Privacy Policy

This Privacy Policy explains how PIXELFALLS ("we", "us", or "our") collects and processes personal data when you use our websites and services, including the marketing site at pixelfalls.co.uk, the IDE, the player, and related apps (together, the "Services").

This notice is intended to meet UK GDPR transparency requirements. It is not legal advice. We may update this policy from time to time; the "Last updated" date above will change when we do.

1. Who we are (data controller)

The data controller is the operator of PIXELFALLS, trading as PIXELFALLS and operating pixelfalls.co.uk.

For privacy requests (access, erasure, questions about this policy), contact us at privacy@pixelfalls.co.uk.

2. Personal data we collect

Depending on how you use the Services, we may process:

• Account data — email address, password (stored hashed by our auth provider), display name, and account identifiers.
• Billing data — subscription status, plan/tier, storage quota and usage, and Stripe customer/subscription identifiers. Payment card details are handled by Stripe and are not stored on our servers.
• Cloud game content — game carts and related metadata you save or publish (titles, descriptions, tags, versions, and cart files).
• Support / feedback — bug reports, messages, and feedback you submit (including via the Bugs app).
• Marketing email — email address if you join the early-access / updates list on the marketing site.
• Technical and usage data — IP address and device/browser information as typically processed by hosting providers; performance telemetry via Vercel Speed Insights on the IDE (see Cookies below).
• Local device data — game projects, editor preferences, and similar data stored in your browser (localStorage / sessionStorage). Guest-mode games stay on your device unless you sign in and save to the cloud.

3. Why we process data (purposes and lawful bases)

• Provide the Services (accounts, cloud save, publishing, billing) — contract / steps prior to contract.
• Security, abuse prevention, and service integrity — legitimate interests.
• Improve the product (including alpha feedback and performance monitoring) — legitimate interests.
• Send marketing / early-access updates when you subscribe — consent (you can unsubscribe at any time).
• Legal and accounting obligations related to paid subscriptions — legal obligation / legitimate interests.

4. Processors and subprocessors

We use trusted third parties to help run the Services, including:

• Supabase — authentication, database, and file storage for accounts and cloud carts.
• Stripe — payment processing and subscription management.
• Vercel — hosting and delivery of the websites/apps; Speed Insights for performance telemetry on the IDE.
• EmailOctopus — marketing / early-access email list on the marketing site.

These providers process data on our instructions (or as independent controllers where that applies, e.g. aspects of Stripe payments). Some may process data outside the UK/EEA; where they do, appropriate transfer safeguards (such as standard contractual clauses) are expected under their terms.

5. Retention

• Account and cloud data — kept while your account is active. If you delete your account in the IDE (Account → Danger Zone), we delete your auth user, profile data we control, and associated cloud cart storage as part of that process.
• Billing records — Stripe may retain payment and subscription records as required for their services and legal obligations after cancellation.
• Marketing list — until you unsubscribe or we remove the list entry.
• Local browser data — until you clear site data or uninstall/clear the browser storage.

6. Your rights

Under UK GDPR you may have rights to access, rectify, erase, restrict, or object to certain processing, and to data portability where applicable. You may also lodge a complaint with the UK Information Commissioner's Office (ICO).

In the IDE you can delete your account (erasure of account and cloud games we store). You can also export individual games as PNG carts from the editor. For other requests, email privacy@pixelfalls.co.uk.

7. Cookies and similar technologies

We use cookies and similar storage technologies that are needed to run the Services, plus limited performance measurement. We do not currently use third-party advertising or marketing tracking pixels on the IDE.

• Strictly necessary — authentication/session cookies (Supabase), guest-mode flags, and related auth flow cookies so you can sign in, stay signed in, and use guest mode.
• Local storage — editor state, preferences, and alpha-terms acceptance on your device (not sent as HTTP cookies).
• Performance — Vercel Speed Insights on the IDE to understand load/performance. This helps us keep the product usable and is described here for transparency.

Because we currently rely on necessary cookies plus this limited performance tooling (and not advertising trackers), we do not show a separate cookie consent banner. If we introduce non-essential marketing or analytics cookies, we will update this policy and, where required, request consent.

You can control cookies through your browser settings; blocking necessary cookies may prevent sign-in or other features from working.

8. Children and schools

PIXELFALLS is intended for learners of all ages, including use in schools and other educational settings as a creative coding and game-making tool.

If you are under 13 (or under the digital consent age where you live), please only create an account or provide personal data with a parent or guardian's involvement, or through a school or organisation that has arranged access for you. Parents, guardians, and schools may contact us at privacy@pixelfalls.co.uk about a child's account or data.

Where a school or similar organisation provides PIXELFALLS for students, that organisation may act as a controller for how accounts and classroom use are organised; we process data as described in this policy to provide the Services.

9. Related documents

Use of the Services is also governed by our Terms of Service.