Privacy policy

This policy explains what data Culprit (culprit.day) processes, why, for how long and what your rights are. It is written to be read, not just accepted.

Data controller

Antonio Morlino, reachable at info@antoniomorlino.com. The service is hosted by Netsons S.r.l. (Italia, UE).

Culprit is published under the name Pacca Studio, the label Antonio Morlino uses to publish games and apps, on Google Play too: all the Pacca Studio games are at paccastudio.com. Pacca Studio is not a company: the data controller remains Antonio Morlino.

Playing without an account

You can play without signing up. Your progress, stars, name and avatar then stay only in your browser (localStorage) and are never sent to us. The server only receives the requests needed to show the case of the day and to judge accusations, without linking them to a person.

Data processed with an account

If you create an account we process:

• your e-mail address, or the identifier of your Google account and the e-mail Google gives us (Sign in with Google);
• the name you choose in the game and the avatar parameters (face shape, hair, hat and the like: graphic choices, not a photograph);
• the face you show to other players (a stock detective, the parts avatar or, only if you choose so, the detective drawn from your photo) and the accessories you put on it (hat, glasses);
• your public nickname, which you choose at your first sign-in: it is the only name other players see on the leaderboard;
• new case alerts, if you turn them on: your choice (e-mail yes or no, hour) and, for notifications on the device, the technical address your browser gives us to deliver them;
• games played: date, hints used, outcome, rating, notebook;
• stars and every change to them (earned, spent, gifted, bought);
• your detective code, friends and the messages attached to star gifts (80 characters at most);
• purchases: pack, amount, currency, payment provider and transaction identifier. We never receive or store card or PayPal account details. In the Android app the purchase goes through Google Play: we only receive the purchase token and the order number.

The detective from your photo

If you buy the "Your detective" product (or unlock it on the leaderboard) you can upload a photo of your face to be drawn as the detective of the comic. It is your choice, with an explicit consent at upload time, for people aged 16 or over and only for photos of yourself.

The photo is scaled down on your device, sent to our server and from there to fal.ai (United States), which on our behalf hands it to an image model by Google (Gemini) that draws your comic portrait. The drawn portrait, not the photo, then goes to a video model by Google (Veo), which animates it into a few short clips (talking, getting angry, laughing and so on): through fal.ai up to 20 October 2026, through OpenRouter (United States) from 21 October 2026. fal.ai, OpenRouter and Google process the photo and the portrait, each for its own part, to generate these results, under their respective terms. We delete the original photo as soon as the job is done, in any case within 24 hours; we keep only the results (the drawn portrait and the clips), which stay private: only your account downloads them and they appear in the videos and pictures you choose to share. Other players see a thumbnail of the portrait only if you choose to show it (see "The face other players see").

To put a hat and glasses on the detective, and to show it small, your device works out once, in your browser, where eyes, forehead and the outline of the face are in the drawn portrait and in the clips, with an open-source library (MediaPipe) downloaded from our server: for this the pictures never leave the device. We store with the detective only those coordinates and two colours of the drawing (the white of the eye and the iris); they cannot be used to recognise you and we do not use them for that.

If you have a "real face" detective, the product sold up to version 1.8: to rest the head on the detective's body your device worked out once where eyes, mouth, chin and forehead are in the picture of the face, in your browser, with an open-source library (MediaPipe) downloaded from our server. We store only those few coordinates with the face; they cannot be used to recognise you and we do not use them for that.

Portrait and clips stay as long as you keep them: you can delete them from Settings → Your detective → Remove my detective, and they are deleted with the account. We do not use the photos to train models or to recognise you.

Why and on what basis

• to provide the service you ask for (performance of a contract): account, saved progress, friends, purchases;
• for security and to prevent abuse (legitimate interest): limits on sign-in links, gifts and purchases, the star ledger;
• for legal obligations: keeping the tax records of purchases.

We do not use your data for advertising, we do not sell it and we do not profile you. There are no third-party analytics or tracking tools.

Cookies and browser storage

We use one technical cookie, culprit_session: it keeps your account session open for 90 days and can only be read by the server. It holds for culprit.day and for the games under the same domain, Culprit Arcade (arcade.culprit.day) and The World of Culprit (world.culprit.day): their server uses it only to ask Culprit who you are, so the same account lets you in everywhere. It needs no consent because it exists only to provide the service. The browser also keeps your progress, language, avatar, a random device identifier and your cookie choices in localStorage: they stay on your device.

Fonts are served from our own server: no request goes to Google to display them.

The only third-party service loaded in the page is Google's script for the "Sign in with Google" button, which may set Google cookies on the accounts.google.com domain. We load it only if you accept it in the banner or in the cookie preferences, found at the bottom of the home and of the settings. Without consent you can sign in with the e-mail link.

We record every cookie choice you make (text version, choices, date, language, device identifier, hashed IP address and browser type) to be able to prove it, as the GDPR requires. This log is kept for five years.

