Privacy policy

Last updated: April 28, 2026

How camera processing works

When you tap start on the play page, your browser asks for camera access. If you allow it, your browser opens the camera and streams frames into a small pose-estimation neural network that runs entirely on your device. Each frame is analyzed locally and immediately discarded. No frame is ever transmitted to any server — not ours, not a third party, not a CDN.

We do not have any technical mechanism to record, save, or replay your video, and we do not want one. The camera stream is held only in the browser tab's memory and stops the moment you close the tab.

What we keep on our own servers

When (and only when) you submit a leaderboard entry we store:

• The display name you typed (≤ 20 characters).
• Your final score for that run.
• The rep timeline — millisecond timestamps of each counted rep, used by our anti-cheat checks.
• The challenge id and the date/time of submission.
• A short, one-way hash of your IP address (kept up to 30 days for abuse and rate-limit detection — we cannot reverse it back into an IP).
• An anonymous player ID (a random 24-character hex string generated by your browser) so we can deduplicate repeat entries from the same browser and credit sparks to the right wallet. The ID is not linked to any external account, email, or login.

Alongside leaderboard entries we keep two small in-game economy files:

• A wallet record keyed by your anonymous player ID, containing your lifetime spark count, current spark balance, and creation/update timestamps.
• An append-only ledger of each spark award — player ID, challenge id, sparks delta, reason code (e.g. reps, finished, pb), and timestamp. We use this to audit the game economy and catch abuse.

That is the entire list for our own servers. We do not collect biometric data, body measurements, photographs, or any information from the camera frames themselves. We do not collect your real name, address, phone number, email (unless you write to us), or precise location.

Sparks (in-game progression tokens)

Playing a challenge earns you sparks, an in-game token shown on your result screen and in the header. Sparks accumulate into a tier (Bronze → Silver → Gold → Diamond → Mythic) that is purely cosmetic.

Sparks are not:

• Money, cryptocurrency, or any equivalent.
• Redeemable for cash, gift cards, goods, or services outside SixSeven.
• Transferable between players or accounts.
• Tradable on a marketplace.
• Tied to ad views — sparks are awarded for gameplay activity (reps, completions, personal bests, daily return, in-session streaks) and never for watching, clicking, or interacting with advertisements.

Sparks have no monetary value and we will not pay them out under any circumstances. They exist only to give a sense of progress and to unlock decorative items inside SixSeven. We may adjust the earning rates, tier thresholds, or available rewards at any time without notice.

Analytics and tag management

We use Google Tag Manager (GTM) on every page of SixSeven to manage third-party measurement and advertising scripts. GTM is itself only a loader — by itself it does not collect personal data — but the tags it loads do. The tags we run, or may run, through GTM include:

• Google Analytics 4 — measures aggregate site usage: page views, sessions, traffic source, country, device and browser stats. Sets first-party cookies and processes a truncated version of your IP address.
• Google Ads / conversion tracking — measures the effectiveness of ad campaigns we may run, and may build a remarketing audience.
• Other measurement, attribution, or remarketing tags we may add as our marketing setup evolves. The current list of active tags is always discoverable in your browser's network panel undergoogletagmanager.com and the individual tag domains.

These services log standard request metadata (IP, user agent, referrer, timestamp), set their own cookies and storage, and are governed by their providers' privacy policies — most notably Google's at policies.google.com/privacy.

We do not push any leaderboard data — your display name, score, or rep timeline — to any analytics or advertising tag. The data on our own servers is never combined with third-party browsing data.

Cookies and similar storage

The tags above may set cookies in your browser. The ones you are most likely to see:

• _ga, _ga_* — Google Analytics 4 client/session IDs (~ 2 years).
• _gcl_au — Google Ads conversion linking (~ 90 days).
• Other Google cookies (IDE, NID, etc.) as set by ad and remarketing tags we add later.

We do not set our own tracking cookies for advertising. Our only first-party storage is a handful of localStorage entries described in the dedicated section below. They live on your device and are never read by an analytics or advertising tag.

To block the third-party tags entirely, use a tracking-blocker extension such as uBlock Origin or Privacy Badger, enable the Global Privacy Control signal in your browser, or install the official Google Analytics opt-out add-on. The site continues to work fully — only the analytics fall silent.

What we do not do

• No sale of personal data for money. We do not sell user data to brokers, partners, or anyone else.
• No video, audio, or biometric recording. Nothing your camera or microphone produces is ever transmitted off your device.
• No combining ads data with our leaderboard data. The display name and score we keep are never sent to Google or any other ad platform.
• No first-party advertising cookies of our own. Any ad-tech cookie you see came from a third-party tag described above.

Browser local storage

For your convenience we store a few small values in your own browser using localStorage:

• sixseven:name — your most recent display name, so you do not have to retype it.
• sixseven:pb — your personal best per challenge, shown next to your final score.
• sixseven:pb-daily — your best score today, used to power the “today's best” badge. Resets at local midnight.
• sixseven:pid — a randomly generated 24-character hex player ID, used to dedupe leaderboard entries and credit sparks to your wallet on the server. It is created entirely on your device, is not derived from any device fingerprint, and is not linked to any account, email, or external identifier.

All of these live only on your device and never reach our server except for sixseven:pid, which we receive when you submit a score so we can apply leaderboard dedupe and sparks awards. You can clear all of these at any time from your browser settings; doing so resets your sparks tracking on this browser.

Third-party assets we load

The hand-pose neural network and its WebAssembly runtime are served from SixSeven's own domain — we vendor MediaPipe's public assets at build time and your browser fetches them from us, not from any third-party CDN. The only off-domain requests on the play page are the analytics/advertising tags described above, which SixSeven loads on every page.

Your rights and choices

• Delete your leaderboard entry. Email [email protected] with the display name and approximate submission date and we will remove the entry, typically within 7 days.
• Opt out of analytics and advertising tags. Use a tracking-blocker extension, enable Global Privacy Control, or install the Google Analytics opt-out add-on linked above.
• EU / UK (GDPR). You have rights of access, rectification, erasure, restriction, portability, and objection. Our legal basis for analytics is legitimate interest in improving the service; you can object at any time using the opt-out methods above or by emailing [email protected].
• California (CCPA / CPRA). You have rights to know, delete, and correct. We do not sell personal data for money. Some advertising tags may meet the CPRA definition of “sharing” for cross-context behavioral advertising — to opt out of that sharing, enable the Global Privacy Control signal in your browser (we honor it for the Google services we use) or block the tags with an extension.

Children

SixSeven is intended for users 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child has submitted a leaderboard entry, contact us and we will remove it.

Changes

We may update this policy from time to time — for example, if we add a new tag or feature that needs a new disclosure. The “last updated” date at the top of this page will reflect the most recent change. Material changes will not apply retroactively to data we have already collected.

Contact

Questions, deletion requests, or anything else: [email protected].