Privacy Policy
Last updated 13 October 2026. Pinch is in invited beta.
1. The short version
We keep what Pinch needs to work and little else. We do not sell your data, we show no advertising, we run no third-party analytics or tracking cookies, and we do not keep your IP address in our database.
2. What we hold
- Who you are: your email address, or, where we offer Google sign-in, the account identifier Google gives us if you sign in that way. Your handle, display name and bio, which are public. If you create without signing in, you get a guest account that holds no email at all.
- What you made: your prompts and the conversation of a creation, the Playables built from them, and their history.
- How it went: records of each creation — what it cost us to run, which model served it, whether it passed verification — and, when someone plays a Playable, the length of the session, a broad device description, and how many frames were drawn. Play sessions are not tied to a name or an email unless the player is signed in.
- Keeping the lights on: a one-way fingerprint of your network address and browser, which we use to stop one person exhausting the free allowance many times over, and to rate-limit sign-in codes. We hash the address and keep only the hash; the address itself is not written to our database. A fingerprint like this can still relate to you, so we treat it as personal data.
- Safety: reports made about a Playable, and a record of any moderation action we take.
- Invite requests: if you ask for an invite, the email address you give us, when you asked, and whether we have sent one. We use it only to send your invite. It is not an account and is not added to any mailing list.
3. What we do not hold
No payment details — Pinch takes no money. No IP addresses in our database — though the hosting providers below keep ordinary request logs, which include addresses, for a limited time. No advertising or analytics identifiers. No location beyond what an address implies before we hash it. No contact list, calendar or files from your device.
4. Cookies
One cookie, for your sign-in session. It is host-only, so it is never sent to the origin your Playables are served from. There are no advertising or analytics cookies, so there is nothing here to consent to or opt out of.
5. Who else touches it
We use a small number of providers, each for one job:
- Anthropic and OpenAI — the models that build your Playable. Your prompt and the code of your project are sent to them to do that. Under their API terms, they do not use it to train their models.
- Neon — the database.
- Vercel — hosting for the site.
- Fly.io — hosting for the origin that serves Playables.
- Cloudflare — caching and protection in front of that origin.
- Resend — sending sign-in codes and service email.
- Google — only where we offer Google sign-in and you choose to use it. It is not offered today.
Building and checking a Playable also runs on a machine we operate ourselves rather than in a datacentre. It holds your project only while the work is running.
We do not sell personal information, and we do not share it for advertising. We will disclose it if the law requires it, or to protect someone from serious harm.
6. Where it lives
On servers in the United States. If you are in the UK or the EEA, using Pinch means your data is handled there.
7. What is public
Your handle, display name and bio are public. A Playable you publish is public to anyone with its link, along with its title and cover. Your prompts and unpublished work are not public.
8. Keeping and deleting
We keep your account and your work until you ask us to remove them. Sign-in codes expire after ten minutes. A sign-in session expires after 180 days. An invite request is kept until the beta ends or you ask us to remove it, whichever comes first.
To have your account and its contents removed, write to support@pinch.gg from the address on the account. We do it by hand during the beta and will confirm within 30 days. We remove your sign-in credentials, your profile, your prompts and conversations, and your Playables. Records we must keep to run the service honestly — what a creation cost us, and any moderation action — are kept with your identity stripped out of them.
9. Your rights
You can ask what we hold about you, ask us to correct it, ask for a copy, or ask us to delete it. Write to support@pinch.gg and a person will answer. If you are in the UK or the EEA you may also complain to your data protection authority.
10. Children
Pinch is for people 18 and over. We do not knowingly collect anything from a child. If you believe a child has an account, write to us and we will close it and delete what it holds.
11. Changes
If we change what we collect or who we share it with, we will update this page and say so — and where the change matters, we will email you.