Carbon Copy is operated by Junhyeok Park, an individual based in the United States and the controller responsible for the personal information described in this notice. In this notice, “we” means that operator. This notice explains how we handle information in the browser game, desktop game, and related online services. Contact us at playcarboncopy@gmail.com about privacy or your information.
Playtest closure: The Carbon Copy browser playtest has concluded. Hosted gameplay, matchmaking, relay, and judging services are paused. This notice explains how information collected during the playtest, including retained data and backups, is handled after closure.
Information we use
- Profile and settings: your nickname, avatar, generated player/device identifier, language, audio and room preferences, and reconnect information let the game remember you and restore play. Much of this information is stored in your browser or app.
- Your Library and History: uploaded images, crop sources, limited-palette versions, titles, drawings, scores, attempt dates, and reference/round identifiers let you create challenges and revisit attempts.
- Cloud saves: when Steam-backed cloud saving is available and authenticated, the game automatically synchronizes profile, settings, Library, and History with our coordinator. These backups include original uploaded images and crop sources, even when a painting is private. Desktop cloud files can also synchronize through Steam Cloud. Cloud storage is not end-to-end encrypted.
- Multiplayer and rankings: room membership, chosen contributions, readiness, connection state, live painting updates, final submissions, scores, and ratings support matches, reconnection, fair results, and rankings. When an eligible Steam leaderboard submission is made, our service receives the completed drawing to validate its score.
- Room chat: messages you send are shared with players in your current room alongside your nickname. Recent messages and delivery records are kept for the room in memory and, where room recovery is available, in encrypted server-only recovery snapshots. These snapshots can preserve recent chat through a coordinator restart while the room remains recoverable. We remove active chat and its recovery records when the room closes or its recovery retention ends. Chat is not saved to your Library, History, or cloud saves. Other players can copy or capture messages.
- Achievements: for authenticated Steam accounts, our coordinator stores painting and upload counts, repeated-painting progress, Rated win streaks, completed-round/match identifiers, and earned achievement progress against a hashed account identifier. It uses completed game results and reports of relevant drawing actions to track milestones, prevent duplicate counting, and synchronize earned unlocks with Valve. Valve stores Steam achievement unlocks separately.
- Steam information: Steam authentication supplies an account identifier and authentication proof. We may obtain your Steam display name, avatar, subscriptions, and relevant leaderboard information. Steam handles your Steam login and purchases under its own terms; you should not send us your Steam password.
- Technical information and correspondence: network requests include IP addresses and connection identifiers. Startup/error logs and site performance measurements help operate and protect the service. If you contact us, we receive your message, contact details, and information you choose to include.
- Multiplayer session duration: we record a random session identifier, connection and disconnection times, session status, and connected duration to understand service usage, plan server capacity, and troubleshoot connection problems. The coordinator temporarily uses the existing player/device identifier in memory to join brief reconnects and avoid double-counting simultaneous connections. The session-duration log itself does not include that identifier, nicknames, IP addresses, Steam IDs, chat, or drawings. These measurements concern time connected to a multiplayer room, not attention or active drawing; they do not track your browsing on other websites.
What other players can receive
Room contribution and public eligibility are separate choices. Contributing a painting to a room shares its limited-palette version and relevant title/attribution with that match. Making a painting eligible for public matches permits that version to be used in those matches. Those sharing paths do not include its original image or crop source. This is separate from the private cloud backup described above.
Other participants receive the profile and gameplay information needed to play, including your nickname/avatar, drawing updates, submissions, and results. They may retain references, drawings, attribution, and results in their own History, and can capture or broadcast what they see during play. Deleting your Library painting cannot recall copies already received by other players.
Public leaderboard entries can associate a score and rank with your Steam identity and display name. If you use Steam Workshop, Valve controls its publication, subscription, visibility, and community features. Subscribed paintings may synchronize automatically; subscribing does not publish your own Library. Workshop packages contain the shared limited-palette artwork, not your original/crop files.
Hosting, connections, and browser storage
During the playtest, OVHcloud hosted the main game, coordination services, stored game data, and a multiplayer relay. The hosted game, coordination, relay, and judging services are now paused. OVHcloud may retain stored service data and backups under its provider lifecycle. Railway's former judges deployment and retained legacy storage are separate from the paused playtest service. Cloudflare provides DNS, protection, and static hosting for the closure page. Steam supplies supported platform features. Cloudflare's site performance beacon collects page-performance and related request information. Multiplayer connections may use direct peer connections or relay services, including Steam networking where available. Direct connections can expose network addresses to other participants.
Connections to the hosted game use HTTPS/TLS. Browser peer gameplay uses WebRTC's encrypted data channels, including when a TURN relay carries the traffic. Our service can read game content, backups, and submissions sent to it, and participants can read the content shared with them. This network encryption does not make cloud saves end-to-end encrypted.
