Legal & privacy

Last updated: 5 November 2026. Translated from the Italian text, which prevails if the two differ.

Dunno (dunno.world) is the public lab of Polyphorm di A.M.: it shows its projects, some free, some paid for on their own sites. Here you find who we are, the rules for using Dunno, what we do with your data and which cookies we use.

1. Contact

For any question write to support@dunno.world. The full business details are in section 5.

2. Terms of use

These are the rules for using dunno.world. They apply to everyone and there is nothing to sign or tick: we only ask you to keep to them.

2.1 Who offers Dunno and what you find

• Dunno is offered by Polyphorm di A.M. (details in section 5) and is free: nothing is sold on dunno.world and no payment is asked. Free projects, like Squishcat, are used right here, with no need for an account.
• Dunno lives on Google's advertising, always labelled as such. The ads are other companies': what you buy from an ad you buy from them, on their terms. Where it shows and what data Google gets: point 3.2, Advertising.
• Paid projects have their own site, with their own terms and privacy notice: Kingillion is at kingillion.com. What you buy there follows Kingillion's terms.
• The figures on the bill are what people paid, before fees and tax, read from the projects' own systems. They are not a tax statement and promise no earnings to anyone.
• Names and portraits of Kingillion's kings are already public on kingillion.com and we show them as Kingillion does: removed ones stay removed. To report one, use the Report button on Kingillion or write to us.
• "Like" and "Not for me" are free gestures: they give no prizes, points or perks.
• A profile is optional and free: it only lets you save projects to your library and build your own Home. Everything else works without one.

2.2 How to use it

Use Dunno as a person playing, with respect for others. These are not allowed:

• bots, scripts or other automated programs that play, vote, report, publish or download the site in bulk;
• getting round the site's limits (how much can be published, voted, reported or drawn in a short time), its checks or its moderation;
• harassing, insulting or threatening other people, in the online games of Scacchi a Scarabocchi and Six Legs too;
• profile names that are offensive, vulgar or hateful, that pass themselves off as someone else or that contain personal data or advertising;
• using Dunno for anything illegal, or trying to damage it, overload it or get into parts of it that are not open to you.

2.3 What you publish

• On Dunno you can publish toasts (Toast Me), stickers (Peel Me), strokes in Everyone's Notebook, your profile's name on the leaderboards and what you share from a game. You are responsible for it: by publishing you guarantee that it is yours or that you have the right to publish it, that whoever appears in it agrees and that it keeps to these rules and the law.
• What you publish stays yours: you only give us permission, for free, to show it on Dunno, as written below for each game.
• We may take down what breaks these terms or the law. Whenever we can we tell you why and, if you disagree, we review the decision (point 2.4).

Toast Me: the toasts you publish

• You publish only the toast, the finished picture of the slice. The photo it is made from stays on your device and, unless you press "Publish", nothing reaches us.
• You can publish if you are at least 14. The photo must be yours, and everyone in it must agree. No children, nothing sexual, violent or hateful, no advertising, no personal data (phone numbers, addresses, profiles) and no pictures by others protected by copyright.
• Before it joins the wall, every toast is checked, automatically (with Anthropic's Claude) or by us. If it doesn't pass, it isn't published and we tell you why. Until it is checked, a toast can only be seen by whoever has its link.
• Every toast has a "Report" button: three reports take it off the wall until we look at it. For a full notice (EU Regulation 2022/2065, art. 16) write to support@dunno.world with the toast's link, why it is illegal, your name and your email. We answer without delay.
• We may take down a toast that breaks these rules or the law: its page shows the reason. If you disagree, write to us and we will review the decision.
• You can delete a toast of yours for good from its page, with the same browser you published it from: that browser keeps the code that allows it. From another device, write to us with the link.
• The toast stays yours. By publishing it you let us show it, for free, on Dunno and in the previews of shared links, until you delete it.

Peel Me: the stickers you put on everyone's wall

• A sticker goes on everyone's wall only if you tick "Also on everyone's wall". Otherwise it stays on your device and nothing reaches us.
• You can put one there if you are at least 14. If it is a photo, it must be yours and whoever is in it must agree. No children, nothing sexual, violent or hateful, no people's names, advertising, contacts, brands or other people's copyrighted pictures.
• Stickers made only of Dunno's pieces (its face, the shapes, the emoji and the ready-made words) go on the wall at once. A word you type or a photo is checked first, automatically (with Anthropic's Claude) or by us: if it can't go, we don't publish it and tell you why; the sticker stays on your own wall anyway.
• With "Report a sticker" you tap the sticker and choose a reason: three reports take it off the wall until we look at it. For a full notice (EU Regulation 2022/2065, art. 16) write to support@dunno.world saying which sticker, why it is illegal, your name and your email. We answer without delay.
• We may take down a sticker that breaks these rules or the law: in "Stick your own", under "Yours on everyone's wall", you see why. If you disagree, write to us and we look at the decision again.
• You can delete it for good from the same list, with the browser you used to put it there: it keeps the code that allows it. From another device, write to us.
• The sticker stays yours. By putting it on the wall you let us show it, for free, on Dunno until you delete it.

