrict its use or give it to you in a portable form. You also have the right to object to processing that is based on our legitimate interests, which covers crash reports, server logs and the recordings of matches. Crash reports you can also switch off yourself, in the app's settings. To use any of these rights, write to the address below.

We hold very little that points to you, so it helps to tell us your online name, roughly when you played, or your device model. If you are not satisfied with our answer, you may complain to a data protection authority. In the Netherlands that is the Autoriteit Persoonsgegevens; you may also go to the authority where you live.

Deleting your data

Uninstalling the app removes everything it stored on your device, including imported games, settings, saves and your online identity. On Android you can also clear the app's data from Settings without uninstalling. On iOS, deleting the app has the same effect. On Linux, deleting the app's data directory does.

Uninstalling does not reach the game server. To have your player record, your device-key hash and your name removed from the server's match records, e-mail us your online name from the address below, which you can copy from the app's settings (Your online name). We delete the player record and its device keys, so the server no longer knows you as a player and your matches stop counting towards any ranking. The records of matches you took part in stay, because the other players' rankings are built from them; they keep the online name that was shown in each match, and their recordings keep what was sent in it. Choosing an online name that does not identify you keeps those records anonymous from the start.

A player record that was never given a chosen name is deleted on its own, in the same way, 10 days after the last time it went online. Crash reports and server logs are deleted on their own, as described above. You can ask us to delete them sooner, and to delete Telegram posts that name you.

This website

This site is a set of static pages with no accounts, no comments and no forms. It sets no cookies and runs no analytics. It loads a web font from Google Fonts, which means your browser requests that font file from Google's servers, and Google sees the IP address making the request; nothing else is sent. The site is hosted on GitHub Pages, and GitHub may keep server logs of requests as part of operating the service.

The replay page

The replay page lets anyone watch a recorded online match again, without an account. For that, your browser contacts our game server directly to fetch the list of matches and the match you open, so the server sees your IP address, as it does for any request. The list is public: for each match it shows the map, the date, the result, and the online names and heroes of the players, and anyone can look up the matches of a player by typing part of their name. A replay is the match's recording (the moves, and the chat phrases players picked), which the game then plays back in your browser. This is the same record the server keeps for rankings and fault-finding (see above), now also open to the public; it contains no e-mail address, real name or IP address. Deleting your player record (see “Deleting your data”) does not take a match you already played off the page, because the match keeps the name that was shown in it. If a name there identifies you, write to us and we will look at it.

The page runs the game in your browser as WebAssembly. The game files you give it are read from your disk into your browser's own storage (IndexedDB) so you need not choose them again, and are never uploaded. A setting or two (such as the licence tick) are kept in the browser's local storage. Remove the game from the page, or clear this site's data in your browser, to delete them.

Changes to this policy

If this policy changes, the date at the top of the page changes with it. Material changes to what the app collects will be described here rather than made quietly.

Contact

Questions about this policy, or any request concerning your data, can be sent to support@jubinganga.com.