PIKSPOT! Privacy Policy

How PIKSPOT! collects, uses, retains and shares personal data.

Last updated: 2026-08-31

Language preference disclosure added: 2026-09-22

Welcome to PIKSPOT! (the “Service”). PIKSPOT! is a player-made website offering information organization, community interaction, and tools for Pikmin Bloom players.

This Privacy Policy explains what personal data we collect, how we use it, when we may share it, how long we retain it, and the rights you may have.

By using the Service, you indicate that you have read and understood this Privacy Policy.

Article 1 — Who we are

PIKSPOT! is a website run by an independent operator, providing tools, information organization, and community features for Pikmin Bloom players. PIKSPOT! is currently provided as a website, not a native app.

Contact email: privacy@pikspot.app Website domain: pikspot.app

Article 2 — Data we collect

Depending on how you use the Service, we may collect the following types of data.

A. Data you provide directly

This may include:

  • Account data, such as your email address, display name, sign-in information, and profile information;
  • Content you submit through the Service, such as posts, comments, reports, lists, collections, profile information, images, image descriptions, or other user content; and
  • Information you provide when contacting us.

Account data also includes an interface language preference (preferred_locale), used for the default interface language across devices and the language of newly created notifications. It is initialized when the account is activated and updated when you manually switch languages. Simply opening a shared link with a language-specific path does not overwrite the account's saved preference.

B. Image upload data

If you use image upload features, we may receive, store, display, compress, convert, or process your uploaded images and technical data related to image uploading, display, management, security checks, or debugging.

To reduce privacy risks, users must confirm before uploading that images do not contain information linked to real-world identity, such as real names, addresses, contact information, private conversations, or facial photographs. Even when personal data is not clearly visible, backgrounds, screenshot content, file names, visual details, or context may reveal identity or location.

Do not upload images you do not have the right to use, or images containing other people's personal data, private content, facial photographs, private conversations, home addresses, contact details, identification documents, tickets or receipts, license plates, schools, workplaces, or other identifying information.

C. Automatically collected data

This may include:

  • IP addresses;
  • Browser, device, and other technical information;
  • Sign-in records and basic service interaction records;
  • Page views, navigation, feature interactions, and error logs; and
  • Technical records related to security, abuse prevention, debugging, and service stability.

D. Cookies and similar technology data

Your manually selected interface language is also stored for 1 year in the current browser's functional cookie pikspot_locale. The cookie uses HttpOnly and SameSite=Lax, with Secure set on HTTPS connections. It is not used for analytics or advertising tracking and is separate from optional product analytics consent. Simply opening a language-specific shared link does not overwrite this cookie. You can update the choice by manually switching languages or delete the cookie in your browser settings. Deleting browser cookies does not also delete the language preference saved in your account.

We use cookies or similar technologies necessary for the operation, security, and core functions of the Service. The Service also uses Vercel Web Analytics for anonymous, cookie-free basic page view analysis. Before transmission, query parameters are removed, and UUIDs and long opaque identifiers in URL paths are replaced with generic markers. Internal administration, material previews, and development draft pages are excluded from this analysis.

At the initial public launch, the Service also plans to use Vercel Speed Insights to collect anonymous website performance data, such as Web Vitals, page paths, browsers, device types, operating systems, network types, countries, and page elements that affect performance. PIKSPOT! does not attach account identifiers, user-entered content, or image data to these performance events. Query parameters and identifiable path segments are removed from URLs first. Data is used only to diagnose and improve website performance, not to build personal behavior profiles across pages.

After you consent to product analytics, the Service may load Google Analytics 4 (GA4) to record sanitized page paths, stable page types, interface language, generalized browser language, core feature events with a limited range of values, and support flow stages. Signed-in users may use an irreversible hashed code generated with a server secret key as a GA4 User-ID. We do not send names, email addresses, Supabase user IDs, friend codes, coordinates, search terms, form content, image data, or payment card data to GA4. Country or region information is generated by Google from technical information received by its service and is separate from the country or region entered on a friend card.

Whether Google AdSense loads is controlled by site-wide switches, page types, regional consent mechanisms, and trusted ad-free eligibility. When you consent to personalized advertising, Google may use advertising technologies. After optional items are rejected, PIKSPOT! may still display non-personalized or contextual ads, and Google may process necessary technical information for ad delivery, frequency capping, aggregate measurement, security, and invalid traffic prevention. PIKSPOT! does not track ad clicks itself.

For details, see the Cookie Policy.

E. Place search and map data

When place search is enabled in the current environment, PIKSPOT! loads Google Places UI Kit in your browser. Search text you enter is sent directly from your browser to Google. Google may also receive the IP address, browser, device, and other technical information necessary to process the request. This processing is governed by the Google Privacy Policy and the Google Maps Platform Terms of Service.