Everyone's Notebook: what you write in everyone's notebook

• Everyone's Notebook is a single notebook, public and permanent: every stroke you put down (ballpoint, pencil, marker, highlighter or whiteout) is seen by anyone, at once and for ever, over or under other people's strokes too. It can't be erased or undone: whiteout is a stroke too, covering in the paper's colour, and it stays.
• You can write in it if you are at least 14. Before your first stroke the notebook shows you its rules, which begin with "You're at least 14", and asks you to accept them: until you press "I agree" you can look at the notebook and leaf through it, but not write in it. The rules, here in full: what you put down stays for ever and everyone sees it, children too; no names, phone numbers, addresses, social handles, links or other personal data, yours or anyone else's; no sexual, violent or hateful drawings or words, no insults; no other people's works, logos or brands, and no advertising; reported areas are hidden and checked. Only strokes go in the notebook: no typed text and no pictures.
• With "Report", in the notebook, you point out the area of the page (you drag a box around what is wrong, tap the spot, or choose everything you can see), choose a reason (personal data, sexual, violent, hate or insults, something else illegal) and, if you like, write your email, to get an answer, and a note. Each person counts once for the same area. When three different people report boxes of the same page that overlap, the part the three boxes have in common hides by itself: the strokes crossing it disappear for everyone until we check them, within 24-48 hours, and then put them back or take them off. If the report doesn't go through, the notebook prepares an email for you with the page, the area and the reason. You can also write directly to support@dunno.world: for a full notice (EU Regulation 2022/2065, art. 16) say which page, where the stroke is, why it is illegal, your name and your email. We answer without delay.
• Only we can take strokes off, one by one or an area of a page, when they are illegal or break these rules. For every removal, every area hidden by reports and every stroke put back or deleted for good we keep a log: the date, the page and the area, how many strokes, the reason and whether we or the reports did it; nothing about who drew or reported. Whoever writes in the notebook is anonymous, so we can't tell them; whoever reported it and left their email hears what we decided. If you wrote some data of yours by mistake, report it or write to us and we take it off.
• To prevent abuse there is a limit to how much can be drawn in a short time, a full page takes no more strokes and a new page opens only once the last one has some writing on it.
• What you draw stays yours, but it mixes with everyone else's. By putting it in the notebook you let us show it, for free and for ever, on Dunno together with the rest of the page, pictures of the notebook included.

2.4 How we moderate

• We take down, or don't publish, what is illegal or against these terms: anything sexual, violent or hateful, children, personal data, advertising, other people's copyrighted works, offensive names. We don't look in advance at everything that is published, but we act when we see it or it is reported to us.
• Toasts, the words you type, the photos of Peel Me and the names you choose for challenges go, before they are published, through an automatic check (Anthropic's Claude) or through us. If the check stops something we tell you why, and you can ask for a person to look at it.
• The rest (the Notebook's strokes, profile names, shares) doesn't go through the automatic check: we look at it when it is reported to us. Three reports hide a toast, a sticker, a name on a leaderboard or an area of the Notebook by themselves until we check them (areas of the Notebook within 24-48 hours); a player's name in a challenge is replaced by a neutral one until we check it.
• Every report, made with "Report" or by email, is looked at by a person, who decides whether to take the content down or put it back. For toasts, stickers, names and strokes taken down we keep the date and the reason.
• When we take down something of yours we tell you why, where you see it: on the toast's page, in the list of your stickers, next to the leaderboard. If you disagree, or if the automatic check stopped something by mistake, write to support@dunno.world with the link or the page: a person looks at the decision again and answers you.

2.5 Abuse

If someone repeatedly publishes things that are clearly illegal or forbidden by these terms, or keeps using offensive names, we may suspend their profile for a reasonable period and, in the most serious cases, delete it. In the same way we may stop for a while handling the reports of whoever keeps sending manifestly unfounded ones. We decide case by case, looking at how often it happened, how serious it is and with what intent. If you think it is a mistake, write to us and we review the decision.

2.6 Dunno as it is

Dunno is free and we offer it as it is. We do our best for it to work, but we don't guarantee that it is always available or free of errors, nor that a game or a save lasts for ever: we may change, suspend or close games and features. Within the limits allowed by law we are not liable for damage arising from using Dunno or from not being able to use it, nor for what others publish, which we take down as soon as we know it is illegal. This never applies to damage caused by wilful misconduct or gross negligence (art. 1229 of the Italian Civil Code), nor to personal injury, and it takes nothing away from your rights as a consumer under the Italian Consumer Code (Legislative Decree 206/2005).

2.7 Who the games belong to

Games, graphics, drawings, animations, sounds, texts, code and names of Dunno and its projects (Dunno, Squishcat, Toast Me, Peel Me and the others) are © Polyphorm di A.M., except for the works of others listed in section 6 and what you all publish. You can play and share the links and the pictures Dunno makes for sharing; without our written permission you may not copy, republish, modify or sell the games or other parts of the site.

2.8 If the terms change

We may update these terms, for example when a new game arrives or the law changes. The date of the last update is at the top of the page and changes apply from that day on. If you disagree you can stop using Dunno and delete your profile, your toasts and your stickers, as explained above.

2.9 Law and courts

These terms are governed by Italian law. If you are a consumer you keep the protection that the law of the country where you live gives you and that can't be excluded, and any dispute stays with the court of the place where you reside or are domiciled (art. 66-bis of the Italian Consumer Code).

2.10 Contact point for the Digital Services Act

Our single point of contact under Articles 11 and 12 of Regulation (EU) 2022/2065 (Digital Services Act), both for the authorities of the Member States, the European Commission and the European Board for Digital Services, and for the people who use Dunno, is support@dunno.world. You can write to us in Italian or English.

3. Privacy notice

This notice explains how we process your personal data under Regulation (EU) 2016/679 (GDPR) and Italian law.

3.1 Controller

Polyphorm di A.M., sede legale: Via Generale Armando Diaz 6, 73054 Presicce-Acquarica (LE), P.IVA 05496490755, REA LE-371288, email support@dunno.world, PEC micoccio@pec.it

For any question about your data write to support@dunno.world.