Authentication uses cookies to maintain your session and protect the Steam sign-in flow. Browser/app storage remembers settings, identity, Library, and History. Blocking or clearing this storage can sign you out or remove local progress; it does not erase server or Steam records.
Carbon Copy does not include cross-site advertising trackers. The hosted game, authentication, relay, and judging services are paused. The game does not change its data handling in response to a browser's legacy “Do Not Track” signal; provider notices below explain their separate practices.
Providers process information to deliver their services and may maintain their own security and operational records. Their notices explain their separate practices: OVHcloud privacy, Railway privacy, Cloudflare privacy, Cloudflare performance measurements, and Steam privacy. We may also disclose information when required by law or when reasonably necessary to investigate abuse or protect someone's rights or safety.
Session-duration records are stored in restricted operational logs on our hosting infrastructure for the operator's use. They are not shown to other players or sent to an advertising service.
Purposes and international processing
We use profile, authentication, Library, cloud-save, match, rating, and achievement information to provide the game features you request. Where European or UK data-protection law applies, our basis for processing necessary to deliver those features is performance of our agreement with you. We use technical records and correspondence for our legitimate interests in preventing abuse, troubleshooting, maintaining reliable service, and resolving support or content complaints. We process information needed to meet a legal obligation on that basis. Where processing requires consent, that consent must be obtained separately; this notice is not a substitute for it.
The operator is based in the United States. During the playtest, the main hosting was an OVHcloud server in Virginia, United States. Railway's former judges service and retained legacy storage are separate from the paused playtest. Cloudflare provides DNS, protection, and static hosting for the closure page. Provider operations, backups, access by the operator, and copies held by other services or players can involve the United States and other countries. Those countries' privacy laws may differ from yours. Contact us for information about the locations and applicable transfer arrangements, including how to obtain a copy of any relevant contractual safeguards.
How long information remains
Local Library, History, and preferences generally remain until you remove them or clear the app/browser's data. Cloud saves, ratings, and achievement progress are persistent so that progress can be restored, duplicate counting prevented, and rankings maintained; they are not automatically erased when a match ends or you log out. Temporary connection, session, transfer, and cache records expire or are replaced as their operational purpose ends.
For information we control, retention depends on whether it is still needed to provide your saved progress or requested service, resolve a current support/security matter, comply with a legal obligation, or complete a deletion request. Backups and providers' records may have separate lifecycles. Copies held by other players and Steam are distinct from our active coordinator data.
The temporary in-memory link used to combine brief reconnects is removed after the session ends. Recorded session-duration events remain in operational logs after that point and are removed through log rotation or deletion under the operational and support criteria above; leaving a room does not immediately erase those log entries.
Your choices and requests
You can edit your profile/settings and choose which paintings to contribute or make publicly eligible. Library Delete removes that painting and its saved source files from the local Library; it does not also delete earlier History entries or recall shared copies. Logout ends a login session, rather than deleting your information.
Email playcarboncopy@gmail.com to request access, a copy, correction, or deletion of information we control. Explain what you want removed and, if relevant, provide your Steam profile link or account identifier so we can locate the correct records. We may need proportionate verification that the request is yours. Do not send passwords, authentication tickets, or unrelated sensitive documents.
When we complete a verified coordinator-erasure request, we remove the account's coordinator cloud save, linked rating and achievement records, and review/report information that we can reliably associate with the request. We retain a minimal hashed account identifier and erasure date to block that account's coordinator cloud reads, uploads, and achievement tracking, so an older device cannot automatically restore the erased progress. This record remains while needed to enforce the erasure instruction; there is no automatic cloud or achievement reactivation. Continuing to play can create new gameplay or rating records.
This process does not wipe your devices or Steam Cloud. We will explain which local or platform copies you need to manage and may ask you to close other running copies of the game while the request is handled. Operator backups can contain earlier data; a backup must be separately handled for the request and must not return erased data to the active service. Contact us before attempting to resume cloud saving after erasure.
A server deletion does not itself clear every browser, device, Steam Cloud copy, Steam achievement, Workshop item, leaderboard entry, or another player's History. We will explain the scope of a request, any information that must be retained, and the steps needed for copies outside our control. Depending on where you live, applicable law may also give you rights to object to or restrict processing, receive portable data, withdraw consent where relied on, appeal a decision, or complain to a privacy authority. We will respond within the period required by applicable law.
Children
Carbon Copy is intended for a general audience and is not directed to young children. If you are a parent or guardian concerned that a child has provided personal information, contact us so we can investigate and take appropriate action, including deletion where required.
Changes to this notice
We will update the date when this notice changes and provide additional notice when a material change or applicable law requires it. A later notice does not authorize an incompatible use of previously collected information without any choice or consent required by law.