Privacy

Last updated 19 June 2026. Plain version: we keep what we need to run the puzzle, for as short as we can, and tell nobody.

What we store

• Your photo. Uploaded to Cloudflare R2 so the link recipient can see it. Auto-deleted after 30 days via a lifecycle rule.
• A short puzzle ID (7 chars) in a key-value store, pointing to the photo + the chosen grid size and hole. Same 30-day expiry.
• A teaser PNG (the scrambled preview shown in link previews on iMessage, WhatsApp, etc.). Stored alongside the photo, same 30 days.
• An optional sender name if you typed one. Stored with the puzzle record.
• An optional face image if you enabled "drop my face in" mode. Stored in R2 with the same 30-day expiry as the main photo and scanned by the same content classifier on upload.

What we don't store

• No accounts, no email, no password, no phone number.
• No third-party analytics, no cookies that follow you anywhere, no ad networks.
• No EXIF beyond what's left after the JPEG re-encode the browser does before upload.

What runs in your browser only

• Your personal best times live in localStorage. Local to your device. Never uploaded.
• The reciprocity attribution flag ("did you create a puzzle after solving one?") lives in sessionStorage for one tab.

Logs and abuse defense

• Cloudflare logs an IP address briefly when you upload, so we can rate-limit and stop abuse. Not linked to a name; rotated by Cloudflare.
• Every uploaded image is scanned by an automated content classifier (Cloudflare Workers AI). Anything flagged is rejected before it's stored.
• Anyone can report a puzzle from the share screen. Reports go to us; the puzzle can be killed early.

Anonymous funnel events

We log a handful of one-bit events — "received", "started", "solved", "revealed", "created-back" — to measure whether the receive-and-reply loop works. No IDs, no identifiers, no cross-session linking. Aggregate counts only.

Your rights

• Delete a specific puzzle early: tap "Report" on its share screen, or email us.
• Want everything related to you removed before the 30 days? Same path — email us.
• EEA / UK residents have the usual GDPR rights (access, erasure, objection). We process under "legitimate interest" for abuse defense and "consent" for everything you upload.

Who runs it

slip.pic is built and operated by JoTo (the company behind joto.games). Data controller: JoTo. Contact: tom+slippic@joto.games.

Changes

If we change anything material, the date at the top moves and the live link still works. We won't quietly start collecting more.