3.2 What data we process and why

• Browsing: as for any website, our host receives your IP address, browser type and the pages you request, to show you the site and protect it from abuse (our legitimate interest).
• Language: when you open Dunno without a language in the address, we choose one for you from the languages your browser is set to and from your country, which our host works out from your IP address at that moment. We use it only to choose the language of the page, and we keep neither the address nor the country. You can change the language at any time with the globe button (legitimate interest: showing the site in a language you understand).
• "Like" and "Not for me": when you press one, your browser gets a technical cookie with a random code, so we count one vote per browser and you can take it back. The database keeps only a hash of that code, the project, the kind of vote and the time. "Not for me" is never public: it hides the project from your pages and to us it is just a number. To block abuse we keep, for 24 hours at most, a hash of your IP address that changes every day. We cannot tell your name from this data. Legal basis: the service you ask for by pressing the button, and our legitimate interest in counting honestly.
• Shares: when you share a project we add 1 to that project's count for the day, for the Trend page. We don't know who shared or with whom. To block abuse we use the same hash of your IP address, for 24 hours at most. Legal basis: our legitimate interest in showing what people really like.
• "Share" inside a game: we save on Dunno's database what you made, as it is at that moment (the game's state: for example the sheet's writing and damage, the chess position, a drawing, a score) and a picture of it (for example Peel Me's wall with your stickers on it, photos included), under a short random link. The "Share" at the top of a game's page does the same when there is something in the game to show. Anyone with the link sees what you shared, and the picture also in the link's preview, until we remove it from Dunno's desk: anyone can ask us to remove it by writing to support@dunno.world with the link. Don't put personal data in it, yours or anyone else's. We store nothing about you: no name, no account, no address. Your IP address is only used as a hash that changes every day, to limit how many shares one person makes in an hour, and we delete it like the others within 24 hours at most. On other projects, "Share" only sends the page's link: beyond the count above it stores nothing. Legal basis: the service you ask for by pressing "Share".
• Game counters: when you squish the cat or the flies, we add that number to the game's public counter. We don't know who did it. To block abuse we use the same hash of your IP address, for 24 hours at most. Legal basis: our legitimate interest in showing how much people really play.
• Visit counts: when you open a project, play it or go to its site, share it or arrive from a shared link (which carries the mark «?da=link»), and when you send a challenge, open an invitation, tap "Play now", answer or ask for a rematch, we add 1 to that day's count for that project. They are numbers only: we don't know who you are. To count a person once every half hour and to block abuse we use the same hash of your IP address, for 24 hours at most. No cookies and no outside services. Legal basis: our legitimate interest in knowing whether the site works.
• Who plays and who comes back (Trend and the games' measures): when you start a round (or first touch a toy such as the cat), when you play and when you share a project, your browser sends a random code it makes the first time and keeps in its storage (dunno:player, point 4); if you are signed in to your profile we use the profile's internal code instead. The code never reaches the database: there we keep only an encrypted fingerprint (hash) made with a secret key of the server, with the project, the day, how many rounds you started that day, for how many seconds you really played and how many touches you made in the game (the browser counts the time only while the page is in view and you touched the game in the last 15 seconds, and sends it in a few batches, when you close or hide the game; never what you touch, only how many touches), and whether you shared it; and, the first time you play a project, where you came from (another player's link, a shared link, a search, a social network, another site or none), which we tell from the «?da=» mark in the address and from the page you came from. No IP address, no name, no device data, no other service. We use it to rank Trend by the time each person really plays, who comes back and what they do in the game (never by the pages opened), and to see whether a game brings people back (how many play again the next day and a week later) and how much it is passed on: we only see numbers per game, never a player. If you play as a guest and then sign in to your profile, the browser's counted days pass to the profile, so you don't count twice. Against abuse we count the new players coming from one address in an hour, with the daily hash of the IP address, kept for 12 hours at most. On iPhone and iPad, Safari may clear the code by itself after 7 days without visits (ITP): from then on you come back as a new player, and that is fine. Legal basis: our legitimate interest in knowing which games people really like, with data that don't say who you are.
• Usage statistics (PostHog), only if you accept them. Today statistics are off: we don't load PostHog and we don't ask you about them. If we turn them on, they will start only after your "Accept" in the banner, and we will update this page. They would work like this: if you press "Accept" in the cookie banner, your browser loads PostHog, which collects for us the pages you open (address, title, the page you came from and how far you scroll), clicks on links and buttons (with their text, never what you type into fields, nor Everyone's Notebook or Burn Me's sheet), the games you open and for how many seconds they stay on screen (the game_open and game_time events), the start and end of a round with its score and the challenges made, opened and answered (never your name, your opponent's or the players' codes), where you came from (the referring site, a campaign's utm_* parameters and the «?da=link» mark of a shared link), your type of device, operating system, browser, language, time zone and screen size. PostHog receives your IP address with every request and works out your approximate location from it (country, region, city). All of this is tied to a random code kept in your browser (point 4), not to your name or your profile. Session recordings are off: nobody replays what you do on the page; heatmaps and surveys are off too. It helps us see which projects people like and what to improve. Legal basis: your consent (Art. 6(1)(a) GDPR and, for cookies, Art. 122 of the Italian Privacy Code), which you can withdraw at any time from "Cookie preferences" at the end of every page, with no effect on the rest of the site; withdrawing does not affect what was collected before. If you reject or don't choose, PostHog is not even loaded: no cookies and no data sent.
• Advertising (Google AdSense): off today: no ads and none of Google's code on the pages. Once we turn it on, it will work like this. Dunno is free and lives on Google's ads, always labelled as advertising: a box on the Home, one under Dunno's games and beside Create games made by adults, and now and then a break between one level and the next (never at the first level, at most one every 3 minutes). Never on the pages of games made by minors, where there are only suggestions of other games, and never to anyone we know to be a minor (a creator profile under 18): they get no ads and Google receives nothing.

  When a page may show you an ad, your browser connects to Google's servers, which receive your IP address, browser and device data (type, operating system, language), the page you are looking at and the ads you see and tap. Advertising cookies and identifiers only if you accept them. The ads you see are of three kinds:

  • based on your interests: only if you have confirmed in your profile that you are at least 18 (Profile, below) and you accept them in Google's cookie message;
  • not based on you, chosen from the page and the rough area derived from the IP address: for everyone else, even if they accept everything in the message. If you accept cookies, Google uses them only so as not to show you the same ad over and over, to count ads and to prevent fraud;
  • limited, if you reject or don't choose: Google uses no cookies or other data stored in your browser.

  The cookie message is Google's own, certified for the European IAB TCF standard: it shows the first time a page may show you an ad, rejecting is as easy as accepting, and there you find the up-to-date list of Google's advertising partners. You can change your choice at any time from "Cookie preferences", at the end of every page.

  For the data it receives, Google is an independent controller: Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland), under its own privacy policy. We choose where ads go and collect your consent: for the collection on our pages and the sending to Google we answer too. How Google uses these data: policies.google.com/technologies/partner-sites. You can also manage Google's ads at myadcenter.google.com.

