Privacy Policy

Last updated: 19 October 2026

Iron Thumbs is a party game: a television (or any big screen) shows the game, and the phones in the room are the controllers. This policy covers the website at ironthumbs.com and the Iron Thumbs mobile app, both published by Tinbell Studio.

The short version. You can play without an account, and without giving us anything. If you sign in, we keep your name and email so your scores carry your name. There is no advertising, no third-party analytics, no tracking across other apps or sites, and nothing is sold or shared with anyone. We count our own visits and games on our own server, without names or IP addresses.

Playing without signing in

Joining a room needs no account. You pick a nickname and an emoji for the round; they live in the server's memory for as long as the room is open and are gone when it closes. Nothing about a guest session is written to disk.

Our own counts

We keep a simple tally on our own server so we know whether anyone is playing: page loads, rooms opened, which games were played and for how long, and which link a visitor arrived by when it carries a campaign tag. To tell a returning browser from a new one, the site stores a random id in your browser's local storage. It is not tied to your name, your account or your address, it is never sent anywhere but our server, and clearing your browser data removes it. No IP addresses are stored. No third party is involved.

If you sign in with Google or Apple

Signing in is optional. When you do, we store exactly three things about you:

the account identifier Google or Apple gives us (an opaque number, not your password);
your display name;
your email address.

We also note the first and last time we saw you, so we can tell dormant accounts from active ones. We never receive your password, and we never ask for one: your provider signs you in and hands us a token we verify against their own public keys. We do not request access to your contacts, calendar, files, photos or anything else held by that provider.

Scores

Each game keeps a single best result: the score, the game it belongs to, the display name attached to it, and when it was set. That is what the records board on the screen shows. Nothing else about a round is kept once the round is over.

What the app asks your phone for

Camera — only to scan the QR code on the television so the phone can join the room. The image is read on your device to find the code; no photo or video is stored, and none ever leaves the phone.
Vibration — to make the controller buzz in your hand during a game.
Motion sensors — some games steer by tilting the phone. Those readings are used to move your character in the moment and are never recorded.

What we do not do

No advertising and no ad identifiers.
No third-party analytics or crash-reporting SDKs. There is no third-party tracking code in the app or on the site; the only counting is our own, described above.
No selling, renting or sharing of personal data with anyone.
No profiles built about you, and no tracking of you across other apps or websites.

Where it is kept

The service runs on servers in Paris, France, operated on our behalf by Fly.io. Traffic reaches them over HTTPS. Google and Apple act as the sign-in providers; their own privacy policies cover what happens on their side of that exchange.

How long it is kept

Account details and your best scores stay until you ask us to remove them. Everything else — rooms, nicknames, the moment-to-moment state of a game — exists only while the room is open.

Your choices

You can ask for a copy of what we hold about your account, ask us to correct it, or ask us to delete it altogether; deleting an account removes its scores with it. Write to [email protected]. If you are in the EU or UK, the GDPR rights of access, rectification, erasure, restriction, portability and objection apply, and you may complain to your national data protection authority.

Children

Iron Thumbs is built to be family-friendly, but signing in requires a Google or Apple account, which those providers restrict by age. We do not knowingly collect personal data from a child who is below the age of consent in their country. If you believe a child has signed in, write to [email protected] and we will delete the account.

Changes

If this policy changes, the date at the top changes with it, and material changes will be announced on the site before they take effect.