Privacy

Last updated 25 August 2026

The short version: PaintRoom is built so as not to know who you are. No account, no email needed to play, no advertising, and nothing about you is ever sold. The long version follows, as the GDPR requires.

Who is responsible

TOTEM, 1 avenue Galois, 92340 Bourg-la-Reine, France, is the controller of this data. Contact: hello@kevin-tale.com.

What we hold, and why

• A random identifier, made by your browser the first time you enter and stored there. It is how the room recognises you between visits, and what your reserve and purchases hang on. Without it there is no game.
• The painter name you choose. It shows above your head and beside your strokes.
• What you paint: for every gesture, the time, the surface, the position, the colour and which painter it belongs to. This history is what makes archives, timelapses, and the answer to "who painted this pixel" possible.
• Your Cubvatar, as the image of your cube.
• Technical logs kept by the web server: IP address, browser, and the time of each request. They exist for security and for dealing with abuse.
• Moderation records: for a ban, the identifier, the date and the reason.
• Payments: the email address you give Stripe, the country used for tax, and whether the payment succeeded. Never your card number.
• The email you leave on the waitlist, if you ask to be told when PaintRoom opens. That address is for that announcement, and nothing else.
• Analytics, only if you agree to them: how the game gets used. The detail is under Analytics below.

On what basis

• Performing our agreement with you: running the room, holding your reserve, granting what you bought.
• Our legitimate interest: keeping the service secure, preventing abuse, keeping the shared painting intact.
• Your consent: analytics, and the opening announcement if you asked for it. You may withdraw either whenever you like.
• Legal obligation: accounting records for purchases, kept for as long as French law demands.

Who else sees it

• Hetzner Online GmbH, in Germany, hosts the server.
• Stripe processes payments.
• Resend, in the United States, holds the waitlist and sends the opening mail if you asked for it.
• PostHog, in the European Union, receives analytics if you agreed to them. Events go through our own host, e.paintroom.io, rather than a tracker on someone else's domain.

Other players see your painter name, your Cubvatar and what you paint — that is the game itself. Nobody buys anything from us.

How long

• your identifier and reserve: while you keep playing, and a reasonable idle period after;
• a room's painting history: as long as its archive stays published;
• server logs: up to twelve months;
• analytics events: up to twelve months;
• session recordings: thirty days;
• moderation records: while the ban stands;
• accounting records: ten years, as French law requires.
• waitlist email: until you unsubscribe, or until you ask us to erase it;

Your rights, and how to use them

You can ask to see what we hold, correct it, have it erased, restrict or object to its use, receive it in a portable form, or withdraw your consent to analytics or to the waitlist. In the room, analytics is the Change link on this page, which brings the bar back. To leave the waitlist, use the unsubscribe link in a mail from us, or write to hello@kevin-tale.com.

Because we do not know your identity, an email address alone does not tell us which player you are. Quote the identifier this browser holds, which is shown in the Privacy tab of the “?” panel inside the room — and if you have bought something, attach the Stripe receipt.

You may also complain to the CNIL, the French data protection authority, at cnil.fr.

Children

PaintRoom is not for children under 13. If you are under 15, a parent or guardian must agree before you enable optional analytics. If you believe a child under 13 has given us data, write to us and we will remove it.

What sits in your browser

Besides the identifier, your browser keeps your painter name, your Cubvatar and your quick colours, so the room is as you left it when you return. These are necessary to the game and are not used to follow you anywhere else. Analytics storage is only set if you agree to it.

Analytics

Separate from the Terms, and only if you agree on the bar at the top of the screen. Refusing changes nothing about how the game plays. You can change your mind from this page, or write to hello@kevin-tale.com.

• PostHog, a processor in the European Union (eu.posthog.com), receives the events. They travel through our own host, e.paintroom.io.
• What we send: that you opened the site, entered a room, painted, opened the gallery, started or finished checkout, chose a Cubvatar, and — if something breaks — a report of the error. Not advertising, and not a profile sold to anyone.
• If you agree, we also record the session: how you move through the room, what you click, and a film of the canvas itself — the painting on screen. That recording is how we see a broken checkout or a stuck brush. It is kept for thirty days, then deleted.
• Your IP address is anonymised before it is stored. An approximate country can still be inferred.
• If you agree, PostHog may keep a first-party cookie and local storage so it can recognise the same browser on a later visit. If you refuse, none of that is set, no analytics events are sent, and no session is recorded.