  Legal basis: for cookies and for ads based on your interests, your consent (Art. 6(1)(a) GDPR and Art. 122 of the Italian Privacy Code), which you can withdraw at any time; for showing ads without cookies, our legitimate interest in keeping Dunno free (Art. 6(1)(f) GDPR), which you can object to in the options of Google's message.

• Leaderboards: if you are signed in to your profile, the scores of your rounds of the games with a weekly leaderboard reach us by themselves, and we show everyone your profile's name and your best score of the week (for games with levels, of each level). Without a profile nothing is sent: at the end of a round you can sign in to put it on the board. If you don't want to appear, play without signing in to your profile. We keep the name, score and date as long as you keep the profile and delete them with it. Anyone can report a name: after three reports we hide it until we check it and, if we take it off, we show you why next to the board. No prizes: it is only a leaderboard. Legal basis: the service you ask for by creating the profile and playing.
• Challenges from afar and guests ("Play with someone", "Beat me"): when you send a challenge or answer one, we keep your result (numbers only: the score or who won, and the round's seed, so the other player plays on the same table), the game, the dates and what the game sends with the challenge (in Hook Me your ghost, below). Whoever receives the link sees your name and your result, in the link's preview too: if the link is forwarded, whoever gets it sees them as well. No other data, no players' codes. Without a profile you play as a guest: with the first result you send (not before: looking at a challenge leaves no trace) you get a name picked at random, for example "Gentle Fly 42", which you can change; a name you type goes through the automatic check first (Anthropic, point 3.3), because whoever opens your challenges will see it. Your browser gets the dunno_guest cookie (point 4) and the database keeps only its hash. With a profile, challenges use the profile's name. Every answer becomes a row of the history of matches (the two players, the game, the results, the date): it feeds "For you" (the challenges waiting for you and the results of yours, with what you have already seen) and tells who you have already played with. If you create a passkey or sign in from that browser, the guest and its challenges join the profile. We ask for no email, phone or contacts and there is no chat: only invitations by link and results pass between players. Against abuse we limit new guests per address (with the daily hash of the IP address) and challenges per player, with data kept 12 hours at most. Whoever sees your name in a challenge can report it: after three reports we replace it with a neutral name until we check it (point 2.4); to count one report per person we keep the daily hash of their IP address, for less than 24 hours. Legal basis: the service you ask for by sending or accepting a challenge, and our obligation to handle reports.
• Ghosts (Hook Me): when you send a challenge from Hook Me, your "ghost" travels with your result: the sequence of what happened on your fishing outing (where the float landed, the bites, the fish caught, the lake's hour) with its timing, 32 KB at most. Whoever answers fishes beside your ghost, with your name; their outing comes back to you the same way, for the rematch. We keep a copy (at most 5 per game, for 8 weeks) that only people who have already played a challenge with you can see. Nothing about your device or your location. Legal basis: the service you ask for by sending or accepting the challenge.
• Daily challenge (Fizz Flick): when you share a round of the daily challenge we keep your best of that day: the score, the day and the round's code (the level and your shots, as the game writes them), tied to your player (the profile, or the challenges' guest above). The link you send carries your name and the day, and whoever opens it sees your name and your score, in the link's preview and its picture too; if the link is forwarded, whoever receives it sees them as well. A name changed or reported no longer answers the links already sent, but a picture already made stays as it was. Against abuse, at most 30 rounds an hour per player. Legal basis: the service you ask for by sharing the challenge.
• Ghosts and trophies of the daily challenge (Fizz Flick): at the end of every round of the daily challenge the browser sends the site the score, the round's code and how the score rose during the round, with its times. If you have a profile or are already a challenges' guest, we keep your latest round of that day as a "ghost": whoever plays the same day's challenge sees it race beside theirs, with your name, the score and how long ago ("Marco's round, 2 hours ago"); only rounds with at least one point, at most 5 per player. With a profile we also keep, for each day, whether you completed that day's challenge, how many times and your best (for "Seven in a Row" and the day's board), and the trophies you win (which, the day, when): you see them on your profile and can share them with a link and a picture that carry your name. If you arrive from a player's link and finish the round, we keep that this player got an answer: whoever answers is only a hash made with a secret key of the server (the same as "Who plays and who comes back"), never the name or the address; it is for the "Dare Accepted ×3" trophy. Against abuse, at most 60 rounds an hour per person and 20 new answers an hour from one address (with the address's daily hash, kept 12 hours at most). Trophies can't be bought: they are won only by playing. Legal basis: the service you ask for by playing the daily challenge (and, for the trophies, by creating the profile).
• Register of consents: when you answer the statistics banner (it shows only when they are on) we keep the choice (accept or reject), the version of this notice it refers to, the date and a hash, keyed with a secret of the server, of your browser type (user agent). No IP address, no cookie, no link to your profile or your challenges: it only shows which text was in force and that a choice was made. Against abuse we count the choices coming from one address in an hour, with the daily hash of the IP address, kept 12 hours at most. Legal basis: our obligation to be able to demonstrate consent (Art. 7(1) GDPR). Your choices about advertising are recorded by Google's message, in your browser (point 4).
• Profile (optional): if you create one, we keep the name you choose (it is yours alone: two profiles cannot have the same name, not even with different capitals, and it appears on the leaderboards), the public part of your passkey (a cryptographic key: the face or fingerprint that unlocks it never leaves your device and we never see it), the projects you save, how your Home is arranged, the date it was created and the date of your last visit. When you sign in, your browser gets a technical cookie with a random code; the database keeps only its hash. For the profile we ask for no e-mail, phone or password; if you become a creator you give us your e-mail (see Creators, below). If you wish, in the profile's settings you can confirm that you are at least 18: we keep only a yes or a no, which you can take back whenever you like. It is used only for advertising: with it, ads may be based on your interests, if you accept them in Google's cookie message; without it, they are never based on you (Advertising, above). If your creator profile says you are a minor the confirmation does not count, we remove it and show you no advertising. Legal basis: the service you ask for by creating the profile.
• Creators (proposing a game): if you propose a game on Dunno, we process: e-mail, creator name, date of birth (to check your age and to know when you come of age), the name and identification number of your GitHub account, technical data about the browser (type and version) and IP address (for security and to record consents), the date and time of the acceptances and, if you are under 18, the name and e-mail of your parent or guardian. The game runs on your GitHub Pages site and is linked to your public GitHub repository: you manage them, and GitHub's rules and privacy notice apply to them too.

