UNRAVEL

PRIVACY POLICY

Effective Date: July 30, 2026

At Unravel, we are committed to protecting your privacy. This Privacy Policy details how we collect, store, encrypt, and handle data when you use the Unravel interactive 3D generative pixel canvas and WebGL physics simulation.

1. COLLECTION AND PROCESSING OF DATA

Unravel is designed to minimize the collection of Personally Identifiable Information (PII). We do not require or collect your real name, email address, physical address, or phone number.

  • Device Identifiers: We generate a unique cryptographic UUID client-side and store it in your browser storage. This device ID is transmitted as an HTTP header (x-device-id) to validate user sessions, process daily challenge streaks, and secure access to your creations.
  • User-Generated Artwork: When you save a creation, share an artwork link, or submit to the public gallery, the grid coordinates, pixel colors, and scrambled positioning states are stored in our secure database.
  • Optional Account Credentials: If you choose to sync your creations across devices, you must register a custom username and a 6-digit PIN. We store only this username and the bcrypt-hashed value of your PIN.

2. STORAGE MECHANISMS AND PWAS

Unravel operates as a Progressive Web App (PWA) with fully offline capabilities. To provide these features:

  • IndexedDB Storage: We use local IndexedDB stores (UnravelStorageDB) on your local device to automatically preserve drafts and save recent creations. This data is stored entirely client-side.
  • Service Worker Cache: Service workers cache site static resources and fonts locally to guarantee load speeds and off-network usability.
  • No Tracking Cookies: We do not deploy advertising, tracking, or marketing cookies.

3. THIRD-PARTY INFRASTRUCTURE

To deliver reliable hosting and asset generation, we share specific visual elements with trusted infrastructure partners:

  • Cloudinary: Low-resolution thumbnail previews generated from your grid canvas are uploaded directly to Cloudinary for optimized delivery when sharing links on social media platforms.
  • Neon DB: Our server-side analytics, session states, and creation logs are stored on Neon serverless databases.
  • Upstash: Redis cache is used to manage API request rate-limits to defend against Denial of Service (DoS) attacks.

4. CREDENTIAL SECURITY AND RECOVERY LIMITS

CRITICAL NOTICE: PIN credentials are encrypted one-way using bcryptjs on our server backend. Because we do not collect email addresses, we cannot recover or reset forgotten PINs. If you lose your PIN, you will lose access to your online account permanently.

5. CHILDREN'S ONLINE PRIVACY

Unravel complies with the Children's Online Privacy Protection Act (COPPA). We do not knowingly collect personal identifiers or contact details from children under 13.

6. YOUR RIGHTS: EXPORT AND DELETION

You can delete all local creations by clearing your browser site data or choosing "Start Fresh." To request deletion of synced creations associated with your device identifier or registered account, please reach out to admin moderation.