Privacy Policy

Last Updated: September 27, 2026

1. Introduction

This Privacy Policy describes how pictopos ("pictopos," "we," "us" or "our") collects, uses and discloses information about you when you access or use the website located at pictopos.com, the pictopos game and related services (collectively, the "Service"). Capitalized terms not defined here have the meanings given in our Terms of Service.

We do not sell personal information, and we do not share personal information for targeted advertising.

2. Information We Collect

2.1. Information You Provide

• Waitlist. When you join the waitlist, we collect your email address and the date and time of your signup.
• Communications. When you contact us, we collect your email address and the contents of your message.

2.2. Information Collected Automatically

• Technical data. When you visit the Service, our hosting provider, Cloudflare, Inc. ("Cloudflare"), receives technical information that your browser sends with every request, including your IP address, browser and device type, the page requested, the referring page and the date and time of the request, in order to deliver and protect the Service.
• Rate-limiting data. To prevent abuse of the waitlist, we record a salted, one-way hash of your IP address (not the address itself) when you submit the waitlist form.
• Analytics. We use Cloudflare Web Analytics to measure page views, visits, referring websites, approximate country, device type and page performance. Cloudflare Web Analytics does not use cookies or local storage and does not fingerprint individual visitors; we receive aggregate statistics only.

2.3. Information Collected When the Game Is Available

When the game becomes available and you create an account, we will also collect:

• Account information: your email address, username and sign-in times;
• User Content and activity: your artwork, titles and drafts; the Plots you hold; likes you give and receive; Virtual Currency balances; and reports you submit;
• Security information: IP addresses and signals from Cloudflare Turnstile, such as browser characteristics, used to distinguish people from automated programs and to enforce our Terms; and
• Moderation records: reports concerning your User Content and our decisions on them.

We do not request or collect your name, telephone number, precise location, contacts or payment information.

3. How We Use Information

We use the information described above to:

• notify waitlist members when the Service launches;
• provide, operate and maintain the Service, including displaying User Content on the map, counting likes and operating leaderboards and feeds;
• create, authenticate and secure accounts, and send account-related messages such as sign-in links and notices that your Plots are about to return to the map;
• detect, prevent and respond to fraud, abuse, security incidents and violations of our Terms;
• understand, in aggregate, how the Service is used, and improve it;
• respond to your inquiries; and
• comply with legal obligations and enforce our rights.

4. Public Information

The Service is a public map. Your username, profile, published artwork and its title, the Plots you hold, like counts and leaderboard position are visible to anyone, including people who are not signed in, and may be indexed by search engines. Your email address, drafts, the likes and reports you submit, and your security information are not made public. Please do not include personal information in your username, artwork or titles.

5. Cookies and Similar Technologies

The pictopos website does not currently set cookies. When the game becomes available, we will use a single cookie that is strictly necessary to keep you signed in, and Cloudflare Turnstile, which processes the signals described in its Turnstile Privacy Policy solely to detect automated traffic. We do not use advertising cookies, tracking pixels or cross-site tracking technologies, and we do not permit third parties to track users on the Service or across other websites.

Do Not Track and Global Privacy Control. Because we do not track users across websites, sell personal information or share it for targeted advertising, we treat all visitors the same regardless of whether their browser transmits a Do Not Track or Global Privacy Control signal.

6. How We Disclose Information

We disclose personal information only in the following circumstances:

• Service providers. We use vendors that process information on our behalf and under our instructions, including Cloudflare (website hosting, waitlist storage, content delivery, domain name services, security, analytics and bot detection) and, when we send email, an email delivery provider. These providers may not use your information for their own advertising.
• Legal requirements. We may disclose information if we believe in good faith that disclosure is required by law, or is necessary to protect the safety of any person, to investigate fraud or abuse, or to protect the rights of pictopos. Where permitted, we will notify you before doing so.
• Business transfers. If pictopos is involved in a merger, acquisition, reorganization or sale of assets, information may be transferred as part of that transaction, subject to this Privacy Policy, and we will notify you beforehand.
• With your consent. We may disclose information for any other purpose with your consent.