  You accept the Creator terms with a box at the way into Crea, or when you send the game. If you tick it at the way in, your browser gets a technical cookie, dunno_crea_terms (point 4), signed by our server: it holds the version and the language of the terms, the fingerprint of the text and of the box's words, the time of the click and a random code, no data about you, and we write nothing to the database. When you sign in with GitHub we record the acceptance, linking it to your profile and your GitHub account, with the time of the click, the time of the sign-in, the IP address and the browser data; the cookie works once only and is deleted at once. When you open your creator profile the acceptance goes into the record of acceptances and we send you a copy of the accepted terms by e-mail. For every game you send we also record your declaration on the game's rights: the game and the version sent, the words of the declaration, date and time, IP address and browser data.

  Why we use them and on what legal basis:

  • Creator profile and publishing games (e-mail, creator name, date of birth, GitHub account and, if you are under 18, the e-mail of your parent or guardian, to ask them for the consent or send them the notice provided for in the Creator terms): performance of the contract, that is the Creator terms you accept (art. 6(1)(b) GDPR).
  • Proof of acceptances and consents (date and time, version and text accepted, IP address and browser data; for a parent's consent also their name and e-mail): our legitimate interest in being able to demonstrate that the Terms and the consents were given and in defending ourselves if they are disputed (art. 6(1)(f) GDPR).
  • Security (IP address and browser data, to prevent abuse and unauthorised access): our legitimate interest (art. 6(1)(f) GDPR).
  • Reports and decisions on games: legal obligation (Regulation (EU) 2022/2065, "DSA", arts. 16 and 17; art. 6(1)(c) GDPR).

  Giving us this data is necessary to become a creator: without it, we cannot open the profile or publish the game.

  How long:

  • Creator profile data (e-mail, creator name, date of birth, GitHub account, e-mail of the parent or guardian): as long as the profile is active. When the profile is closed (you delete it from the Profile page, you ask us to, or you don't use it for 24 months) we delete them within 30 days.
  • Record of acceptances of the Creator terms (date and time, version and text accepted, creator name, e-mail, date of birth, IP address and browser data): 10 years from the acceptance, even if the profile is closed in the meantime.
  • Declarations on the rights of the games sent: like the record of acceptances, 10 years from sending, even if the game or the profile is removed in the meantime.
  • Acceptances recorded when you sign in with GitHub, if you then don't open a creator profile: we delete them after 30 days.
  • Consents of the parents of minor creators and their record (name and e-mail of the parent or guardian, date and time, IP address, browser data, version and text of the form): until 5 years after the creator turns 18, that is until their 23rd birthday, even if the consent is revoked or the profile closed.
  • Consent requests that expired unanswered or were refused: we delete them, with the parent's e-mail, 30 days after they were sent.
  • IP address used for security (limits against abuse, with its encrypted hash): at most 24 hours. The IP address and browser data recorded with an acceptance or a consent stay with that record, for the periods above.
  • Reports, with the name and e-mail of whoever made them: 6 months after they are closed. Decisions on games stay, without a link to the profile once it is closed.

  Who receives the data: the technical providers that help us run Dunno, which act on our behalf as processors. Some are based outside the European Union: in that case the transfer takes place with the safeguards provided for by the GDPR, given here for each one:

  • Vercel Inc. (United States), hosting of the site: standard contractual clauses (Commission decision 2021/914).
  • Supabase Pte. Ltd. (Singapore), database and file storage; Dunno's data is in the European Union, in Frankfurt (region eu-central-1): standard contractual clauses (Commission decision 2021/914).
  • Resend (Plus Five Five, Inc., United States), sending e-mails: adequacy decision (EU-U.S. Data Privacy Framework, Commission decision of 10 July 2023) and standard contractual clauses (Commission decision 2021/914).
  • Cloudflare, Inc. (United States), forwarding the e-mails sent to support@dunno.world: adequacy decision (EU-U.S. Data Privacy Framework, Commission decision of 10 July 2023) and, where needed, standard contractual clauses (Commission decision 2021/914).

  GitHub (GitHub, Inc., United States, and GitHub B.V.) is not one of our providers: you manage your account, the repository and the GitHub Pages site under GitHub's rules, and GitHub is an independent controller of that data (see its privacy statement). Through our GitHub App we read from GitHub your account's name and identification number and the game's repository.

  Your rights: you can ask us to access your data, correct it, erase it, restrict its processing, receive it in a machine-readable format (portability) and object to processing based on our legitimate interest. The parent or guardian has the same rights over their own data. We keep the records of acceptances and consents until the dates above even if you ask for erasure, because they serve to demonstrate the consents and to defend ourselves if they are disputed (art. 17(3)(e) GDPR). You can also lodge a complaint with the Garante per la protezione dei dati personali, the Italian data protection authority (garanteprivacy.it). Controller: Polyphorm di A.M., sede legale: Via Generale Armando Diaz 6, 73054 Presicce-Acquarica (LE), P.IVA 05496490755, REA LE-371288, email support@dunno.world, PEC micoccio@pec.it; for creators' data write to support@dunno.world.

