No account needed to play.日本語

POCKET64 Privacy Policy

Last updated: July 31, 2026

Bloom Studio Inc. (the "Operator") handles user information in connection with the POCKET64 web service (the "Service") as described in this Privacy Policy.

1. Information we collect or process

The Operator collects or processes the following information to provide the Service.

1.1 Account and authentication information

  • An identifier associated with your Google account
  • Your name or profile name, email address, email-verification status, and profile image provided by Google
  • Tokens and other authentication information issued in connection with OAuth authentication
  • Your POCKET64 user ID, generated or user-selected display name, and guest or Member status
  • Session identifiers and session creation, update, and expiration information

The specific information obtained from Google depends on the Google consent screen shown to you and the OAuth permissions in effect at that time.

1.2 Game and progression information

  • The game played, score, date and time of play, and duration or frame count
  • The seed used for a run, score identifier, and daily and weekly aggregation keys
  • Personal bests, XP, rank, medals, and leaderboard position
  • Frame-numbered taps, drags, and other in-game input events submitted to validate a score

Input events are processed to replay a run on the server and validate its score for anti-cheating purposes. The current application does not persist the input-event sequence itself in the database after validation.

1.3 Device, network, and environment information

  • IP address
  • User agent and browser and device information
  • Request time, requested resource, response status, errors, and security-related logs
  • Identifiers and settings stored in cookies, local storage, or other browser storage

1.4 Communications

If you contact us, exercise a privacy right, or report a bug, we may collect your name, email address, the content of your request, identity-verification materials, and other information needed to respond.

2. How we use information

The Operator uses information to:

  1. create guest sessions, authenticate users, register Members, and manage accounts;
  2. provide games; verify and save scores; and calculate personal bests, XP, ranks, and medals;
  3. create and display daily, weekly, and all-time leaderboards;
  4. transfer guest data to a Member account;
  5. generate shared-score pages and social-sharing images;
  6. detect, prevent, investigate, and respond to cheating, bots, excessive requests, unauthorized account use, and other violations;
  7. troubleshoot, maintain, understand use of, improve, and develop the Service;
  8. respond to communications, verify identity, and handle privacy-rights requests; and
  9. enforce the Terms, resolve disputes, comply with law, and respond to legal process.

The Operator does not currently use user information for behavioral advertising, third-party ad delivery, or an analytics service such as Google Analytics.

3. Information made public

  1. A Member's display name, game, score, position, rank, medal, and similar information may be publicly visible on leaderboards.
  2. A shared-score URL may display a user's display name, game, score, and rank. If the URL is posted to an external service, that service may copy, cache, or redistribute the information under its own systems and policies.
  3. Guests generally do not appear on public leaderboards. If guest scores are transferred during registration, those scores may become eligible for leaderboards after registration.

4. Cookies and local storage

  1. The Service uses essential cookies to maintain signed-in and guest states, complete OAuth authentication, prevent abuse, and protect security. An authentication session may last up to 90 days. A short-lived session cache may be stored in a cookie to improve performance.
  2. The Service stores a game identifier and personal-best value in `localStorage` to show a per-game personal best on initial display. When a server-side record is available, the server-side value controls.
  3. You can remove cookies and local storage through your browser settings. Removing or disabling them may cause loss of access to guest results, signed-in status, the initial personal-best display, or other features.
  4. The Service does not currently use advertising or analytics cookies. Before introducing them, the Operator will update this Policy and obtain any consent required by applicable law.

5. Service providers and integrations

The Operator uses or integrates with the following providers as necessary to operate the Service:

| Provider | Primary role | Information that may be processed |

|---|---|---|

| Google | User authentication through Google OAuth | Authentication request, Google account identifier, profile information, and authentication tokens |

| Vercel | Hosting, content delivery, networking, and operational logs | IP address, user agent, request information, and data transmitted to and from the Service |

| Neon | Production database | Account, session, score, progression, and other information stored in the database |

Each provider may handle information under its contract terms and privacy policy. The Operator selects and oversees providers using contracts and other measures appropriate to the nature of the processing.