The leaderboard

If you have an account and close cases on their own day you enter the monthly leaderboard and the all-time one, which anyone can open from the game. It shows only your public nickname, the face you chose to show (see below), your points, solved cases and hints used, in the month and in total. It shows no name, e-mail or other data, and never your photograph. You can change the nickname whenever you like from the settings; deleting the account removes you from the leaderboard.

The same public data, that is your nickname and the face you chose to show, also appear on the leaderboard of Culprit Arcade (arcade.culprit.day), the sister action game, together with the results you get there. Arcade receives from Culprit only a number that identifies the account, the nickname, that face, how many stars you have and who the culprit was in yesterday's case, if you closed it (to let that one run in your night): never name, e-mail or photograph. Arcade's leaderboards are of the day, of the month and of all time. If you end on the podium of the day you receive stars, and the stars you spend there are taken here: Arcade tells Culprit only these movements, which you find on the Stars screen.

In The World of Culprit (world.culprit.day) you play with your detective, the same one you see here. World receives from Culprit the account number, the nickname, the language and your detective; for now only you see it.

The face other players see

On the leaderboard and in the friends list a face shows next to your name. You choose it in Settings → Your detective, among:

• a stock detective, the same for anybody who picks it: this is the default for everybody, also for those who have a detective drawn from their own photo;
• the parts avatar, which you put together from graphic choices;
• the detective drawn from your photo, if you have one: it shows in public only if you choose so, with a box when you upload the photo or later from the settings, and it carries a small badge next to your name. It is a drawing, but it may look like you: that is why it is never shown without your choice.

If you choose to show it, other players receive only a square thumbnail of the portrait, with the hat and glasses you put on it: never the photo, never the clips. You can change your mind whenever you like: from then on the thumbnail is no longer handed to anybody (the browser of someone who already saw it may keep a temporary copy for one hour at most). In the comic, in the videos and on the front pages of your cases, which you see and share only if you want to, your own detective always appears.

Who sees your data

Providers help us and process data on our behalf, each for its part only:

• Brevo (France, EU) to send the e-mails with the sign-in link and, if you turn them on, the new case alerts (each one carries the link to stop them);
• your browser's notification service (Google, Apple, Mozilla or Microsoft), if you turn on notifications on the device: it gets only an empty signal from us, with no data about you and no text;
• Google for Sign in with Google, if you choose it: Google gives us identifier, e-mail and name;
• Stripe and PayPal for payments from the website, Google Play for purchases in the Android app: they handle payment data under their own policies;
• Netsons S.r.l. (Italia, UE) for hosting and technical server logs (IP address, date and time, requested page), kept for security for the period set by the provider.
• Google Drive (Google) to keep the backup copies of the database off the server: the copies are encrypted before they leave and the key stays with us, so Google holds the files but cannot read their content.

Case illustrations may be generated by an artificial intelligence service (OpenAI) from the case text, which contains no personal data.

• fal.ai (United States) and OpenRouter (United States) and, through them, the Google models that draw and animate your detective, only if you use that product (see the dedicated section).

Players you add as friends see your in-game name, the face you chose to show, your streak and today's outcome. Never your e-mail.

For how long

• account and games: as long as the account exists; if you ask to delete it, 24 more days, then they are deleted for good;
• sessions: 90 days from the last visit; sign-in links: 20 minutes;
• gift messages: as long as the recipient's account exists;
• backup copies of the database (they serve to restore the game after a failure): up to about 12 months, then deleted automatically;
• purchase records: 10 years, as required by tax law, even after the account is deleted, no longer linked to your profile.;
• photo uploaded for the detective: deleted when the job is done, within 24 hours at most; drawn portrait and clips: until you or the account delete them.

Deleting your account

You can delete your account from Settings → Delete account and data, at the bottom of the page. The account closes at once: every session ends, you disappear for friends and the leaderboard and you get no more alerts. For 24 days the data stay on our servers, so you can change your mind: just sign in again with the same e-mail or the same Google account and you find everything as it was. After the 24 days we delete for good e-mail, name, nickname, avatar, the detective from your photo with its portrait and clips, games, stars, cards, friends and gifts: from then on they cannot be recovered. Only purchase records remain, unlinked from your profile. Your data may remain in the backup copies, encrypted, until they are deleted automatically (about 12 months at most): we do not use them, except to restore the game after a failure, and then we delete the accounts already removed once again. You can ask for the same by writing to info@antoniomorlino.com.

Your rights

You have the right to access your data, correct it, delete it, restrict its processing, object and receive it in a readable format (portability). Write to info@antoniomorlino.com: we answer within 30 days. You can also lodge a complaint with your data protection authority.

Children

The game is not designed for children. You must be at least 14 to create an account, the digital consent age in Italy. If we find an account of a younger person without the consent of a guardian, we delete it. Uploading a photo for the detective requires being at least 16, the GDPR age of digital consent in the European Union.

Changes

If we change this policy we update the date below and, for important changes, we say so in the game. Last update: 2026-10-19.