• Games' memory: Peel Me, Squishcat, Jelly Flies and Burn Me remember how you left them (the stickers you peeled and where you were on the wall, when you last saw the cat and how much you stroked it, the marks on the table, how many flies you squashed and your best round, the written sheet while it is whole). They keep it on your device; with a profile, in the profile too, so you find it on your other devices, each under a random name that only stops anything being counted twice. It goes when you delete the profile or clear the site's data in your browser. Legal basis: the service you ask for by playing.
• Add a device: the code that links another phone or computer is valid for 10 minutes, once; we keep only its hash, deleted within a day. The other device makes its own passkey for the same profile. Legal basis: the service you ask for.
• Kingillion portraits: the images come from kingillion.com, which we run. Your browser asks that site for them, and it sees your IP address like any site you visit.
• Toast Me: the photo a toast is made from never leaves your device. If you publish the toast, we store the toast's picture, the date, the outcome of the check and an encrypted fingerprint of the code that lets you delete it. If a person can be recognised in the toast, the picture is their personal data. When the automatic check is on, the picture goes to Anthropic, which examines it on our behalf. To block abuse we use the same IP address hash, for 24 hours at most; for reports we also keep the reason chosen. Legal basis: the service you ask for by pressing "Publish", and our duty to handle reports.
• Peel Me: the stickers you make, including those made from a photo of yours, stay on your device. The photo is cut out there, by the cutting model Dunno sends you from its own site. If you put a sticker on everyone's wall we store what it shows (the word, the emoji, the shape, or the photo's cut-out), finish, colour, date, the outcome of the check and an encrypted fingerprint of the code that lets you delete it. If a person can be recognised in the cut-out, it is their personal data. When the automatic check is on, the word or the cut-out goes to Anthropic, which examines it on our behalf. To block abuse we use the same IP address hash, for 24 hours at most; for reports we also keep the reason chosen. We count how many stickers are peeled in all, without knowing by whom. Legal basis: the service you ask for by ticking "Also on everyone's wall", and our duty to handle reports.
• Burn Me: what you write on the sheet, by pen, marker or typewriter, stays on your device while the sheet is whole, so you find it when you come back; with a profile, in the profile too, to find it on your other devices. As soon as the sheet is wrecked or you take a new one, we delete it. We don't read it or use it for anything else. We only count how many sheets are wrecked in all, without knowing by whom. Legal basis: the service you ask for by writing on the sheet.
• Scacchi a Scarabocchi: your games, against the computer or between two of you, are played and kept on your device (the computer thinks in your browser, and writes its comments there): we don't see them. Online, your browser connects to Supabase's realtime service and, through it, sends the other player the room's code, a random number for a nickname and your moves; the game in progress is also kept on your device, so that it goes on if the page is reloaded. We ask for no name or account and store nothing: the messages go from one browser to the other and are gone. Like any website, the service sees your IP address while you are connected. We only count how many games are played in all, without knowing by whom. Legal basis for online games: the service you ask for by choosing to play online.
• Six Legs: against the computer or two players on one device, everything stays on your device. Online, your browser connects to Supabase's realtime service and, through it, sends the other player your insect, a random nickname made of the insect's name and a number, and your moves; if you play with a friend, also the room's code. We ask for no name or account and store nothing: the messages go from one browser to the other and are gone. Like any website, the service sees your IP address while you are connected. We only count how many battles are fought in all, without knowing by whom. Legal basis: the service you ask for by choosing to play online.
• Tris a Mano: the marks you draw and your games, against the computer or between two of you, stay on your device and go when you leave the page: we don't see them and don't store them. We only count how many games are played in all, without knowing by whom.
• Everyone's Notebook: of each stroke we keep only the tool, colour, thickness, the drawing's points, the page and the time; nothing about who made it. For "My pages", when you put down your first stroke the notebook creates a random code for your device: the browser keeps it in its storage (dunno-taccuino-device) and sends it with each stroke and when you open "My pages". We never store the code itself: for each page that device wrote on we keep only an encrypted fingerprint of it (HMAC, with a secret key of the server), used solely to show that device its pages and to count how many different people wrote on a page. It is not linked to a name, a profile, the games' memory, the IP address or anything else personal; if you clear the site's data from the browser it is gone, and those pages can no longer be linked to you. For the anti-abuse limit we use an encrypted fingerprint of the IP address that changes every day, kept at most an hour after the last stroke. A link to a page (with "?page=") just opens that page. Strokes reach the others live through Supabase Realtime, from the same provider as the database. Strokes taken off by moderation stay visible only to us until we delete them for good. If you report an area with "Report", we store the page, the box, the reason, the date and, only if you write them, your email, which we use solely to answer you about the report, and your note; to count one report per person for the same area, and at most 30 in 12 hours, we use the same IP address hash, for 24 hours at most. Legal basis: the service you ask for by putting down a stroke, and our duty to handle reports.
• Fly Me: your best score stays on your device, and so does the phone's tilt if you choose to steer with it (it is read there and never sent); if you are signed in to your profile, the score goes on the leaderboard (above). We only count how many things are caught in the storm in all, without knowing by whom.
• Doodle KO: the fighters you draw and your fights, against the computer or between two of you, stay on your device: the drawing comes to life and fights in your browser, and we don't see it. We only count how many fights are fought in all, without knowing by whom.
• Hook Me: your field journal (the fish you caught, how many and the biggest of each, the junk you fished out), today's wish and the lake's hour and weather stay on your device; nothing about your fishing is sent, except an outing you send as a challenge, with its ghost, and the score on the leaderboard if you are signed in to your profile (above). We only count how many fish are caught in all, without knowing by whom.
• Margherita on the Moon, Logo_FINAL_v47, The Seat and Grandma's Turning Round: your progress, records and settings stay on your device; nothing of the game is sent, except the score on the leaderboard if you are signed in to your profile (above). We only count, without knowing who you are, that people play.
• PLIP: your best time on each level, the milestones you reached and whether you turned the sound off stay on your device; nothing of the game is sent, except each level's time on the leaderboard if you are signed in to your profile (above). We only count, without knowing who you are, that people play.
• Loopwood: the island you build and whether you turned the sound off stay on your device; nothing of the game is sent. If you share it, the island travels inside the link you send. We only count, without knowing who you are, that people play.
• Fizz Flick: your progress, records, settings and player name (made up by the game, or chosen by you) stay on your device; nothing of the game is sent, except the score on the leaderboard if you are signed in to your profile (above). If you challenge someone, the link you send carries that name, the level, the shots and the score. We only count, without knowing who you are, that people play.
• Bocce di Gelatina: whether you have seen the tutorial, whether you turned the sound off and the graphics quality stay on your device; nothing of the game is sent. We only count, without knowing who you are, that people play.
• Gomitoli: the levels you unlocked, your best times with their stars, whether you turned the sound off and whether you have seen how to play stay on your device; nothing of the game is sent, except each level's time on the leaderboard if you are signed in to your profile (above). We only count, without knowing who you are, that people play.

