Privacy Policy

Last updated: February 25, 2026

Welcome to Mirlo Volador ("we," "us," or "our"), a browser-based hand-tracking bird game available at mirlovolador.fun. We are committed to protecting your privacy and being transparent about the data we collect and how we use it. This Privacy Policy explains in detail what information we gather, why we gather it, how we protect it, and what rights you have regarding your data.

By using Mirlo Volador, you agree to the collection and use of information as described in this policy. If you do not agree with this policy, please do not use our service.

1. Information We Collect

1.1 Information You Provide Voluntarily

When you create a pilot profile to participate in the leaderboard, you may provide:

• Username: A display name of your choosing. This is publicly visible on the leaderboard.
• Game scores: Your gameplay scores are recorded and associated with your profile for leaderboard ranking purposes.

We do not require an email address, real name, phone number, or any other personal identification to create a profile or play the game.

1.2 Information Collected Automatically

• Country detection: When you create a profile, we use the ipapi.co service to determine your approximate country based on your IP address. This is used solely to display a country flag next to your leaderboard entry. We do not store your IP address in our database.
• Device and usage information: Through Vercel Analytics, we collect anonymized data about your device type, browser, operating system, screen resolution, and general usage patterns (such as page views and session duration). This data is aggregated and cannot be used to identify individual users.
• Camera access: The game uses your device's camera to enable hand-tracking gameplay via MediaPipe. All camera processing occurs entirely within your browser on your local device. No camera images, video frames, or hand-tracking data are ever transmitted to our servers or any third party. The camera feed is processed in real-time and immediately discarded after each frame.

1.3 Information Collected by Third Parties

Certain third-party services integrated into our website may independently collect information as described in Section 5 of this policy. We do not control and are not responsible for the data collection practices of these third parties.

2. How We Use Your Information

We use the information we collect for the following purposes:

• Leaderboard functionality: Your username, country, and scores are used to maintain and display the global leaderboard so players can compete with each other.
• Game operation: Camera data is processed locally on your device to enable the hand-tracking game mechanic. This data never reaches our servers.
• Analytics and improvement: Aggregated, anonymized usage data helps us understand how players interact with the game so we can improve the experience, fix bugs, and optimize performance.
• Advertising: Third-party advertising services display ads on our site to support the free operation of the game. We do not share your personal data with advertisers, though advertisers may collect their own data through cookies as described below.
• Security: Cloudflare Turnstile is used to protect the service from automated abuse, bots, and malicious activity.

3. Cookies and Tracking Technologies

3.1 What Are Cookies

Cookies are small text files stored on your device by your web browser when you visit a website. They serve various purposes including remembering preferences, enabling functionality, and supporting advertising. Some cookies are set by us (first-party cookies) and some are set by third-party services we use (third-party cookies).

3.2 Types of Cookies We Use

• Essential cookies: Required for basic site functionality, such as maintaining your session state, storing your pilot profile locally, and enabling Cloudflare security verification. These cookies are strictly necessary for the service to function and cannot be disabled without breaking core game features.
• Analytics cookies: Used by Vercel Analytics to collect anonymized usage data. These cookies help us understand traffic patterns, popular features, and areas for improvement. They do not contain personally identifiable information.
• Advertising cookies: Placed by Google AdSense and its advertising partners to serve advertisements. These cookies may track your browsing activity across different websites to build an interest profile and deliver personalized, relevant ads. They are set by Google and its network of advertising partners.

3.3 Managing Cookies

You can control cookies through your browser settings. Most modern browsers allow you to view, block, or delete cookies. However, blocking essential cookies may prevent the game from functioning properly.

To opt out of personalized advertising specifically, you can visit:

• Google Ads Settings to manage your Google advertising preferences.
• Network Advertising Initiative opt-out page to opt out of interest-based advertising from participating companies.
• Digital Advertising Alliance opt-out for additional advertising preference controls.

4. Data Storage and Retention

4.1 Where Your Data Is Stored

Leaderboard data (usernames, countries, and scores) is stored in a Supabase-hosted PostgreSQL database. Supabase infrastructure is hosted on cloud providers and may be located in various regions globally. Analytics data is processed and stored by Vercel's infrastructure. Advertising data is processed by Google's global infrastructure.

