Privacy Policy
Last Updated: September 2026
This Privacy Policy explains what data Artixie ("we", "our", "us") collects when you use our game and website ("the Service"), how that data is used, with whom it may be shared, and what rights you have over it.
"Personal data" in this policy means any information that can directly or indirectly identify you, such as your email address, nickname, IP address, or profile content.
1. Who We Are
Artixie is an online multiplayer drawing and guessing game available at Artixie.com. For questions about this policy or your data, contact us at ArtixieGame@gmail.com.
2. Data We Collect
2.1 Account Data (Registered Users Only)
When you log in through Google OAuth 2.0, we receive and store:
- Google account ID
- Email address
- Display name
- Profile picture URL
You also provide or generate:
- Nickname (chosen once during setup, 3–18 characters)
- Biography (up to 160 characters, optional)
- Country code (optional, chosen by you)
- Profile picture selection (index from our built-in collection, or your Google picture)
- Post visibility preference (public, friends, or private)
- Total score, total wins, and per-room-type scores
2.2 Session Data
When you log in, we create an authentication session stored in our database with a 30-day expiry. A cookie named auth_session is set in your browser (HttpOnly, SameSite=Strict) to identify this session on subsequent requests. Session rows store: session ID, user ID, creation time, expiry time, and last-seen timestamp.
2.3 Gameplay Data (All Players)
Whether you play as a guest or with an account, we process:
- IP address: used to enforce per-lobby connection limits, prevent abuse, and rate-limit drawing view counts. Guest players are identified by IP and nickname for session continuity within the same lobby.
- Nickname: for guests, prefixed with
~to distinguish from registered accounts. - Lobby and room data: room name, room type (general, food, animals, objects, verbs), language, and player scores during sessions. This data is held in memory and is not persisted after the session ends, unless you are a registered user earning ranked points.
- Lobby reservation tokens: created when you attempt to enter a room, to prevent exploits.
- Report session ID: a cookie named
report_sessionused to prevent duplicate drawing-cancellation votes within a single session. - User session cookie: a cookie named
usersessionused to identify your in-game player slot during a lobby session.
2.4 User-Generated Content
Registered users may create and store:
- Lobby drawings: the word being drawn, room name and type, language, stroke data, a server-generated PNG thumbnail (320×180), description, and view/display counts.
- Art drawings: title, description, tags, status (incomplete or finished), stroke and layer data, a server-generated PNG thumbnail (320×180), and view/display counts.
- Wall posts: text messages (up to 500 characters) written on your own profile or on a friend's profile, with configurable visibility.
- Comments on art drawings: text comments (up to 160 characters) on art drawings.
- Reactions: "paint" and "throw heart" reactions (and any others) sent to other players in-game. When both sender and recipient are registered users, the reaction type and date are stored to generate a daily reputation display.
- Likes: records of which drawings you have liked (lobby or art type).
- Drawing reports: reason text (up to 160 characters) submitted when reporting a drawing for review.
- Featured phrases: text (up to 160 characters) that daily and weekly winners may optionally publish on the exhibition page.
2.5 Contact and Suggestion Data
If you submit a suggestion through our suggestions page, we collect:
- Name (optional)
- Email address
- Category selection
- Suggestion text (up to 2,000 characters)
Suggestion content and your email are sent to our internal email address for review.
If you request account deletion by email confirmation, we send a deletion confirmation link to your registered email address. The associated token (stored in the database) expires after 1 hour and is consumed upon use.
2.6 Browser-Side Storage
We use the following client-side storage mechanisms:
| Storage type | Key | Purpose | Persists after tab close? |
|---|---|---|---|
localStorage |
sound |
Sound effects on/off preference | Yes |
localStorage |
theme |
Lobby background theme preference | Yes |
localStorage |
chatColor |
Chat color theme preference | Yes |
sessionStorage |
afk_disconnect |
Flag to show AFK disconnect message on homepage | No (tab session only) |
| Cookie | preferred_language |
UI language preference (1-year expiry) | Yes |
| Cookie | auth_session |
Authentication session (30-day expiry, HttpOnly) | Yes |
| Cookie | usersession |
In-game player slot identifier (session) | Session |
| Cookie | report_session |
Drawing report deduplication (24-hour expiry, HttpOnly) | Yes |
| Cookie | pending_setup |
Temporary Google OAuth data during profile setup (30-minute expiry, HttpOnly) | Yes |
| Cookie | oauth_state |
CSRF protection during OAuth login flow (5-minute expiry, HttpOnly) | Yes |
The localStorage keys listed above store only your locally chosen preferences. They do not contain account identifiers and are not transmitted to our servers.
2.7 Analytics and Advertising
We use Google Analytics to collect aggregated usage data such as page visits, session duration, and general traffic patterns. Google Analytics may set its own cookies. Google's privacy policy is available at https://policies.google.com/privacy.
We display third-party advertisements, including ads served by advertising networks such as Adsterra. These third-party vendors may use cookies, web beacons, or similar technologies to serve and measure ads based on a user's visits to our website or other websites. We do not control these technologies directly.
2.8 Canvas API
The drawing board uses the HTML5 Canvas API to capture and transmit drawing strokes. Canvas output is used for rendering drawings and generating thumbnails server-side.
