Privacy Policy

GraffitiWorld is an independent project run by a solo developer, who is the data controller for the purposes of the UK and EU General Data Protection Regulation. There is no company behind it.

For any privacy question or request, email tonyginkle@gmail.com.

Anonymous player identity. The first time you load the map we create a player record and set a signed, HTTP-only cookie named wg_player in your browser. This is what lets your paint, your daily allowance and your level survive a page reload without you ever creating an account. It is essential to the game working and is not used for advertising.

Device identification. Your browser sends us a technical fingerprint derived from how your device renders a canvas image, its WebGL graphics capabilities, and its audio stack, plus a random identifier stored in your browser under wg_did. We use this solely to enforce bans and daily paint limits. Without it, anyone told to stop could clear their cookies and carry on defacing other players’ work in seconds. We are naming this plainly because it is a form of tracking, even though we do not use it to advertise to you or share it with anyone.

Account details. If you register we store your email address and a securely hashed password. If you sign in with a third party such as Google, we receive your email address, name and profile picture from that provider. We never see your password for those accounts.

Gameplay content. The paint you place, its location, colour and brush, and your public handle, level and statistics. Paint is public by design; that is the entire point of the game.

Chat messages. Stored so other players can read them, and automatically deleted after 24 hours.

Technical logs. Your IP address, browser user-agent and a coarse device class (mobile, tablet or desktop) are recorded with gameplay events. These protect the service from abuse and let us find bugs.

Contract. Running your player account and saving your paint. Without this data there is no game to provide.

Legitimate interests. Device identification, rate limits, ban enforcement and abuse logging. We rely on our interest in keeping a shared, public canvas usable and in protecting other players’ work from vandalism and automated abuse. We have weighed this against your privacy and limited the data to what enforcement actually requires.

Consent. Advertising and analytics cookies where the law requires it, including all personalised advertising to visitors in the EEA, the UK and Switzerland. You may withdraw consent at any time (see Your choices).

We show advertising to keep GraffitiWorld free to play. Advertising is supplied by Google.

Third party vendors, including Google, use cookies to serve ads based on a user’s prior visits to this website or other websites. Google’s use of advertising cookies enables it and its partners to serve ads to you based on your visit to this site and/or other sites on the Internet.

You may opt out of personalised advertising by visiting Google Ads Settings. You can also opt out of a third-party vendor’s use of cookies for personalised advertising at www.aboutads.info.

If you are in the EEA, the UK or Switzerland, we use a Google certified consent management platform to ask for your consent before any personalised advertising cookies are used, as required by Google’s EU user consent policy. Declining does not stop you playing; you will simply see non-personalised ads.

More detail on how Google uses data from sites that use its services is available at policies.google.com/technologies/partner-sites.

We do not sell your personal data, and we never have. We share it only with the providers that make the site run:

• Google: advertising, and consent collection in Europe.
• Map and tile providers: OpenFreeMap and OpenStreetMap serve the map imagery. Your browser requests tiles from them directly, so they receive your IP address as part of that request.
• Search: place search is powered by Nominatim (OpenStreetMap). Your search text is sent to them when you use it.
• Hosting and infrastructure: the servers and databases that store the map, on our instructions only.
• Sign-in providers: only if you choose to use them.

We may also disclose data where we are legally required to, or where it is necessary to investigate abuse or protect the service.

• Anonymous player cookie: 1 year from your last visit.
• Chat messages: 24 hours, then deleted automatically.
• Paint and public profile: for as long as the paint is on the map. Removed paint is kept in a hidden state so moderation decisions can be reviewed or reversed.
• Ban and abuse records: kept for as long as the ban needs to be enforceable. Deleting these on request would defeat their purpose.
• Account details: until you ask us to delete your account.

If you are in the UK, the EEA or Switzerland you have the right to access the data we hold about you, to have it corrected, to have it erased, to restrict or object to how we use it, and to receive it in a portable format. These rights are available to everyone who asks, wherever you live. We do not think they should depend on your address.

Email tonyginkle@gmail.com and we will respond within 30 days. We may need to verify that the account is yours before acting.

One honest limit: paint is a shared, public artefact. If you ask us to delete your account we will remove your profile and unlink your paint from your identity, but paint that other players have built on top of may remain on the map.

If you believe we have mishandled your data you may complain to your local supervisory authority. In the UK that is the Information Commissioner’s Office.

• Advertising consent. If you were shown a consent prompt, you can reopen it at any time from the link in the footer and change your answer.
• Cookies. Your browser can block or delete cookies. Blocking the wg_player cookie will stop the game remembering your paint between visits.
• Personalised ads. Opt out through Google Ads Settings regardless of where you live.

GraffitiWorld is not directed at children under 13, and we do not knowingly collect their personal data. If you believe a child has given us data, email tonyginkle@gmail.com and we will delete it.

Our providers may process data outside your country, including in the United States. Where data leaves the UK or EEA we rely on the safeguards those providers put in place, such as the European Commission’s standard contractual clauses.

If we change how we handle your data we will update this page and the date above. Material changes affecting how we use your data will be signposted on the site.