4.2 Data Retention Periods

• Pilot profile data (username, country): Retained until you choose to delete your profile, or until the service is discontinued. Upon deletion, this data is permanently removed from our database.
• Game scores: Retained as long as your pilot profile exists. Deleting your profile permanently removes all associated scores from our database and the leaderboard.
• Analytics data: Retained by Vercel in accordance with their data retention policies, typically for up to 12 months in aggregated, anonymized form.
• Camera and hand-tracking data: Not retained at all. Processed in real-time within your browser and immediately discarded after each frame. This data never leaves your device.
• Advertising cookies and data: Retained by Google and its advertising partners in accordance with their respective privacy policies. We do not control Google's data retention practices. Google's advertising cookies typically expire after a set period, which varies by cookie type.
• Security verification data: Cloudflare Turnstile data is retained by Cloudflare in accordance with their privacy policy and is used solely for bot protection purposes.

5. Third-Party Services

We integrate the following third-party services into Mirlo Volador. Each has their own privacy practices, and we encourage you to review their policies:

• Google AdSense: Provides advertising on our site. Google may use cookies and tracking technologies to serve ads based on your prior visits to our site and other websites. Google's use of advertising cookies enables it and its partners to serve ads based on your browsing history. Review Google's Privacy Policy for full details.
• Vercel Analytics: Provides anonymized, privacy-focused website analytics. Vercel collects aggregated data about page views, device types, geographic regions, and usage patterns without using personally identifiable information. Review Vercel's Privacy Policy for full details.
• Cloudflare Turnstile: Provides bot protection and security verification to prevent automated abuse of our service. Cloudflare may collect device fingerprint information, browser characteristics, and interaction patterns to distinguish legitimate users from bots. Review Cloudflare's Privacy Policy for full details.
• Supabase: Provides the database infrastructure for storing and serving leaderboard data. Supabase processes data in accordance with their privacy policy and data processing agreements. Review Supabase's Privacy Policy for full details.
• ipapi.co: Provides IP-based geolocation for country detection. When you create a pilot profile, your IP address is sent to this service to determine your country. The IP address is not stored by us after the country is determined. Review ipapi.co's Privacy Policy for full details.
• MediaPipe (Google): Provides the hand-tracking machine learning model that runs entirely in your browser. In our implementation, no video data, hand landmark data, or any other camera-derived data is transmitted to Google or any external server through MediaPipe. All processing is local.

6. Your Rights and Choices

6.1 General Rights

Regardless of where you are located, you have the following rights:

• Play without a profile: You can enjoy the game fully without creating a pilot profile. Without a profile, no personal data beyond anonymized analytics is collected.
• Delete your profile: You can delete your pilot profile at any time from within the game interface. This permanently and immediately removes your username, country data, and all associated scores from our database and the public leaderboard.
• Deny camera access: You can decline the browser's camera permission request. This will prevent the hand-tracking game mechanic from functioning, but you can still view the website.
• Opt out of personalized ads: Use the links provided in Section 3.3 to manage your advertising preferences and opt out of interest-based advertising.
• Clear cookies: Use your browser settings to clear cookies at any time.

6.2 How to Exercise Your Rights

To delete your profile, use the profile management feature within the game interface. For any other data-related requests, including requests for data access, data portability, or questions about our practices, contact us at privacy@mirlovolador.fun. We will acknowledge all legitimate requests within 7 days and provide a substantive response within 30 days.

7. GDPR Compliance (European Economic Area)

If you are located in the European Economic Area (EEA), the United Kingdom, or Switzerland, you have additional rights under the General Data Protection Regulation (GDPR) and equivalent legislation.

7.1 Legal Basis for Processing

We process your data under the following legal bases:

• Consent: We process camera data based on your explicit consent when you grant camera permission through your browser. We serve personalized advertisements based on consent obtained through cookie consent mechanisms. You can withdraw consent at any time by revoking camera permissions or managing cookie preferences.
• Legitimate interest: We process anonymized analytics data based on our legitimate interest in understanding how players use the game so we can maintain and improve the service. We have conducted a balancing test and determined that this processing does not override your fundamental rights given the anonymized nature of the data.
• Contract performance: We process leaderboard data (username, country, scores) as necessary to provide the leaderboard service you explicitly request when creating a pilot profile.

7.2 Your GDPR Rights

Under the GDPR, you have the right to:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate personal data we hold about you.
• Erasure: Request deletion of your personal data ("right to be forgotten"). You can exercise this directly by deleting your pilot profile.
• Restriction: Request that we restrict processing of your personal data under certain circumstances.
• Objection: Object to our processing of your personal data based on legitimate interests.
• Data portability: Request to receive your personal data in a structured, commonly used, machine-readable format.
• Withdraw consent: Withdraw your consent at any time where processing is based on consent, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint: File a complaint with your local data protection supervisory authority if you believe your rights have been violated.

