Play solo

Privacy and storage

Your solo progress stays in this browser. Guest rooms hold shared game state temporarily on the server, and an anonymous browser ID helps estimate how many players are currently in a game. This page explains what is kept, what the server logs, and how to remove it.

The short version

  • There is no account, no sign-up, no email address and no personal profile.
  • There is no third-party analytics or advertising script in this build.
  • The homepage shows an aggregate count of active guest browsers, using first-party presence reports from game pages.
  • Your solo progress is saved by your browser on your own device, and it is never uploaded. There is no cross-device solo sync.
  • A guest room is different: a nickname, the room you are in, your pins and your scores are held on this project’s server while the room exists, so that every player sees the same round at the same moment.
  • A room is short-lived. Finished rooms are removed after one hour, idle lobbies are removed sooner, and the private reconnect token is saved in your browser for recovery.
  • You can export your solo progress as JSON from the Solo menu to keep, copy or share it yourself.
  • Browsing the homepage loads this site's files and the aggregate player count. Clicking Try a live round opens the game and connects to its imagery and map providers.

What is saved in your browser

The game writes a few small entries to your browser's local storage for this site:

  • the game you are playing now, and the one previous game — free or daily — that can be brought back from the Solo menu: the five-round plan, the photograph you are on, your view, the pin you are drafting and the round’s original deadline;
  • any daily challenge attempt you started, with its own saved round state, so it waits for you instead of reopening by itself;
  • your passport — finished games, experience, level, badges, the days you played and your current run of consecutive days;
  • your preferences, such as timer, distance units, reduced motion and optional game sounds. The sound switch is shared by solo and multiplayer on this browser; sounds are off until you enable them.
  • a random anonymous browser ID for the current-player count, shared by solo and multiplayer tabs.

These are local storage entries rather than cookies. They do not expire on their own — they stay until something removes them — and they belong to the exact web address you played on. The site sets no cookies of its own anywhere.

Solo progress is not uploaded. The separate anonymous presence reports are described below. The Solo menu can export your progress as JSON, which gives you a personal copy you can keep, copy or share. There is no import and no automatic sync, so a copy cannot be loaded back into the game by itself, and a different browser, device or web address starts empty.

How the current-player count works

A game page uses a cryptographically random ID in this site's local storage to count the same browser profile once across solo, guest rooms, tabs, refreshes and rematches. Each page also creates a separate tab ID in memory, so leaving one tab does not remove another. Neither ID is a name, room code or account, and your IP address is not used as the player's identity. These reports use this site's own service, with no cookies, fingerprinting or third-party tracking.

While a visible game is active and you have interacted within five minutes, it sends a presence report every 20 seconds. Solo reports during loading, exploration and round results; joined guest rooms also report during the lobby and countdown. Finished games stop reporting. Hiding or leaving a page sends a departure when possible; missing heartbeats expire after 90 seconds. The homepage only reads the total until you open its live game preview. Playing in that preview follows the same presence rules as the solo page.

The server keeps hashed IDs in bounded, short-lived memory, separate from room data. It keeps no historical player database, and restarting the service resets the count until new reports arrive. The public response contains aggregate counts and timing information only; it exposes no identifier, nickname, IP address or room credential. This is an estimate of active browsers: separate devices, profiles and private browsing sessions can count separately, and storage restrictions can prevent a browser being counted.

What a guest room keeps on the server

Multiplayer needs a shared clock, so a guest room cannot live only in your browser. While a room exists, the server holds:

  • the nickname you chose for the room, shown to the other players in the lobby, the round and the leaderboard;
  • your room membership — which room you are in and whether you are still connected — so the room can wait for you instead of dropping you;
  • your pins and your scores, including the round-by-round breakdown the final leaderboard shows;
  • a private reconnect token, stored by the server only as a hash, which is how your browser proves it is the same player when it comes back.

Your browser keeps that token in session storage and local storage so you can recover after a refresh, a closed tab or a browser restart. Up to five room sessions are retained; recovery entries older than 24 hours are discarded when read. The room may expire sooner on the server. Leaving a room or receiving confirmation that the session is invalid removes its saved entry. Clearing this site’s browser data removes all recovery entries. If local storage is blocked, recovery is limited to the current tab; the game shows a warning. The token is not written into the page or address bar, and it is not a cookie. Requests carrying it go to this site as same-origin requests with an authorization header.