6. Disclosure to third parties

The Operator does not disclose personal data to a third party except:

  1. with your consent;
  2. as required or permitted by law;
  3. when necessary to protect a person's life, body, or property and obtaining consent is difficult;
  4. when especially necessary to improve public health or promote the sound development of children and obtaining consent is difficult;
  5. when cooperation with a government authority performing duties under law is necessary and obtaining consent may interfere with those duties;
  6. in connection with a merger, acquisition, business transfer, or other succession; or
  7. when processing by a service provider, joint use, or another arrangement is not treated as third-party disclosure under applicable data-protection law.

The Operator does not sell personal information.

7. International processing and transfers

Providers used by the Service may process or store information in countries or regions outside Japan. The Operator takes measures required by applicable law, such as entering into appropriate contracts and reviewing providers' security practices. Where the law requires disclosure of a processing country, the foreign legal system, or safeguards in place, you may request that information using the contact details in Section 13.

If information about a user in the EEA, United Kingdom, or another jurisdiction is transferred internationally, the Operator will use an available lawful transfer mechanism where required, such as an adequacy decision, standard contractual clauses, or another safeguard recognized by applicable law.

8. Retention

The Operator retains information only for as long as needed for the purposes described in this Policy or as required by law. The principal criteria are:

  1. Member account, score, and progression data: while the account exists and, after deletion, for a reasonable period needed for legal compliance, dispute resolution, abuse prevention, and backup management
  2. Guest accounts and scores: until transfer to a Member account, a verified deletion request, or operational deletion of data no longer needed after session expiration
  3. Authentication sessions: generally up to 90 days from creation, but potentially shorter following sign-out, account deletion, or a security response
  4. IP addresses used for rate limiting: for the short rate-limit window and the period needed for abuse prevention; the current system progressively deletes expired counters
  5. Input events submitted for score validation: for the time needed to process the validation request; the current application database does not persist them
  6. Browser local storage: until you clear the Service's site data in your browser
  7. Communications: for the time needed to respond and handle potential legal claims

Information in backups or a provider's operational logs may be deleted later under the applicable provider's retention cycle.

9. Security

The Operator uses reasonable organizational and technical safeguards designed to prevent unauthorized access, use, disclosure, loss, destruction, or alteration. These measures include access controls, management of authentication credentials and signing keys, protection of communications, server-side score validation, rate limiting, and appropriate provider selection.

No internet transmission or electronic storage system can be guaranteed completely secure. If you identify a security issue, contact the Operator under Section 13.

10. Your rights

Depending on applicable law, you may have rights to request notice of the purposes of use, access, correction, completion, deletion, suspension of use, erasure, cessation of third-party disclosure, or access to records of third-party disclosure concerning your information.

If you are in the EEA or United Kingdom, you may also have rights under applicable data-protection law to access, correct, or erase personal data; restrict processing; receive portable data; object to processing; and withdraw consent for processing based on consent. You may also lodge a complaint with the supervisory authority where you live.

To make a request, contact the Operator under Section 13. The Operator may ask you to verify your identity through account information or another reasonable method to prevent impersonation. Where permitted by law, the Operator may charge a fee or decline all or part of a request and will explain the reason where reasonably possible.

11. Legal bases for processing

For users in the EEA, United Kingdom, and other places requiring legal bases to be stated, the Operator principally processes information on the following bases:

  1. Performance of a contract: to provide accounts, games, scores, leaderboards, and sharing features
  2. Legitimate interests: to secure, operate, troubleshoot, improve, and protect the fairness of the Service and prevent abuse, provided those interests are not overridden by your rights and interests
  3. Legal obligation: to comply with law and lawful requests from courts or government authorities
  4. Consent: to provide an optional feature for which applicable law requires consent; you may withdraw that consent prospectively at any time

The Service does not make decisions based solely on personal data that produce legal or similarly significant effects on users. Score validation, ranking, and medal calculations under game rules are entertainment functions within the Service.

12. Children under 13

The Service is not directed to children under 13, and children under 13 may not use it. If the Operator learns that it has collected personal information from a child under 13, it will take reasonable steps to verify the situation and delete the information unless retention is required by law. Contact the Operator under Section 13 if you believe this may have occurred.

13. Contact, complaints, and requests

  • Operator: Bloom Studio Inc.
  • Email: pocket64@googlegroups.com

To request account deletion, contact us from the email address used to register or provide information that reasonably identifies the relevant account.

14. Changes to this Policy

The Operator may revise this Policy to reflect changes in the Service or applicable law. If a change is material, the Operator will give advance notice of its effective date and substance by posting it in the Service or through another reasonable method.