PIKSPOT! does not receive, log, or cache place search text, Google Place IDs, or candidate place names through its own API. When a player selects a result, Google Places UI Kit helps move the MapLibre map to that location in the browser. This does not create a saved record in /map.

In /alarm, Google Places UI Kit is used only to help players move the map. Selecting a search result does not itself create a backend search record. After checking the crosshair, only explicitly confirming and submitting the current map center saves it as that account's private Alarm area setting. Players can continue adjusting the map before confirming. PIKSPOT! does not save search text, Google candidate names, or Place IDs, and private Alarm coordinates are not publicly displayed.

Place search is disabled by default in production. It must be explicitly enabled with a separate browser feature switch and a Google API key restricted by website origin and API scope. Enabling other map or alarm features does not automatically enable this data transfer. By its technical nature, a browser API key appears in frontend requests; it is not a secret server credential.

F. Payment and support data

Payment features are currently disabled by default. If one-time support payments are explicitly enabled in the future, PIKSPOT! will use PAYUNi to process transactions. PIKSPOT! sends PAYUNi the merchant code, order number, amount, item description, time, and callback URLs needed to process a transaction. Payment data you provide on the PAYUNi payment page is processed by PAYUNi and the relevant financial institutions under their procedures.

PIKSPOT! retains the association between a transaction and an account (which may be removed after account deletion), amount, currency, transaction status, payment method type, PAYUNi transaction identifier, refund status, reconciliation time, selected callback event fields, and integrity hashes. If you choose to display a name or message in support activity, that display preference and content are also retained. PIKSPOT! should not store full card numbers, card verification codes, or complete payment credentials from the PAYUNi payment page.

Article 3 — How we use data

We may use personal data to:

  • Provide, operate, maintain, and improve the Service;
  • Create, verify, and manage user accounts;
  • Provide sign-in, authentication, and account security;
  • Store preferences or necessary session information;
  • Process content, requests, images, and interactions you submit through the Service;
  • Display, organize, manage, review, or remove user content;
  • Prevent abuse, fraud, unauthorized access, and other harmful conduct;
  • Perform debugging, security maintenance, system monitoring, and service quality improvements;
  • Respond to inquiries, support requests, and legal or rights-related notices;
  • Comply with applicable laws and legal obligations; and
  • If advertising is enabled in the future, provide, measure, frequency-cap, improve, or personalize ads to the extent permitted by law and with any required consent.

Article 4 — Legal bases for processing

If the GDPR or similar data protection laws apply, we may process personal data on one or more of these legal bases:

  • Performance of a contract: where processing is necessary to provide the Service you request;
  • Legitimate interests: such as operating the Service, maintaining security, preventing abuse, and improving features;
  • Legal obligations: where applicable law requires us to process or retain data; and
  • Consent: where the law requires your consent for specific optional processing, such as non-essential cookies, certain analytics, or personalized advertising.

Vercel Web Analytics and Vercel Speed Insights provide anonymous, cookie-free page and performance analysis for operating and improving the Service. GA4 product analytics and personalized advertising are optional processing. In regions using the PIKSPOT! custom interface, they are enabled only after the corresponding consent is obtained. Google advertising consent signals in the European Economic Area, the United Kingdom, and Switzerland are managed by a Google-certified CMP. You can change or withdraw your choices through “Privacy settings” in the footer.

Article 5 — Sharing data

We do not sell your personal data.

Where reasonably necessary, we may share data with service providers that help operate the Service, such as third parties providing:

  • Website hosting and infrastructure;
  • Databases and authentication;
  • Image storage, file processing, or content delivery;
  • Email or notifications;
  • Security, legal, or technical support; and
  • Advertising, consent management, or analytics.

These providers may process data only to the extent necessary to provide their services and are subject to their respective applicable legal and contractual obligations.

Article 6 — Third-party services

The Service may use or integrate third-party services, such as:

  • Supabase;
  • Vercel (website hosting, performance monitoring, and anonymous, cookie-free page analytics);
  • Google OAuth / Google Sign-In (if you choose to sign in with Google);
  • Facebook Login (if you choose to sign in with Facebook);
  • LINE OAuth / LINE Login (if you choose to sign in with LINE);
  • Google Analytics 4 (loaded only after product analytics consent);
  • Google AdSense and Google Privacy & Messaging (loaded only when advertising switches and applicable consent conditions permit);
  • Google Maps Platform (including Google Places UI Kit, which handles search text directly in the browser and displays candidate places only when place search is explicitly enabled; certain features also resolve Google Maps links actively provided by users);
  • PAYUNi and relevant financial institutions (only when payment features are explicitly enabled and you initiate a transaction); and
  • Other infrastructure, storage, analytics, consent management, or security services necessary for operating the Service.

Third-party services are governed by their own terms and privacy policies. We are not responsible for their privacy practices and recommend reviewing their policies separately.

Article 7 — Advertising and Google AdSense

PIKSPOT! may use Google AdSense to help cover website operating costs. Whether third-party advertising is actually enabled is controlled by site-wide settings, page eligibility, user eligibility, regional rules, and required consent mechanisms.