3. How We Use Your Data
We use the data described above to:
- Operate and deliver the game and its features
- Authenticate your identity and maintain your session
- Calculate and display rankings, scores, achievements, and veteran badges
- Enable social features: friendships, wall posts, notifications, drawing galleries, and the exhibition page
- Generate server-side drawing thumbnails for display in galleries and the homepage
- Enforce community rules and review reported content
- Prevent abuse through rate limiting (messages, comments, views, suggestions, room joins)
- Send transactional emails (account deletion confirmation, suggestion notifications)
- Analyze service usage and improve performance through aggregated analytics
- Display contextual or interest-based advertising
4. Lawful Basis for Processing
Depending on your region, our processing relies on:
- Contract performance: to provide you with account features, game access, and profile functionality you have requested.
- Legitimate interests: to maintain security, prevent abuse, enforce our rules, and improve the Service — in ways that do not override your fundamental rights.
- Legal compliance: to meet obligations under applicable law.
- Consent: for analytics and personalized advertising, where required by applicable regulation.
5. Data Sharing and Third Parties
We do not sell your personal data.
We share data only with service providers who assist us in operating the Service:
- Hosting and infrastructure providers: for database storage and server operation.
- Google (OAuth 2.0): for authentication. Google's privacy policy governs data processed on their side.
- Google Analytics: for aggregated usage analytics. See https://policies.google.com/privacy.
- Advertising partners (including Adsterra): to serve ads and measure their performance. These partners may collect data through cookies independently.
- Email delivery (SMTP): to send account-related transactional emails.
These providers are restricted from using your data for independent purposes beyond what is necessary to perform the services we have engaged them for.
We may disclose data when required by law, court order, or to protect the rights, safety, or property of Artixie, its users, or others.
Aggregated or anonymized data that cannot reasonably identify any individual may be shared or published without restriction.
6. Data Retention
| Data type | Retention period |
|---|---|
| Account and profile data | Until account deletion |
| Auth sessions | 30 days from creation, or until logout |
| Lobby drawings | Until deleted by user or admin |
| Art drawings | Until deleted by user or admin |
| Wall posts | Until deleted by author or target |
| Drawing likes and reactions | Until deleted by user or account deletion |
| Drawing reports | Retained after review for audit purposes |
| Notifications | Until read and cleared, or account deletion |
| Deletion tokens | 1 hour, consumed on use |
| Pending OAuth setup cookie | 30 minutes |
| Reservation tokens | It may vary from a few seconds to a few minutes. (in-memory only) |
| Expired auth sessions | Cleaned daily by automated scheduler |
| Suggestion form content | Retained for internal review; contact us to request deletion |
When you delete your account, your user record and all directly associated content — drawings, wall posts, comments, likes, notifications, sessions, reactions, and friendships — are deleted via database cascade. Drawing reports you submitted may be retained in anonymized form for moderation purposes.
7. Data Security
We implement reasonable technical and organizational measures to protect your information, including:
- HTTPS encryption for all client-server communication
- HttpOnly and SameSite cookie attributes to mitigate session hijacking
- Cryptographically random session and token generation
- Server-side input validation and sanitization
- Rate limiting on messages, drawing events, comments, and API endpoints
- Admin-mode access controls requiring explicit activation for privileged operations
- Segregated database access with restricted credentials
No method of transmission or storage is completely secure. We cannot guarantee absolute protection against unauthorized access or disclosure.
8. Your Rights
Depending on your location, you may have the right to:
- Access: obtain a copy of personal data we hold about you.
- Rectification: request correction of inaccurate data. Display name, bio, and country are editable directly in your profile settings.
- Deletion: delete your account and associated data from within your profile settings.
- Portability: receive your data in a structured, machine-readable format where technically feasible.
- Objection: object to processing based on legitimate interests.
EEA / EU users: The above rights apply under the General Data Protection Regulation (GDPR). You may also lodge a complaint with your national supervisory authority.
Brazilian users (LGPD): You may request confirmation, access, correction, anonymization, portability, or deletion of your data by contacting us.
California users (CCPA/CPRA): We do not sell personal information. You may request disclosure of the categories of data we share with third parties for business purposes.
To exercise any of these rights, contact us at ArtixieGame@gmail.com. We may ask you to verify your identity before processing your request. Some data may be retained despite a deletion request where required by law or for legitimate operational reasons such as fraud prevention.
9. Children's Privacy
The Service is not directed to children under 13 years of age, and users must be at least 13 years old to use it, as stated in our Terms of Service. We do not knowingly collect personal data from children under 13. If we learn that we have collected personal data from a child under 13, we will delete it promptly. If a parent or guardian believes their child has created an account or submitted personal data through the Service, please contact us at ArtixieGame@gmail.com and we will delete the relevant data promptly.
Users between 13 and 17 years of age should use the Service only with parental or guardian supervision.
10. Cookies Summary
A summary of cookies we set directly:
| Cookie | Purpose | Duration | HttpOnly |
|---|---|---|---|
auth_session |
Authentication session | 30 days | Yes |
usersession |
In-game player slot | Browser session | No |
report_session |
Drawing report deduplication | 24 hours | Yes |
pending_setup |
Temporary OAuth profile data | 30 minutes | Yes |
preferred_language |
UI language preference | 1 year | No |
oauth_state |
CSRF protection during OAuth flow | 5 minutes | Yes |
Third-party cookies from Google Analytics and advertising partners may also be set. You can configure your browser to block or delete cookies, though doing so may affect Service functionality. We do not respond to Do Not Track (DNT) browser signals at this time.
11. Changes to This Policy
We may update this Privacy Policy periodically. When we do, we will revise the "Last Updated" date at the top of this page. Continued use of the Service after changes are posted constitutes acceptance of the revised policy. We encourage you to review this page periodically.
12. Contact
For any privacy-related questions, requests, or concerns, contact us at:
ArtixieGame@gmail.comThis policy replaces and supersedes all prior privacy policies related to Artixie.