7. Data Retention

• Waitlist email addresses are retained until six months after the Service launches, or until you unsubscribe or request deletion, whichever occurs first. If you create an account with the same address, it becomes part of your account information.
• Rate-limiting hashes are deleted after one hour.
• Technical data held by Cloudflare is retained in accordance with Cloudflare's policies; we receive aggregate statistics only.
• Account and game information is retained while your account is active. Upon account deletion, it is deleted or de-identified within 30 days, except for backups, which are overwritten within 90 days.
• Moderation and security records are retained for up to 12 months after the relevant event, or longer where necessary to establish, exercise or defend legal claims or to prevent a banned user from returning.

8. Data Security

We implement reasonable administrative, technical and physical safeguards designed to protect personal information, including limiting the information we collect, encrypting connections to the Service, hosting the Service with Cloudflare, and restricting access to stored information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If a security breach affects your personal information, we will notify you and the appropriate authorities as required by law.

9. Your Rights and Choices

Regardless of where you live, you may request that we:

• confirm whether we process your personal information and provide you with a copy;
• correct inaccurate personal information;
• delete your personal information; or
• stop sending you email, which you may also do by using the unsubscribe link in any message.

To make a request, email privacy@pictopos.com from the address associated with your information so that we can verify your request. We will respond within 30 days. We will not discriminate against you for exercising any of these rights.

10. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from children under 13, consistent with the Children's Online Privacy Protection Act. If we learn that we have collected such information, we will delete it. A parent or guardian who believes that a child under 13 has provided us with personal information may contact us at privacy@pictopos.com.

Users aged 13 to 17 must have the consent of a parent or guardian to use the Service. Users under 18 may remove artwork or text they have posted at any time, or request its removal by emailing privacy@pictopos.com. Removal from the Service does not ensure complete removal of copies made by others.

11. Notice to California Residents

This Privacy Policy is intended to comply with the California Online Privacy Protection Act, including its requirements to describe the categories of personally identifiable information we collect, the parties with whom we share it, the process for reviewing and requesting changes to it, how we notify users of changes to this Privacy Policy, how we respond to Do Not Track signals, and whether third parties may conduct online tracking on the Service (they may not).

The California Consumer Privacy Act applies to businesses that meet certain thresholds, which pictopos does not currently meet. We nonetheless extend to California residents the rights described in Section 9. We do not sell or share personal information, as those terms are defined under that law, and we do not use or disclose sensitive personal information. Under California Civil Code Section 1798.83, we do not disclose personal information to third parties for their direct marketing purposes. California residents under 18 may request removal of content they have posted as described in Section 10.

12. Notice to Users in the European Economic Area and United Kingdom

If you are located in the European Economic Area or the United Kingdom, pictopos is the controller of your personal information. We process personal information on the following legal bases:

• Consent, for the waitlist. You may withdraw consent at any time by unsubscribing.
• Performance of a contract, to provide your account and the Service you request.
• Legitimate interests, in securing the Service, preventing abuse and understanding aggregate usage. You may object to processing based on legitimate interests.
• Legal obligation, where we are required by law to retain or disclose information.

In addition to the rights described in Section 9, you may request that we restrict processing of your personal information or provide it to you in a portable format, and you have the right to lodge a complaint with your local data protection authority.

13. International Data Transfers

pictopos is operated from the United States. The Service is hosted on Cloudflare's global network, so technical data may be processed in other countries, and waitlist information is stored with Cloudflare in North America. If you access the Service from outside the United States, your information will be transferred to and processed in the United States, where data protection laws may differ from those of your jurisdiction. Where required by law, we rely on appropriate safeguards, such as our service providers' standard contractual clauses.

14. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. The "Last Updated" date above indicates when it was last revised. If we make material changes, such as collecting a new category of information or using information for a new purpose, we will notify you by email or within the Service before the changes take effect, and will obtain your consent where required by law.

15. Contact Us

If you have questions about this Privacy Policy or our privacy practices, please contact us at:

pictopos
privacy@pictopos.com