What we store, why, and how to erase it. In short: almost nothing, and what little exists is either anonymous or up to you to delete.
The only cookie is lc_id: an anonymous session identifier, required to play. It contains no personal data.
If you choose to claim your identity, we store the email you provide.
That email is used only to send you the sign-in link and, if you turn it on yourself, at most one notice a day when La Máquina touches your lights. It is off by default, you can switch it on and off whenever you like, and every message carries its own unsubscribe link.
Nothing else. No third-party cookies, no external analytics, no ad trackers. Your email is never shared and never used for advertising.
The canvas lives on the event log: which pixel was lit, when and by whom. It is the game itself, not your data — the timelapse, the scoring and the height depend on it.
The server also keeps a technical access log — IP address, page requested and referring site — for 30 days, only to learn where people come from. The session cookie is stripped from that log before it is written, and none of it goes to third parties.
It is immutable by design and never used outside the game.
You can play without an account. The email is used only to send you a magic link (via Resend) and to tie your lights to a single player across your devices.
It is never shared and never used for marketing.
Delete your identity at any time: /api/identity/forget?email=your@email.com. This removes the link between your email and your anonymous actor.
The lights you painted remain on the canvas: the event log is sacred and immutable — it is the game's memory, not yours.
Server in the EU (Hetzner, Germany). Database: local PostgreSQL on the same machine.
Contact: nzo@ultimaluz.com