The six-character invite code is what gets you in, and only while the room is still a lobby: anyone holding the code or the invite link can join up to the 20-player limit, and the code stops accepting newcomers as soon as the shared ten-second countdown begins. From then on the room is closed, and only players already in it can reconnect — with the private token above, not with the code. Choosing Play again together after a match opens a fresh room: the same nicknames and the same private tokens are carried into it, the scores start empty, and the finished room is removed on its usual one-hour timer.

Rooms are cleaned up on a timer. A finished room is removed one hour after it ends, and an idle lobby has a bounded lifetime of a couple of hours and is removed if it is never played. When a room is removed, its players, names, pins, scores and tokens go with it. Nothing from a guest room is copied into your solo passport or your daily records, and no score from one is kept as a record anywhere.

Two limits are deliberate. There is no chat of any kind: a room carries nicknames and pins, and nothing else you can type. And there is no login, so the saved private token in the same browser profile on this site is the only way back into a match that has already started. Another tab in that profile can recover your place; another browser or device cannot. Anyone using your browser profile may also access its saved rooms.

What the server records

PinPonder is delivered by a web server, and that server and the proxy in front of it keep ordinary request logs to operate the service and find faults.

A log line records:

  • the address that connected;
  • the request method and the path that was asked for;
  • the response status and the number of bytes sent;
  • the page that referred the request, and the browser's user-agent string.

That is the standard record a web server keeps. No cookies are set of the site's own, and the logs are not used to build profiles of visitors. The guest-room service behind multiplayer is part of the same server, and its requests appear in the same kind of operational record. Tokens and scores are not written into it: room state lives in the room database described above, and a private token is only ever stored there as a hash. Presence IDs are also excluded from request logs; their short-lived hashes are held only in the presence service's memory.

What your browser contacts while you play

While the project's conservative monthly app allowance remains, new games load Google Street View and Google Maps directly from Google. Google receives the ordinary request information needed to supply those features, including the browser's network address and the map or panorama coordinates being requested. Google's handling of that data is described in the Google Privacy Policy, and use of its map features is subject to the terms linked from PinPonder's terms of use.

When the monthly allowance has been reached, new games use Panoramax photographs and OpenFreeMap. Earlier saved games and daily challenges can also retain that provider. Other Google loading errors show a retry option instead of changing providers. OpenFreeMap then receives the map tile requests; its privacy policy is at openfreemap.org/privacy. The Panoramax images are served by PinPonder, while optional Photo credits links leave this site for the original source. The two provider pairs are never displayed together.

Guest rooms and anonymous presence reports talk to this site's own service under /party-api/. The homepage reads its aggregate current-player count there too. That is the same origin as the game: no third party is involved in multiplayer beyond the map and photo providers above.

The gameplay pictures on the marketing pages are captures of the real game, published under CC BY-SA 4.0 with the photographs they show. The public pages load their own assets, including its silent background film and poster, and use no third-party fonts or tag managers. The film is served directly by PinPonder and does not load Google. The homepage live preview loads the game only when you click Try a live round; from that point it contacts the providers described above and stores progress just like the full solo page. Closing the preview unloads the game.

Deleting what is saved

Your solo record can be removed entirely from inside the game, and a guest room removes itself without anyone asking.

  1. Open the Solo menu in the game.
  2. Use Export progress (JSON) first if you would like a copy. It is a plain file that stays with you.
  3. Use Clear all solo progress to remove both saved games — the one in progress and the previous one — along with the daily records and the settings. The game asks for confirmation before anything is deleted.

Clearing site data for this address in your browser's own settings removes the same entries, plus any site preferences your browser keeps for this address. It also clears the session token for a room you were in, which is the point: after that, the tab can no longer reclaim that seat. Clearing site data also removes the anonymous browser ID; a later game may create a new one. Clearing solo progress alone does not remove that ID.

On the server side there is nothing for you to delete by hand. A finished room is removed one hour after it ends and an unplayed lobby after its bounded lifetime, and rooms are not kept afterwards. Active presence expires within 90 seconds of the last heartbeat; no historical presence record is kept. Neither step removes the server's request logs, which are not stored in your browser.

This page describes the current build

Anything that changes what is stored, or who can see it, will be described here before it ships. If advertising or further analytics are added later, this page will say so first.

Play free, on your own or in a room

Five rounds, real photographs, no account needed.

Play solo Play with friends