Privacy Policy

Excapaint ("we", "us") is a free daily game in which you excavate a famous painting. This policy explains what information we collect, why, and what choices you have. You can play anonymously — if you never sign in, we store no personal information about you on our servers.

Information we collect

• Account email.If you choose to sign in, we collect your email address. We use it only to send your one-time sign-in ("magic") link and to identify your account. We never sell it.
• Gameplay data.When you're signed in, we save your results for each painting — your integrity score, how many tiles were damaged, and brushes used — linked to your account so we can power your personal museum and stats.
• Technical data. Our hosting and infrastructure providers process standard request data (such as IP address, browser type, and timestamps) transiently to keep the service secure and reliable.

We do not collect payment information, and we do not run third-party advertising or cross-site tracking.

Cookies & local storage

We use a single essential session cookieto keep you signed in. We also store a small flag in your browser's local storage so the "how to play" guide only appears once. We do not use advertising or cross-site tracking cookies.

How we use your information

• To run the game and keep you signed in;
• To save your results and build your museum and stats;
• To keep the service secure, reliable, and free of abuse;
• To respond to your questions or requests.

Service providers

We rely on a few providers who process data on our behalf: Supabase (authentication, database, and image storage), Vercel (hosting and content delivery), and Upstash (rate limiting). Your data may be processed on servers located outside your country. We also use Anthropic to generate art "fun facts" from public museum information — this does not involve your personal data.

Data retention

We keep your account and gameplay data for as long as your account is active. You can ask us to delete it at any time (see below).

Your rights

You can request access to, correction of, or deletion of your personal data by emailing us at contact@excapaint.com. Depending on where you live, you may have additional rights under laws such as the GDPR or CCPA.

Children

Excapaint is not directed to children under 13, and we do not knowingly collect their personal information. If you believe a child has provided us data, contact us and we will remove it.

Security

We use reasonable measures to protect your data, including encrypted connections and database access controls. No method of transmission or storage is completely secure, however, so we cannot guarantee absolute security.

Changes to this policy

We may update this policy from time to time. When we do, we'll revise the "last updated" date above.

Contact

Questions about this policy or your data? Email us at contact@excapaint.com.