We do no profiling ourselves. Beside the games and at the end of a round we show suggestions of other verified games of Dunno's catalogue (our own games and those approved in Create): they are the same for everyone and are not based on who you are. Where it is allowed, advertising may take their place (Advertising); on the pages of games made by minors and to anyone we know to be a minor, never advertising, only those suggestions. To know whether the site works we count, anonymously, the moments described above (Visit counts) and who plays and who comes back, without knowing who you are (Who plays and who comes back); an analytics service (PostHog), off today, we would use only if you accept it. We do not sell your data: Google gets only the advertising data, as explained above. Fonts are served by our own site, not by Google.

3.3 Who helps us (processors)

• Vercel: hosts the site and its server functions.
• Supabase: database, on servers in the European Union (Frankfurt); its realtime service also carries the online games of Six Legs and Scacchi a Scarabocchi and the strokes of Everyone's Notebook.
• Anthropic: the automatic check of toasts, stickers and the names chosen for challenges before others see them, when it is on.
• PostHog Inc.: usage statistics, off today; if we turn them on, only if you accept them (point 3.2), with the data in its European cloud, in Frankfurt (Germany).

Google is not our processor: for advertising it is an independent controller (point 3.2, Advertising).

3.4 Transfers outside the European Union

Vercel and Anthropic are based in the United States. Transfers rely on the European Commission's adequacy decision on the Data Privacy Framework, for companies that take part in it, or on the standard contractual clauses approved by the Commission.

PostHog statistics, off today, will go to its European cloud once they are on: they will stay in the European Union, in Frankfurt (Germany). Only if we used one of its servers outside the European Union (the US cloud) would they go to the United States, with the same safeguards (Data Privacy Framework or standard contractual clauses), and we would say so here.

Google may take the advertising data to the United States: Google LLC takes part in the Data Privacy Framework and, where that is not enough, uses the standard contractual clauses. It explains this here: business.safety.google/adsdatatransfers.

3.5 How long

• "Like" and "Not for me": as long as the project exists, or until you take the vote back by pressing the button again. If you delete the cookie, the vote stays in the count but can no longer be linked to your browser.
• Shares and counters: only numbers, with nothing about you.
• Who plays and who comes back: each counted day 35 days; the first arrival at a game as long as you play it, and at most 35 days after your last round. If you clear the site's data from the browser (or use "Forget this device", if you play as a guest) the code is gone and the counted days no longer lead to you.
• Daily challenge: your best of each day 35 days, then it is deleted by itself; sooner if you delete the profile or the guest.
• Ghosts of the daily challenge, days played and answers to links: 35 days, then they are deleted by themselves. Trophies: as long as the profile. Sooner if you delete the profile or the guest.
• What you share from a game: until we remove it. Then the link stops working and we erase the state and the picture; only the link, the project and the date remain.
• Profile: until you delete it (Profile page, "Delete the profile": everything goes, at once). A profile unused for 24 months is deleted by itself. Each sign-in lasts 180 days at most, then you get back in with the passkey. Its challenges, matches, ghosts and what it has seen in "For you" go with the profile.
• Creators: the periods are under Creators in point 3.2.
• Guest: as long as you play; a guest that hasn't played for 90 days is deleted by itself, with its challenges, matches and ghosts. "Forget this device" (point 3.6) deletes it all, at once.
• Challenges: open for 7 days; each challenge, with its results and what the game sent, is deleted 14 days after it was sent. History of matches: 12 months. What you have already seen in "For you": 30 days.
• Ghosts: 8 weeks, at most 5 per player and game.
• Register of consents: 24 months for each choice.
• Toasts: until you delete one or we take it down. When we take one down, we erase the picture and keep only the reason. Reports stay as long as the toast exists.
• Everyone's Notebook: strokes stay for ever, like the notebook, unless we take them off as illegal. The device code's fingerprint stays next to the pages it wrote on for as long as the notebook exists; clearing the site's data removes the code, and the fingerprint no longer leads to you.
• Everyone's Notebook reports, with the email and the note if there are any: until we have looked at them, then we delete them, and never beyond 6 months. The removal log (date, page and area, how many strokes, reason) stays as long as the notebook exists: it holds nothing about who drew or reported.
• IP address hash: 24 hours at most.
• Usage statistics (PostHog), off today: once they are on, up to 12 months. PostHog's cookie will last 1 year at most and, if you withdraw your consent, we delete it from your browser at once.
• Advertising: Google's cookies in your browser 13 months at most (point 4). How long Google keeps the data it receives is up to Google, under its privacy policy.
• Technical logs: a few days.

3.6 Your rights

You can ask us at any time to see your data, correct it, delete it, restrict its use, receive it in a machine-readable format and object to processing based on legitimate interest. You can take back your vote yourself, at any time, and change or delete your profile yourself, from the Profile page. Write to support@dunno.world: we answer within 30 days. You can also complain to the Italian Data Protection Authority (garanteprivacy.it) or to the authority of the country where you live.

Some of it you can do yourself, below: download as a file (JSON) the data we keep about your profile and your challenges (name, challenges, matches, ghosts; with a profile also your library, Home and the games' memory) and, if you play as a guest, delete the guest at once with all its challenges, matches and ghosts ("Forget this device"). With a profile, "Delete the profile" deletes all of this too.

If you give us your consent (to advertising cookies, in Google's message, or to usage statistics, off today), you can withdraw it at any time, as easily as you gave it, from «Cookie preferences», at the end of every page. Withdrawing it does not affect the lawfulness of what we did before, with your consent (Art. 7(3) GDPR).

3.7 Minors

Using Dunno needs no personal data. The optional profile is for people aged 14 or over: in Italy, the age to consent alone to an online service. Publishing a toast or a sticker and writing in Everyone's Notebook also take being 14, and toasts must not show children. Purchases on other sites follow their own rules: Kingillion, for example, does not sell to anyone under 18.

We show no advertising to anyone we know to be a minor, nor on the pages of games made by minors. We don't know the age of someone without a profile, and under 14 a "yes" in Google's message doesn't count: so anyone who hasn't confirmed in their profile that they are at least 18 gets only ads that are not based on them, even if they accept them.

