Pen Fight operated by LetsCrak

Privacy & Cookie Policy

Effective date: 2 September 2026 · Last updated: 2 September 2026 · Version 2.0

Pen Fight is free and currently sells nothing. We plan to support the game with advertising. This policy explains the data used by the game today and what will happen if Google AdSense or another advertising service is enabled.

1. Who we are

Pen Fight is a browser game available at penfight.site. It is operated by LetsCrak in Sri Lanka. Where data-protection law uses the term “controller”, LetsCrak is the controller for the information described in this policy.

Privacy questions and requests can be sent to hello@letscrak.com.

2. What this policy covers

This policy covers:

• the Pen Fight website and browser game;
• the multiplayer relay and optional account services used by the game;
• optional Google Sign-In and Google Analytics features;
• advertising technology if it is enabled; and
• messages you send to us.

It does not control a third-party site or service that you open from Pen Fight, including WhatsApp, Google, or an advertiser’s website. Their own privacy terms apply after you leave Pen Fight.

3. Information we handle

3.1 Information kept in your browser

The game stores the following information on your device so it can work and remember you:

• your chosen display name, selected pen, sound setting and notice preferences;
• game progress such as levels, stars, unlocked pens, streaks and match results;
• a randomly generated browser identifier used for connection continuity and anonymous game counts; and
• a room code, seat and resume token in session storage for a short multiplayer reconnect.

Unless an account service is configured and you sign in, game progress stays in that browser. Clearing site data can erase it.

3.2 Multiplayer and service data

When you connect to multiplayer, the relay receives your browser identifier, display name, room information, selected pen, connection and microphone status, and the game messages needed to run the match. Other players in the room can see your display name, pen, game actions and status.

Our hosting, relay and security systems may also receive technical data such as your IP address, date and time, requested page, browser or device type, connection events and error or abuse-prevention logs. IP addresses can indicate an approximate area, but Pen Fight does not request your device’s precise GPS location.

At the start of a solo series, the game may send the relay an anonymous event containing the browser identifier, game mode and selected format. This helps us understand whether the game is being used; it does not include your name or email address.

3.3 Voice chat

Voice chat is off until you press the microphone control and grant browser permission. Audio is sent live to players in your room. It normally travels peer to peer using WebRTC; if that route fails, encoded audio may pass through the Pen Fight relay or a configured connectivity relay. We do not intentionally record or store voice audio.

WebRTC connection setup uses connectivity services, which may include Google STUN servers, and exchanges network connection information between participating browsers. This is needed to establish the live connection.

3.4 Google Sign-In and account data

If Google Sign-In is configured, Google’s sign-in library may load in the lobby. If you choose to sign in, we receive a Google account identifier, name, email address, profile image and identity credential. We use them to sign you in, show your profile and, where the account service is available, save progress across devices. We do not receive your Google password.

3.5 Analytics

If Google Analytics is configured, it may receive a page view, the page URL with invite codes removed, referrer, device and browser information, approximate location derived from IP address, and analytics cookies or identifiers. We use this information to understand site performance and general usage. We do not intentionally send Google Analytics your display name, email, voice audio or saved game.

3.6 Advertising data

Pen Fight does not currently sell items. If Google AdSense or another advertising service is enabled, Google and participating advertising vendors may receive or collect the page URL, IP address, browser and device information, general location, ad interactions, cookies and other identifiers. They use this information to deliver ads, limit repetition, measure performance, prevent fraud and, where permitted and selected, personalize ads.

3.7 Information you send us

If you email us, we receive your email address and whatever you put in the message or attachments. We use it to answer the request, investigate a report and keep an appropriate record of the correspondence.

4. Why we use information

Depending on the information and the law that applies, we use it to:

• provide the game, multiplayer rooms, live voice and optional account features;
• remember progress and settings requested by you;
• operate, secure, debug and improve the service;
• measure general use and, if enabled, display and measure advertising;
• prevent cheating, spam, fraud and abuse;
• answer support, privacy, safety and legal requests; and
• comply with law and protect users, LetsCrak and the public.

The legal basis may be performance of a service you requested, our legitimate interests in running and protecting Pen Fight, your consent, or compliance with a legal obligation. When consent is required, you can withdraw it for the future.

5. Cookies and browser storage

Pen Fight itself uses local storage and session storage rather than setting its own first-party cookies. Optional Google services and advertising vendors may place or read cookies and use similar technology.

