Privacy Policy - PHYSICS LAB

Effective date: 2026-10-07

Contact: [email protected]

1. Summary

PHYSICS LAB has no accounts, no advertising and no cookies. We only measure visits in aggregate and count how many games are played in total (section 5). The official levels, the level editor and the arcade mini-games work entirely on your device. Three optional online features - the player gallery, the global leaderboards and the arcade's Daily Lab ranking - use our server. When you use them we store the levels you publish, the leaderboard name you choose and your verified times and scores, linked to a random ID your browser creates. We never ask for, and do not store, your email address, real name, phone number or IP address.

2. Information stored on your device

The game saves the following in your browser's localStorage:

Remove it at any time with the "Clear my records" button on the site, by deleting drafts in the editor, or by clearing your browser's site data for this site. Clearing it also disconnects you from anything you published: the server has no other way to recognise you. The game works normally if storage is unavailable (private browsing, blocked site data) - it simply will not remember anything.

If you install the game as an app, a service worker also caches its own files so it works offline. That cache holds only the game's own assets.

Daily reminder (optional). If you turn on reminders on this device, your browser asks for permission to show notifications. The app then keeps a small note in its own offline storage (plab-state): the time you picked, the last day you played, your streak and the reminder text. Only the app on your device reads it, once or twice a day, to decide whether to remind you; nothing is sent to us or to any push service. Turn it off in the reminder panel, in your browser's notification settings, or by clearing this site's data. The calendar option makes a calendar file on your device; once you add it, the event is kept by your calendar app under its own privacy policy.

Android app (Google Play). The app contains the same game, so everything in this policy applies to it: your progress, settings and random ID stay in the app's own storage on your phone, and the optional online features (section 4) talk to the same server. The only permission Android asks you for is permission to show notifications, and only when you turn on the daily reminder. The app also declares permissions that need no prompt and send nothing anywhere: internet access, vibration (haptic feedback, which you can switch off in the menu) and restoring reminders after the phone restarts. Reminders are scheduled on the phone by Android itself - no push service, nothing is sent to us - and are removed when you turn them off or uninstall the app. The app has no advertising ID and no analytics, crash-reporting or advertising SDK; the website's visit statistics (section 5) are not part of the app. Uninstalling the app, or clearing its storage in Android's settings, deletes everything it kept on the phone. Links to this policy and the terms open in your browser.

3. Levels you share as a link

When you share a level from the editor, the whole level - its layout, your solution, and the level name, creator name and hint you typed - is packed into the link itself (after the # sign). Sharing a link does not upload anything to us, and the part after # is not sent to any web server when the link is opened.

Anyone who receives the link can read everything in it, and the messaging app, social network or email service you use to send it will handle the link under its own privacy policy. Do not put personal information in level names, creator names, hints or leaderboard names. All of them are optional.

If you use one of the share buttons (for example X, Facebook, WhatsApp, Telegram, LINE or Reddit), your browser opens that service's own page; nothing is sent to it until you choose to post there.

4. Online features: gallery, leaderboards and Daily Lab

These features are used only when you open the gallery, publish a level, clear a level while online, like or report a level, view a leaderboard, or finish a Daily Lab game in the arcade while online.

What the server stores

To verify a Daily Lab score, your browser sends the input of that run - the positions and timing of your taps and drags inside the game area - and our server replays it. The input is used only for that check and is not stored.

The raw device ID never leaves your browser in stored form - the server keeps only its keyed hash, which cannot be turned back into the ID. It is not linked to your identity, is not used for advertising, and is not shared with anyone.

What the server does not store: your email, real name, phone number, any account, your contacts, precise or approximate location, or your IP address. Your IP address is used only in memory, for a short time, to limit abusive request rates, and is never written to our database. Our hosting providers may keep standard technical access logs for a short period for security and operations.

Why (purposes and legal bases)

• to run the gallery and leaderboards you ask to use (performance of the service; GDPR Art. 6(1)(b));
• to keep them fair and safe - replaying runs to stop faked times and scores, limiting request rates, filtering and moderating reported content (legitimate interests; GDPR Art. 6(1)(f)).

Automatic checks: level names, creator names, hints and leaderboard names are screened automatically for offensive words, links and contact details, and a level is hidden automatically after several independent reports until a person reviews it. These checks decide only whether text or a level may be shown; they have no other effect on you.

How long

• Published levels: until you remove them from the editor, or until moderators remove them.
• Leaderboard entries: while the level and the leaderboard exist. A new best time replaces the old one.
• Weekly time-trial entries: deleted 12 weeks after your last time that week.
• Daily Lab entries: deleted 90 days after the day they belong to.
• Play records: kept only to count one play per day; they may be deleted after 90 days.
• Reports: until they are resolved, then for up to 12 months as a moderation record.

Who can see it and who processes it

Published levels, leaderboard names, times and Daily Lab scores are public. Our server and database run on Railway (Railway Corporation, United States), and the website is served by Cloudflare (Cloudflare, Inc., United States). They process data on our behalf and under their own security obligations. Using them means data may be transferred to and stored in the United States; where required, such transfers rely on the providers' standard contractual clauses.

5. Network requests

The game loads its own files (HTML, CSS, JavaScript, level data and image assets) from wherever you are running it. The online features described in section 4 send requests to our API server. The landing page also asks the API for the current world records and today's Daily Lab rankings to display them.

Live counter. While a page is open and visible, it sends a small request to our API about every 30 seconds. It contains a random ID that the browser tab creates for itself (kept only until the tab is closed) and the number of games and arcade runs started since the last request. The server keeps these IDs in memory only: a tab heard from in the last minute or so counts as playing right now, and a tab ID it has not seen in the last 30 minutes adds one to the site-wide visit total ("12,345 visits"); game counts are added to the site-wide play totals ("12,345 games played"). To keep scripts from inflating the visit total, the number of new visits per IP address is also counted in memory and reset every hour. Neither the ID, the IP address nor any per-person record is written to the database; only the totals are.

Visit statistics. We use Cloudflare Web Analytics to see aggregate figures such as page views, referring sites, countries and device types. It uses no cookies or local storage, does not fingerprint your device and does not follow you across other websites. It is provided by Cloudflare, our hosting provider.

No request goes to an advertising or cross-site tracking service.

6. Children's privacy

PHYSICS LAB is not directed at children under 13 and asks no one for personal information. Because players can publish levels and choose a public leaderboard name, parents may wish to remind children never to type a real name or other personal details.

7. Third-party services

No third-party advertising, crash reporting or social SDKs are integrated. Cloudflare Web Analytics (section 5) comes from our hosting provider Cloudflare and sets no cookies. The hosting providers named in section 4 are the only processors. Share buttons are plain links to the services named in section 3; those services are only contacted if you tap one.

8. Your rights

Data protection laws such as the GDPR and Korea's Personal Information Protection Act (PIPA) give you rights of access, correction, deletion, restriction, objection and portability.

• Delete a level you published: open it in the editor → Share → Remove.
• Leaderboard entries and anything else: email [email protected] with the leaderboard name and the level(s) concerned. Because there are no accounts, we may ask you to show the device ID from your browser so we can find the right entries; we will not ask for anything more.
• You may also lodge a complaint with your local data protection authority.

We answer requests within 30 days.

9. Changes

If we change how data is handled, we will update this policy and its effective date before the change takes effect.

10. Contact

Questions about this policy: [email protected]

11. Business operator

Terms of service · Delete your data