Privacy — 像素碰 Pixel Pung

Last updated 2026-08-08

The short version: you can play this game without an account and without giving us anything at all. If you do make an account, we keep the handful of things needed to run it — and there are no adverts, no analytics, and no third parties watching you play.

Playing without an account

Games against the bots run entirely in your browser. No account is needed and nothing about those games is sent to us.

Playing other people without an account

Quick Play and private rooms do not need an account either. To seat you at a table with three other people, our server has to be able to tell your seat from theirs, so it makes a temporary guest name — something like Guest-x7k2p9, generated by us at random. You do not choose it and it says nothing about you.

While that guest name exists we store it, when it was made, and the tables it sat at. That is all: no password, no email address, no chip balance, no rating. It is deleted automatically once it has gone unused for a couple of days, and everything attached to it goes with it. Signing in or making an account retires it on the spot.

Ranked play is the one thing that does need an account, because a rating and a coin balance are only worth having if they outlive your browser.

Your browser keeps a few things for itself, in its own local storage, under these names:

• mj.wallet.local — the chip balance from your games against the bots
• mj.saved — hands you chose to save
• mj.collection — which tile sets you have unlocked
• mj.lang — whether you are reading this in English or 中文

These live on your device. They are not sent to our server, and clearing your browser's site data removes them permanently — including that chip balance, which is why the game warns you about it.

The game also keeps a copy of its own files (the page, the code, the stylesheet) in your browser's cache, so that it still opens and plays with no network. That cache holds the game itself and nothing about you.

If you make an account

An account exists for one reason: playing against other people. Making one with a username stores:

• Your username and handle — the handle is just the lowercased form, used to keep names unique.
• Your email address — kept so that you can sign in with it as well as with your username. See below for what we do not do with it.
• Your password, hashed — with scrypt, salted, never stored or logged in readable form. We cannot tell you what your password is, because we do not know.
• When the account was created and last used.

Your email address is a second name to sign in with, and nothing else. We do not send mail. There is no verification message, no newsletter, no notifications, and — this is the one worth reading twice — no password reset by email. If you lose your password, the address on the account cannot get you back in, because anyone could type it. Nothing is ever sent to it, and it is never given or sold to anybody.

A username and an email address each belong to one account at a time. Nobody else can register yours while your account exists, and deleting your account is the only thing that releases them.

If you sign in with Google

Signing in with Google sends you to Google and brings you back. We ask Google for openid, email and profile, and we store:

• Google's permanent ID for you (its sub value) — this is what actually identifies the account, because it never changes.
• Your email address and display name — the email is kept so the account screen can show you which Google account you used, and, if no other account has already claimed that address, as the address on your account. Nothing is sent to it here either.

We send Google nothing about you in return — not your games, not your results, not your chips. There is no Google script on the game page.

Staying signed in

Two cookies, both strictly functional, neither used for advertising or tracking:

• mj_sid — your session. It holds a random token; the server stores only a hash of it. It expires after 30 days.
• mj_oauth — set only during a Google sign-in and cleared straight afterwards. It carries the two values that make the round trip to Google safe from tampering, and it lasts ten minutes.

Your IP address

Your IP address is used, in memory, to rate-limit repeated failed sign-in attempts so that nobody can sit and guess at passwords. It is not written to the database and it is not part of your account record.

Playing online

Once you play a match against other people, we store what a match needs: which matches you played, where you sat, the hands as played, the final results, your chip balance and the movements in and out of it, your rating and how it changed, and your friends list.

Other players can see your handle, your rating and rank, and your results — that is what a leaderboard and a profile are.

Chat

Chat is mostly a fixed list of eight phrases (碰, 上, 食糊 and so on). Typing your own text is possible only when every other human at the table is a friend you have accepted.

Either way, chat is never written to the database. It lives in the server's memory for the length of the match and dies with it.

Reporting other players

If you report someone, we store the match, who reported, who was reported, and the reason. This is kept so that repeated behaviour can be seen, which is the only thing that makes reporting worth doing.

What we do not do

• No advertising, and no advertising identifiers.
• No analytics or telemetry services. There is no third-party script on the page.
• No selling or sharing of anything, to anyone.
• No tracking you across other apps or websites.
• No real money. Chips are chips — they cannot be bought, and they cannot be cashed out.

Deleting your account

You can delete your account from inside the game, at any time, from the account panel. It asks you to confirm with your password (or, for Google accounts, by typing your own username), and then it is done immediately.

You can also request deletion without opening the game, at /delete-account.

Deleting removes your username, your email address, your password hash, any linked Google identity, your sessions, both chip balances and their full movement history, the record of the hands banked to your account, your rating and every change to it, your friends and pending invites, and any reports you filed.

The things your browser keeps for itself — the four local storage entries listed at the top of this page — are not touched by deleting your account, because they were never ours to delete. Clearing your browser's site data removes those.

One thing survives, and it is worth being straight about: matches you finished with other people keep their result rows, with your account detached from them. Those results are three other players' history as much as yours, and removing them would rewrite their records too. After deletion, nothing in them points back at you.

Children

This game is for players aged 13 and over. We do not knowingly keep anything about anyone younger, and if we learn that an account belongs to a child under 13 we delete it and everything attached to it.

Nothing here is played for money. Chips are a score, they cannot be bought and they cannot be turned back into money — see Community Standards for what that means at the table.

Changes to this policy

If this changes in a way that affects what we keep about you, the date at the top changes with it.

Contact

Questions about any of this, or about your data, go to support@pixelpung.com. That address is read by a person, and it is the same one on the Community Standards and account deletion pages.

Pixel Pung is made and run by one independent developer, not a company. It is free, it sells nothing, it shows no advertising, and its chips cannot be bought or cashed out. If you need to reach whoever is responsible for this site, the address above is the way, and it is answered by that person directly.