Privacy & Cookies
- No ads, no tracking, no analytics and no cookies.
- The game is free. The only thing you can buy with real money is Pewpkins Plus, an optional one-time extra, and only a grown-up should buy it. Coins can never be bought.
- You can play without an account. Then your Numpkin's name, colour, skins, coins and game stats are saved only on your own device.
- An account is optional. A grown-up must say yes by email first. Then we keep your username, coins, skins, game stats and the achievements you unlocked, and show only your username on the leaderboards.
- If you play with friends, your device connects directly to theirs, so they see your Numpkin's name. Use a fun nickname, not your real name!
- We only get personal details if a grown-up sends us a support message.
1. Who is responsible
The controller for this website and game under the EU General Data Protection Regulation (GDPR) and the Spanish data protection law (LOPDGDD) is:
Lerudi Consulting S.L.
Calle Maestra Ángeles Aspiazu 12, Planta 3, Puerta D
Edificio Andrómeda
29640 Fuengirola (Málaga)
Spain
NIF / VAT ID: ESB93515062
Email: p@lerudi.com
For any privacy question or to use your rights, write to p@lerudi.com or use the support form and choose "Privacy / data request".
2. What happens when you visit pewpkins.com
The game is a set of static files hosted by Vercel Inc. (USA). To deliver those files and protect the service from abuse, Vercel's servers process technical data that every browser sends: your IP address, the date and time, the page requested, browser type and operating system. Vercel keeps such logs only for a short period according to its own policies.
Legal basis: Art. 6(1)(f) GDPR. We have a legitimate interest in showing you the game securely and reliably. Vercel acts as our processor. Transfers to the USA are covered by the EU-U.S. Data Privacy Framework and/or the EU Standard Contractual Clauses. See Vercel's privacy policy.
We do not use analytics, advertising, social media plugins, tracking pixels or fingerprinting. Fonts and all other game files come from pewpkins.com itself, not from third-party content networks.
3. Cookies and storage on your device
Pewpkins sets no cookies. To remember your choices between visits, the game uses your browser's local storage. This data never leaves your device:
| Key | What it stores | How long |
|---|---|---|
numpkin-profile | Your Numpkin's nickname and colour, chosen maze, number of bots, bot difficulty, mouse speed and the last party code you typed | Until you clear it |
numpkin-audio | Sound effects, music and voice on/off settings | Until you clear it |
pewpkins-meta | Guest progress: coins, skins you bought or won, your outfit, your daily-reward streak, and your own game stats from the last 30 days (for your guest spot on the leaderboards) | Until you clear it; game stats older than 30 days are dropped |
pewpkins-session | Only if you log in: your username and login tokens, so you stay logged in | Until you log out |
pewpkins-device-account | Only for an account made without a password: its username and device key, so this device can log in to it | Until the account is deleted, or its password is reset |
pewpkins-account | Only if you log in: a copy of your account's game data (coins, skins, outfit, progress), so the menu shows it straight away | Until you log out |
pewpkins-life | Your lifetime game totals on this device (for example tags, wins, slides) and the achievements you unlocked | Until you clear it |
pewpkins-levels | Levels you made in the Level Editor | Until you clear it |
numpkin-sniper-best | Your best Lookout Tower wave | Until you clear it |
pewpkins-cloud-at | Steam edition only: when this computer's progress was last saved to Steam Cloud | Until you clear it |
pwk_store_plus, pwk_store_owned | Phone apps only: which in-app purchases (Pewpkins Plus, packs) this phone's store account owns, so they work offline | Until the app is removed |
pwk_update_hidden | Phone apps only: that you closed the "new update" note, so it stays away until the next version | Until the app is removed |
This storage is strictly necessary to provide the settings you ask for, so no consent banner is needed (Art. 5(3) ePrivacy Directive and the national laws based on it, such as Germany's § 25(2) TDDDG). You can delete it at any time:
4. Playing with friends (party play)
When you choose Play with Friends, your browser connects to your friends' browsers using WebRTC with the help of PeerJS:
- A PeerJS signalling server (
0.peerjs.com, run by the open-source PeerJS project) introduces the players using a temporary random ID and the 4-letter party code. - To find a connection path, the game asks a STUN server for the device's public IP address. If a direct connection is impossible (some school, office and mobile networks block them), the game traffic is relayed through a TURN server. We use the STUN and TURN servers of Cloudflare, Inc. (USA, our processor, covered by Standard Contractual Clauses;
stun.cloudflare.com,turn.cloudflare.com). To use them, the game first fetches short-lived access details from pewpkins.com (hosted by Vercel); your IP address is held in memory there for at most 10 minutes to stop floods, then forgotten. If Cloudflare's servers are unavailable, the game falls back to Google's STUN server (stun.l.google.com) and the PeerJS project's TURN servers (eu-0.turn.peerjs.com,us-0.turn.peerjs.com). A relay only passes the game traffic along; it does not keep it. - Players in the same party can see each other's IP address (a technical part of direct connections), Numpkin nickname, colour, position and scores.
Nothing about the match is stored by us. It disappears when the party ends. Party play only starts when you press Host Party or Join, so nothing here happens in solo games. Legal basis: Art. 6(1)(b) and (f) GDPR (providing the multiplayer feature you asked for). These services may process data outside the EU.
5. Accounts, coins and leaderboards
Accounts are optional. Without one, everything stays on your device (see section 3) and you see where you would be on the leaderboards, in grey; you are not shown to anyone else.