If Google AdSense is enabled, third-party vendors, including Google, may use cookies, local storage, device information, IP addresses, page views, interaction data, or similar technologies to deliver ads, cap frequency, measure advertising performance, prevent fraud, improve advertising services, and provide personalized ads where permitted by law and with any required consent.

Ads are not intended to appear on the home page, legal and trust pages, sign-in flows, account settings, form submissions, image uploads, error handling, reporting or review flows, or other critical operations. If full-screen interstitial ads are used in the future, they will in principle be limited to natural transitions between main pages, rather than transitions between a page and its subpages or detail pages.

If you are in a region requiring consent, we will provide appropriate notice and consent or rejection options under applicable law and advertising service requirements. After personalized advertising is rejected, non-personalized or contextual ads may still appear. These ads are not selected using personal interest profiles, but advertising services may still process necessary information or use some storage technologies for ad delivery, frequency capping, aggregate performance measurement, security, and invalid traffic prevention.

Rejecting product analytics or personalized advertising does not automatically grant paid or membership ad-free eligibility. Membership, subscriptions, payments, and ad-free eligibility are determined by the PIKSPOT! database and payment webhooks. GA4, AdSense, and browser choices are not the authoritative source of permissions. In principle, third-party ad requests do not load for users with valid ad-free eligibility.

Article 8 — International data transfers

Some service providers or infrastructure used by the Service may be outside your country or region. Your personal data may therefore be transferred to and stored in other jurisdictions.

Where applicable law requires, we will take reasonable measures to ensure appropriate protection for these transfers.

Article 9 — Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy, unless applicable law requires or permits a longer period.

In general:

  • Account data may be retained while an account is active and for a reasonable period afterward for legal, operational, or security needs;
  • Security and technical records may be retained for a reasonable period to protect the Service, investigate abuse, and comply with legal obligations;
  • User-submitted content, including images, may be retained according to operational needs unless deletion or removal is required by applicable policies or law;
  • If content has been reasonably relied on, quoted, reported, backed up, or recorded by others, or relates to disputes, security incidents, legal obligations, or rights requests, deletion may take longer or may not be immediate across all backups and records;
  • The most recent service activity time of signed-in accounts is used for 30-day friend card visibility and necessary service activity aggregates. It is updated at most once every 24 hours, without page, device, or IP information;
  • GA4 user-level and event-level data is expected to be retained for 14 months, without resetting the retention period on new activity; and
  • When an account is deleted, if GA4 is configured, we submit a user data deletion request to Google using the irreversible hashed User-ID. External service failures retain a retry status but do not prevent deletion of the PIKSPOT! account itself.

Article 10 — Your rights

Depending on your location and applicable law, you may have one or more of the following rights:

  • To inquire about or access your personal data;
  • To correct inaccurate or incomplete data;
  • To request deletion of your personal data;
  • To request restriction of processing;
  • To object to certain processing;
  • To request data portability;
  • To withdraw consent where processing is based on consent; and
  • To complain to a supervisory authority.

To exercise these rights, contact:

privacy@pikspot.app

You can also visit Data / Account Deletion (/data-deletion) and, after signing in, delete your PIKSPOT! account and associated data yourself.

Before processing a request, we may ask for reasonable information to verify your identity.

Article 11 — Data security

We take reasonable technical and organizational measures to protect personal data against unauthorized access, misuse, modification, disclosure, or destruction.

However, no internet transmission or electronic storage method can guarantee absolute security, so we cannot guarantee completely risk-free data security. Users should still avoid submitting or uploading unnecessary, sensitive, or real-world identifying content.

Article 12 — Children's and young people's privacy

PIKSPOT! is a general-audience service and is not primarily directed at children below the applicable legal age. We do not request dates of birth or create age profiles from birth dates. Minors should obtain appropriate authorization from a parent, guardian, or legal representative as required by local law before using the Service. Unless reliable age signals about children or teenagers become available in the future, Google advertising tags use an “age unspecified” setting; this does not mean we have verified that a user is an adult.

If you believe a child has inappropriately provided us with personal data, or uploaded images containing children's or young people's personal data, facial photographs, or other sensitive content, please contact us.

Article 13 — Third-party links and external content

The Service may contain links to third-party websites, pages, or services. We are not responsible for their privacy practices or content.

Article 14 — Changes to this Privacy Policy

We may update this Privacy Policy from time to time. The updated version will be published on the Service with a revised “Last updated” date.

For material changes, we may provide additional notice where appropriate or required by applicable law. If Google AdSense, non-essential cookies, personalized advertising, or new third-party data processing services are implemented in the future, we may update this policy and the Cookie Policy.

Article 15 — Contact

For questions, requests, or concerns about this Privacy Policy or our data practices, contact:

privacy@pikspot.app

Privacy Policy