Privacy

Private playtest · Updated September 15, 2026

This invitation-only test is for adults aged 18 or older, including friends outside the United States. Please do not use it if you are under 18.

Pocket Cube is operated by Hootan Shadmehr in San Francisco, California, United States. For privacy questions or requests, contact hootan@umich.edu. This is our temporary contact address during testing.

What we keep and why

• Guest accounts: a random account identifier, a protected device credential, platform and account/device timestamps let you play and recover saved progress. The server stores a hash of the credential, not the credential itself.
• Optional Google sign-in: Google supplies a verified account identifier and email address so you can use the same progress across devices and see which account is signed in. We keep the latest verified email. Your Google password is never given to us, and provider access or refresh tokens are not saved in the game database.
• Play: completed levels, submitted move sequences and attempt results, together with unlocked hints for your unfinished level. Your unfinished cube and Undo/Redo history stay in this browser. We do not keep per-level free-hint usage records.
• Reliability and security: account-operation receipts, limited technical logs and backups help prevent account mix-ups and recover from failures. Connections expose an IP address and browser information to the server; infrastructure error/security logs may include them. We do not add IP addresses to game-account records.
• Messages you send us: if you contact us, we use the message and contact details to respond and handle your request.

The browser stores your game credential, saved game/account journals and sound preference. Necessary cookies remember the private-test invitation and protect Google sign-in. Clearing browser storage can remove access to an unlinked guest account.

This test has no advertising, analytics SDK, payments, sale of personal data or sharing for targeted advertising. Linking Google is optional; you can play as a guest.

Who processes it

The operator can access data for running the test, support and security. Amazon Web Services hosts the game and its restricted backups in the United States. Google handles sign-in when you choose it, under Google’s privacy policy. We may also disclose information when legally required or necessary to protect the service and people using it.

For EU/UK personal data covered by AWS’s processing terms, AWS provides contractual transfer safeguards, including standard contractual clauses where applicable. AWS describes those safeguards here. Contact us for information about processing or international transfers.

Where data-protection law requires a legal basis, we rely on our legitimate interests in operating this voluntary private test, saving the progress you request, responding to you and securing accounts. We do not use these interests to justify advertising or unrelated uses. If a future feature needs consent, we will ask before enabling it.

Download or delete your account

In Settings, choose Download account data for a copy, or Delete account and confirm. Deletion makes that account unavailable on every device and normally finishes within a few minutes. If the connection fails, return to Settings to check its status; a failed connection does not cancel the request.

We remove the account’s active identity/email and play records. A different account keeps completed levels it already received through an explicit progress combination, without retaining the deleted account’s move history. This browser removes the deleted account’s saved journals while keeping other saved accounts. Other devices remove their local copies when they reconnect and learn of the deletion.

We retain a small security record: the random deleted account identifier, deletion timestamps and hashes that prevent old device credentials or reserved sign-in secrets from being reused. These records persist while the service or its recoverable copies exist. They contain no email, Google identifier or move history, but they are still security-related personal data.

Restricted backups can contain older data until rotation. Backup snapshots use a seven-day retention setting; temporary recovery copies are kept out of ordinary use. Before a copy is restored for play, deletion records are reapplied so an erased account cannot return. Downloaded exports that you save are under your control.

There is no automatic inactivity expiry for active accounts during this private test. Unfinished sign-in proofs expire after ten minutes and their email claims are cleared by maintenance. Accounts with financial records need an individual deletion review; this free test does not enable purchases. Contact us if a download is too large, deletion stays pending, or you cannot access the account.

Your choices and rights

You may contact us to request access, correction, deletion or a portable copy, to object to processing, or to ask that it be restricted. Available rights and exceptions depend on applicable law. We may need to verify ownership proportionately; never send us your password or device credential. We aim to respond promptly and within the applicable deadline, normally one month for EU/UK requests. You may also complain to your local data-protection authority.

If you believe a child has provided information, contact us so we can address it. We will review this notice before introducing children’s support, advertising, payments or a broader launch. Material changes will be brought to testers’ attention.