Signing up. A player picks a username, optionally a password, and gives a grown-up's email address (a parent or guardian, or their own address if they are 14 or older). The account stays locked until the grown-up clicks YES in the email we send. This is how we get a parent's consent for children under 14 (Art. 8 GDPR, Art. 7 LOPDGDD). If nobody confirms within 7 days, or the grown-up clicks No, the account and everything in it is deleted.
| What we store | Why |
|---|---|
| Username | To log in, and shown on the public leaderboards (nothing else about the player is shown) |
| Password, or a device key | To log in. Without a password, the game makes a long random key on the player's device and uses it instead; the player never sees it. Either way we store only a scrambled hash, which we cannot read |
| Link code (short-lived) | To join another device to the account without a password: a signed-in device asks for a 6-character code, which works once and for 10 minutes. We keep only a scrambled hash of it, deleted when used or expired |
| Grown-up's email address | Only to ask for consent and to send password-reset links. Never shown to anyone and never used for marketing |
| Coins, skins, outfit and colour, the daily-reward streak and weekly leaderboard prizes won | To keep what the player earned |
| Game stats per match (date, mode, tags, zaps fired, hits, jumps, distance and similar game numbers) | For the leaderboards and the won skins |
When you log in for the first time, the coins, skins and game stats saved as a guest on that device are moved into the account.
Legal basis: Art. 6(1)(b) GDPR (providing the account the player asked for) together with the grown-up's consent, Art. 6(1)(a) and Art. 8 GDPR. The grown-up can withdraw consent at any time by asking us to delete the account.
Who processes it: the account database is hosted by Supabase, Inc. on servers in the European Union (Ireland), as our processor. Consent and password emails are sent through Resend (see section 6). Supabase and Resend are US companies; any access from outside the EU is covered by the EU Standard Contractual Clauses and/or the EU-U.S. Data Privacy Framework.
How long: until the account is deleted. The player can delete it in the game (My account → Delete my account); a grown-up can also ask us at p@lerudi.com. Deleting removes the account, username, email address, coins, skins and all game stats at once. Accounts that have not been used for 3 years are deleted.
Coins can only be earned by playing. They cannot be bought, sold or exchanged for money.
Steam edition. If you play Pewpkins on Steam, you can sign in with your Steam account instead of the grown-up's email. Steam (run by Valve Corporation, USA, who decide themselves how they use Steam data) tells our server your SteamID so we know which Pewpkins account is yours. We store the SteamID with the account, not your Steam name, friends or anything else from Steam. When you pick your Pewpkins username you confirm that you are 14 or older, or that a grown-up said yes. Achievements are unlocked in your Steam profile. The game files on your computer keep the same settings and guest progress as listed in section 3. Legal basis: Art. 6(1)(b) GDPR (the account you asked for).
Phone and tablet apps. The Pewpkins apps for Android (Google Play) and iPhone/iPad (App Store) are the same game: they store the same settings and guest progress on the device (section 3) and use the same optional accounts and party play. They contain no ads, no analytics and no tracking tools.
Pewpkins Plus (purchases). Pewpkins Plus is an optional one-time purchase. It is sold and paid for entirely through Steam, Google Play or the App Store: they handle the payment and your payment details, under their own terms and privacy policies, and we never see card or bank details. The game only learns from the store whether this device's store account owns Plus. In the phone apps every purchase first asks a grown-up to solve a sum. If you are signed in to a Pewpkins account, we note on the account that it has Plus (and, on Steam, check your SteamID's ownership with Valve), so Plus works wherever you log in. Legal basis: Art. 6(1)(b) GDPR (the purchase you asked for).
6. Support messages
If you send a message with the support form, we receive your name, email address, topic and message, plus your browser type and the page you sent it from to help fix problems. A small server function on pewpkins.com (hosted by Vercel) passes the message to our inbox using the email service Resend (Resend, Inc., USA, our processor, covered by Standard Contractual Clauses). The form does not store anything itself. To stop spam floods, your IP address is held in memory for at most 10 minutes and then forgotten.
Purpose and legal basis: to answer you, Art. 6(1)(a) GDPR (your consent, which you can withdraw any time) and Art. 6(1)(f) GDPR (handling inquiries). Retention: we delete support emails no later than 12 months after the matter is closed, unless the law requires us to keep them longer.
You can also simply email p@lerudi.com.
7. Children
Pewpkins is made for kids, so we collect as little as possible. Nobody needs an account to play. Accounts need a grown-up's confirmation first (section 5), and only usernames are ever shown. We ask players to pick a fun username, not their real name, and we block rude words in usernames. We ask that support messages come from a parent or guardian, or someone aged 16 or older. If you believe a child has given us personal data without a grown-up's consent, contact us and we will delete it.
8. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you (Art. 15)
- have it corrected (Art. 16) or deleted (Art. 17)
- restrict its processing (Art. 18)
- receive it in a portable format (portability, Art. 20)
- object to processing based on legitimate interests (Art. 21)
- withdraw consent at any time, with effect for the future (Art. 7(3))
- complain to a data protection supervisory authority (Art. 77). Ours is the Spanish Agencia Española de Protección de Datos (AEPD). You can also complain in the EU country where you live or work.
We do not sell personal data and do not use automated decision-making or profiling.
9. Security and changes
The site is served only over encrypted HTTPS. We may update this policy when the game changes. The date at the top shows the current version.