To exercise any of these rights, contact us at privacy@mirlovolador.fun. We will respond within the legally required timeframe of 30 days.

8. CCPA Compliance (California Residents)

If you are a California resident, the California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA) provides you with specific rights regarding your personal information:

• Right to know: You have the right to request that we disclose the categories and specific pieces of personal information we have collected about you, the categories of sources from which we collected it, our business purpose for collecting it, and the categories of third parties with whom we share it.
• Right to delete: You have the right to request that we delete the personal information we have collected from you, subject to certain exceptions permitted by law.
• Right to correct: You have the right to request that we correct inaccurate personal information we maintain about you.
• Right to opt out of sale or sharing: We do not sell your personal information in the traditional sense. However, the use of advertising cookies by Google AdSense may constitute a "sale" or "sharing" under the CCPA's broad definitions. You can opt out by managing your advertising preferences through the links provided in Section 3.3.
• Right to non-discrimination: We will not discriminate against you for exercising any of your CCPA rights. You will not receive a different level of service or different pricing for exercising your privacy rights.

To exercise your CCPA rights, contact us at privacy@mirlovolador.fun. We will verify your identity before processing your request and respond within 45 days as required by law.

9. Data Security

We take reasonable and appropriate measures to protect the information associated with our service:

• Encryption in transit: All data transmitted between your browser and our servers is encrypted using HTTPS with TLS 1.2 or higher.
• Database security: Leaderboard data stored in Supabase is protected by row-level security policies, ensuring users can only access and modify their own profile data. Database access requires authentication tokens.
• Bot protection: Cloudflare Turnstile protects against automated attacks, abuse, and unauthorized access attempts.
• No passwords stored: We do not use a password-based authentication system, eliminating the risk of password database breaches.
• Local camera processing: Camera and hand-tracking data never leaves your device, completely eliminating the risk of camera data breaches from our infrastructure.
• Minimal data collection: We follow the principle of data minimization, collecting only the information necessary to provide the service (username, country, scores).
• Regular updates: We keep our dependencies and infrastructure up to date to address known security vulnerabilities.

While we implement these security measures, no method of electronic transmission or storage is completely secure. We cannot guarantee absolute security of your data but will promptly notify affected users and relevant authorities in the event of a data breach that poses a risk to your rights and freedoms, as required by applicable law.

10. International Data Transfers

Mirlo Volador is available globally, and data may be processed in countries other than your country of residence. Specifically:

• Supabase database infrastructure may be hosted in the United States and other regions.
• Vercel's analytics and hosting infrastructure operates globally with data centers in multiple countries.
• Google's advertising and analytics services process data across their global infrastructure.
• Cloudflare operates a worldwide network of data centers and may process security-related data in any of these locations.

Where data is transferred outside the European Economic Area, we rely on the safeguards implemented by our third-party service providers, which may include European Commission adequacy decisions, Standard Contractual Clauses (SCCs), or other approved transfer mechanisms to ensure your data receives an adequate level of protection regardless of where it is processed.

11. Children's Privacy

Mirlo Volador is not specifically directed at children under the age of 13. We do not knowingly collect personal information from children under 13. The game can be played without creating a profile, in which case no personal data is collected beyond anonymized analytics.

If you are a parent or guardian and believe your child under 13 has created a pilot profile or otherwise provided personal information to us, please contact us immediately at privacy@mirlovolador.fun and we will take prompt steps to delete such information from our systems.

We encourage parents and guardians to monitor their children's online activity and to help enforce this policy by instructing children to never provide personal information through online services without permission.

12. Do Not Track Signals

Some browsers include a "Do Not Track" (DNT) signal. There is currently no industry standard for how websites should respond to DNT signals. Our site does not currently respond to DNT signals, but you can manage tracking through the cookie and advertising preference controls described in Section 3.3.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the technologies we use, legal requirements, or other factors. When we make changes:

• We will update the "Last updated" date at the top of this page.
• For significant changes that materially affect how we handle your data, we will provide a prominent notice on our website before the changes take effect.
• We will retain prior versions of this policy for reference.
• We encourage you to review this Privacy Policy periodically to stay informed about our data practices.

Your continued use of Mirlo Volador after any changes to this Privacy Policy constitutes your acceptance of the updated policy. If you do not agree with the revised policy, please discontinue use of the service.

14. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy, our data practices, or your personal data, please contact us at:

Email: privacy@mirlovolador.fun

We aim to acknowledge all inquiries within 7 days and provide a substantive response within 30 days. For requests related to GDPR or CCPA rights, we will respond within the timeframes required by applicable law.