Privacy

Version 2026-11-03

The short version

You can play without an account. We give your browser a random identifier so your collection comes back when you return, and that is all we need from you.

If you choose to watch a video for a hint, that video comes from Google, and Google uses cookies to show it. You are asked about those cookies before any are set.

What we store

• A random identifier in a cookie called mz_device. It holds no name, no email and nothing you typed, and it lasts two years.
• A player name. Generated for you, and you can change it. It is visible on the leaderboard.
• Which cards you found, when, and how many points they were worth.
• Photos you uploaded or took, and the cards made from them.
• If you sign in with Google: your email address, your name and your profile picture, so your collection can follow you to another device.
• When you last played, and how many hints and videos you used, so the free hint and the video limit work.

Cookies

• Ours. mz_device keeps your collection. During a sign-in two short-lived cookies protect the sign-in itself and are removed after it. These are needed for the game to work.
• Google's. The video ads come from Google AdSense. Google, as a third party, uses cookies to serve ads, and may use them to show ads based on your earlier visits to this and other websites. In the European Economic Area, the United Kingdom and Switzerland you are asked for your consent first, through Google's own consent message, and you can change your choice at any time from the link that message leaves on the page.

You can turn off personalised ads in Google's ad settings, or for many ad companies at once at aboutads.info. How Google uses information from sites that use its services is explained at policies.google.com/technologies/partner-sites.

Photos of people

A photograph of a face is personal data and we treat it as such. When you make a card from your own photo, the photo is sent to the computer that makes the image. That is normally our own machine; when it is busy it can be an image service we rent, which means your photo passes through their systems while the card is being made.

Your photo is kept only as long as it is needed to make the card and to let you make further cards from it. Deleting it from your album deletes it from our storage. Cards made from your own photo are never shown to other players.

Do not upload photographs of other people without their agreement, and do not upload photographs of children.

Who else is involved

We use these companies to run the game. Each sees only what it needs to do its part.

• Hetzner (Germany), where the server and the database run.
• Cloudflare, which sits in front of the site and delivers it.
• Replicate (United States), which makes card images when our own machine is busy, and suggests names for new cards. It receives the description of the picture to make, and the photo when a card is made from one. It does not receive who you are.
• Google, for signing in if you choose to, and for the video ads if you choose to watch one.

What you can do

From your profile you can download everything we hold about you as a file, and you can delete your account. Deleting removes your player record, your own photos and the cards made from them.

Cards you were the first to discover stay in the game, because other players have them in their collections too. They simply stop being linked to you.

How long we keep things

Your collection is kept for as long as you keep your account. Delete it from your profile, or write to us, and it is removed. The mz_device cookie in your browser expires two years after your last visit.

Children

Plopstack is meant for players aged 13 and over. It is not directed at children, and we do not knowingly collect data from children under 13.

Questions

Write to [email protected]. If you think we handle your data wrongly, you can also complain to your national data protection authority. In Belgium that is the Gegevensbeschermingsautoriteit.