6. Google advertising and your choices

If advertising is enabled, third parties may place and read cookies on your browser, or use web beacons, IP addresses and other identifiers to collect information as a result of ads being served on Pen Fight.

Google explains how it uses information from publishers in How Google uses information from sites or apps that use its services. Google may show personalized or non-personalized ads depending on your location, eligibility, settings and choices. Non-personalized ads can still use cookies or local storage for frequency capping, aggregated reporting and fraud prevention.

We will not configure advertising requests to include your display name, Google Sign-In email, voice audio or saved game.

When Google advertising is enabled, we will use an appropriate consent and privacy-choice mechanism where required. For visitors in the EEA, United Kingdom and Switzerland, this means a Google-certified consent management platform integrated with the IAB Transparency and Consent Framework. Where applicable law requires it, visitors in supported US states will receive a privacy message with an option to opt out of sale, sharing or targeted advertising as those terms are defined by local law, and the resulting signal will be used to restrict data processing. The consent message will identify the advertising vendors available for your region and provide access to information about how they use data. The platform may store a consent signal so Pen Fight and participating vendors can record and respect your choice.

You can control advertising in several ways:

• use the consent or privacy-choice message shown on the site and, once advertising is enabled, reopen that control to change or withdraw your choice;
• manage Google ad personalization in My Ad Center; and
• block or delete cookies using your browser settings.

7. Who receives information

Information may be shared with the following recipients for the stated purposes:

• other players, who receive the display name, game state and live voice needed for a shared room;
• hosting, relay and account-service providers, which process network, game, account and security data for us;
• Google, for configured Sign-In, Analytics, connectivity and advertising services under Google’s own privacy terms;
• advertising vendors participating through Google or another advertising service when ads are enabled and allowed by your choices;
• communications providers used to receive and answer email; and
• authorities, advisers or a successor operator where reasonably necessary for law, safety, dispute handling or a genuine business transfer.

We do not sell personal information for money. Some privacy laws may describe disclosure for personalized advertising as a “sale”, “sharing” or targeted advertising. Where those laws apply, we provide the relevant choice when advertising is enabled.

8. How long information is kept

• Browser data remains until you clear it or the browser removes it.
• Short room-resume data is ignored after about four minutes.
• Live multiplayer and voice data is transmitted for the session; we do not intentionally record voice. Limited operational and security logs may be retained as reasonably needed.
• Account progress, if account storage is enabled, is kept while the account is active and as reasonably needed to provide, secure or delete it.
• Google Analytics and advertising information is retained according to our configuration, your choices and the applicable provider’s policy.
• Support correspondence is kept as long as reasonably needed to resolve and document it.

9. Security and international processing

We use reasonable technical and organizational safeguards, including encrypted HTTPS and secure WebSocket connections in normal production use. No internet service can promise absolute security. Do not put secrets or sensitive personal information in your display name.

Pen Fight is operated from Sri Lanka and uses providers and players in other countries. Information may therefore be processed outside your country, where privacy laws may differ. Providers may use contractual and other safeguards required for international transfers.

10. Your controls and privacy rights

You can:

• play without Google Sign-In where anonymous play is available;
• turn the microphone off or revoke microphone permission in your browser;
• clear Pen Fight site data in your browser, which also deletes local progress;
• manage cookies and Google advertising choices as described in section 6; and
• ask us to access, correct or delete information associated with you, or exercise any objection, restriction, portability or consent right available under your local law.

Email hello@letscrak.com with the subject “Privacy request”. We may need enough information to verify the request and find the relevant data. We will respond within the period required by applicable law.

11. Children

Pen Fight is intended for a general audience aged 13 and over and is not directed to children under 13. You must not use Pen Fight if you are under 13. We do not knowingly collect personal information from a child under 13. Ages and parental-consent rules differ by country; a parent or guardian should supervise a user aged 13 or over where local law requires it.

If you believe a child has provided personal information, email hello@letscrak.com so we can investigate and delete it where appropriate.

12. No sales or payment data

Pen Fight currently offers no real-money purchases, paid subscriptions or paid digital items. We therefore do not ask for or process card, bank or payment-account information. If that changes, we will update the service and this policy before accepting a payment.

13. Changes to this policy

We may update this policy when the game, its providers or legal requirements change. The date and version at the top identify the current text. A material change will be explained prominently in the game or on this page where reasonably possible.

14. Contact

Email hello@letscrak.com, or see the Contact Us page.

© 2026 LetsCrak · Pen Fight All rights reserved