Privacy notice

The built-in sample and “Advanced: choose subjects manually” mode do not upload your photo. The browser reads one JPEG, PNG, or WebP file, applies image orientation, decodes and crops it with Canvas, and computes a SHA-256 digest to recognize the same file. Photo pixels, crops, and game state normally remain in the current page's memory. The exact original file bytes are retained while the page is open. After completion, you can download the orientation-corrected full-resolution working photo and a memory card. The photo download is not a byte-for-byte copy of the uploaded file. Memory cards are rendered locally with Canvas; neither download uploads the photo.

Local play requires no registration. Publishing shared puzzles requires sign-in. Temporary Blob URLs are released when a photo is replaced or the page closes.

Choosing Review and publish after automatic recognition saves one private draft in this browser so your photo and selected subjects survive sign-in and refresh. This draft includes the working photo and analysis, but no test token. It is available for 24 hours; expired drafts are removed when accessed again. Publishing or explicitly discarding the draft removes it. You can also remove it by clearing this site's browser data. This step does not publish the photo or make another model request.

Clicking Publish uploads one orientation-corrected photo and stores the puzzle, its account ownership, and the data needed to play. A published photo stays until you delete the puzzle, with no automatic seven-day expiry. Sharing the same link reuses that stored photo; publishing again creates another copy.

Anyone with the link can view, save, or forward the photo without signing in. After solving, recipients can choose Download keepsake; saving is manual. Deletion disables the puzzle link and removes the server photo and associated puzzle records. If storage deletion fails, the creator is asked to retry. Deletion cannot recall copies already downloaded, forwarded, or cached by others.

Deleting your account also removes its published photos. Once account deletion starts, new publications are blocked. If photo removal fails, the account remains so deletion can be retried.

Creators can see open counts, recorded finishes, optional display names, and finish times. A random browser cookie lasting up to one year limits repeat counts; the database stores its puzzle-specific hash. Clearing cookies or changing devices can count again. These counts are not verified unique people or proof of solving.

Automatic analysis is a controlled, optional feature. You first enter the test token on the current page and choose “Unlock photo upload.” The browser sends that token to the same-origin GET /api/photo-puzzle/analyze readiness check. This verifies the test token and server-side provider configuration without a photo, upstream model call, or photo-analysis quota use. The token stays only in this page's React memory and is sent only to this site's same-origin readiness and analysis endpoints. The app does not write it to the URL, localStorage, a database, or application logs, and refreshing the page clears it.

After readiness succeeds, a disclosure appears beside the automatic upload control. Choosing a file through “Choose photo and build automatically” is the informed trigger for that analysis. The app first checks for valid browser-local coordinates for the same file. A cache hit builds the game without uploading the photo or calling the model. Otherwise, the browser immediately sends one re-encoded, orientation-corrected, proportionally downscaled JPEG copy to this site's server. On selected transient failures, the server retries once, sending the same copy to the vision provider at most twice. There is no separate consent checkbox or “analyze” button. Advanced manual selection is a separate local option that needs no token and makes no upload.

The analysis route reads the photo in memory for that request. It does not write the photo to a database, object store, or server cache, and responses use Cache-Control: no-store. The model returns subject candidates only. Code selects one to three non-overlapping targets from validated candidates and installs a game without manual boxes or per-box review. No usable candidates means no new game. Drafts and labels for non-sample photos lack independent visual verification, so their cards use a neutral poetic line, without unverified names, relationships, dates, places, emotions, or events. Finishing the game does not make another model call.

When a server key is configured in a controlled test environment, the server forwards the photo copy to the Alibaba Cloud Model Studio Beijing qwen3-vl-plus OpenAI-compatible endpoint configured through PHOTO_PUZZLE_BASE_URL and server-only credentials. The code rejects arbitrary hosts, other regions, and other models.

An allowed endpoint address does not verify the provider's actual data-storage location or retention period. Processing depends on server configuration and provider policies, which have not been independently verified. Before a public launch, the operator must identify the actual provider and review its privacy, retention, training, and data-location policies. Use only the sample or local mode if you do not accept that processing.

After successful AI analysis passes validation and installs as a game, the app stores the schema v3 result in browser localStorage: candidate IDs, labels, clues, visible-extent and occlusion markers, normalized rectangles, code-selected targets, and rejection diagnostics. Caption drafts in old entries are discarded on load and are not used on non-sample completion cards. Entries are scoped to the page language, and the key contains the photo's SHA-256 digest; cached data contains no photo pixels. This lets the same file reuse its selections without another upload or model call. The completion screen does not provide caption editing.

Clear this site's browser data to delete the cache. It is not synced between browsers, devices, or private windows.

Games may fill the tray with bundled people, cat, or bouquet assets. These images do not come from the photo uploaded for this game and are not generated by its inference request. Their individual sources and licenses have not been independently verified; that check remains a release requirement.

Hosting and network providers may receive ordinary request metadata, such as IP address, time, User-Agent, and error logs. The deployed site's operator and host control that processing, not this repository's game code. The operator must update this notice before adding analytics, accounts, storage, or other services.

This template does not name a data contact. Contact the operator of the deployed site for privacy requests.