Challenges ask for no personal data: a guest has a name picked at random (one typed by the player goes through the automatic check) and no contact details. There is no chat and there are no public rooms with strangers: you only play with someone who sends you a link, and only invitations and results pass between players.

If your child is under 14 and has published something on Dunno (a toast, a sticker, strokes in Everyone's Notebook, a profile name…), write to us at support@dunno.world telling us where: we take it down.

4. Cookies and device storage

Technical tools, needed for what you ask, which require no consent:

• dunno_voter: a cookie set only when you press "Like" or "Not for me", with a random code. It lasts about 13 months.
• lang: a cookie set only if you pick a language with the globe button. It remembers your choice for 1 year.
• dunno_session: a cookie set only when you sign in to your profile, with a random code. It lasts 180 days at most; "Sign out" deletes it.
• dunno_challenge: a 5-minute cookie while you create a profile or sign in, to match the request with your passkey's answer.
• dunno_crea_terms: a cookie set only when you tick the Creator terms box at the way into Crea, signed by our server, with the version and the language of the terms, the fingerprint of the text, the time of the click and a random code. It is used to record your acceptance when you sign in with GitHub (point 3.2, Creators). It lasts at most 24 hours, works once only and is deleted when you sign in, if you untick the box or if you choose a year of birth under 14.
• dunno_guest: a cookie set only when you send or answer a challenge without a profile, with a random code: you play as a guest, with a name picked at random (which you can change) and no contact details. It lasts 90 days; a guest that hasn't played for 90 days is deleted with its challenges. If you create a passkey or sign in from this browser, the guest joins your profile and the cookie is deleted; "Forget this device" (point 3.6) deletes it with all the guest's data.
• Browser storage: remembers on this device your votes, how many times you squished the cat and the flies, your best round and chosen tool in Jelly Flies, the toasts you published with the codes to delete them, the browning you chose and whether you accepted the toast rules, your Peel Me stickers (with the cut-out photos) and where you stuck them, those you put on everyone's wall with the codes to delete them and whether you accepted their rules, whether you accepted the rules of Everyone's Notebook, the games of Scacchi a Scarabocchi in progress and how you set them up, the insect you picked and the computer's level in Six Legs, your best score in Fly Me and whether you fly with up and down inverted, the last fighter you drew in Doodle KO, the opponent and the computer's level you chose, your Hook Me journal with its records, today's wish and where the lake's day and weather had got to, the progress, records and settings of Margherita on the Moon, Logo_FINAL_v47, The Seat and Grandma's Turning Round, PLIP's best times and milestones, your Loopwood island, Fizz Flick's progress, records and settings, Bocce di Gelatina's settings, Gomitoli's progress, records and settings, whether you turned the sound off and whether you turned on night mode. It never leaves the device.
• dunno-home: browser storage, set only if you add a project to your Home without a profile. When you create the profile or sign in, the Home joins the profile and the entry is deleted.
• dunno:guest-name: browser storage with the name you will play your first challenge as, until you send the first result (then it goes to your guest and the entry is deleted).
• dunno-taccuino-device: browser storage, set only when you put down your first stroke in Everyone's Notebook, with a random code that, unlike the rest, goes with your strokes so you can find "My pages" again (point 3.2). It stays until you clear the site's data from the browser.
• dunno:player: browser storage, set at your first round (or first minute played, or share), with a random code: so we count who plays and who comes back only once (point 3.2, "Who plays and who comes back") without knowing who you are. The code stays here; it reaches the server only to be made into the encrypted fingerprint. It stays until you clear the site's data (or use "Forget this device", if you play as a guest); on iPhone and iPad Safari may clear it after 7 days without visits. Next to it, dunno:src in the tab's storage (sessionStorage) keeps only where the visit came from (for example "search") and goes when you close the tab. It is a first-party measure, only for Dunno's aggregate statistics, passed to no one else and never matched with other data: that is why, like the technical tools, it doesn't ask for consent.
• dunno:dare: the tab's storage (sessionStorage), set when you open the link of a daily challenge: the name of who dares you, the day and their score, so the dare stays if you reload the page and at the end of the round we tell you how it went. It goes when you close the tab. A technical tool, no consent needed.
• dunno:analytics-consent: browser storage, set when you answer the cookie banner. It only remembers your choice ("granted" if you accept, "denied" if you reject), the version of this notice and the date, so we don't ask on every page. If you reject, we don't ask again for 6 months; we ask again if the part of this notice about statistics changes. It stays until you change your choice or clear the site's data from the browser.

Analytics cookies, only with your consent: today statistics are off, so we don't ask you about them and PostHog stores nothing. If we turn them on, they will start only after your "Accept" in the banner, and we will update this page. From then on, if you press "Accept", PostHog (point 3.2) will store in your browser:

• ph_<project key>_posthog: a cookie of the dunno.world domain with your browser's random code and that of the current visit, to count visits and join up the pages of one visit. It lasts 1 year.
• ph_<project key>_posthog_cpm: a cookie that goes with the one above, holding only a fingerprint of its content to keep it consistent. It lasts 1 year.
• ph_<project key>_posthog and other entries starting with ph_ in browser storage (localStorage): the same data as the cookie, until you withdraw consent or clear the site's data.
• A few entries starting with ph_ in the tab's storage (sessionStorage), to recognise the tab and the visit: they go when you close the tab.

If you press "Reject" or don't choose, PostHog is not even loaded: no cookies, nothing in browser storage, no requests to its servers. You can change your mind at any time from «Cookie preferences», also at the end of every page: if you withdraw your consent we stop the statistics at once and delete PostHog's cookies and entries from your browser (those starting with ph_ or __ph).

Advertising cookies (Google), only where an ad may show to you (point 3.2, Advertising):

• FCCDCF and FCNEC: cookies of Google's cookie message, remembering your choice so it doesn't ask on every page. They are there even if you reject. They last 13 months at most.
• __gads, __gpi and __eoi: Google's cookies on the dunno.world domain, to show and count ads, not repeat the same one and prevent fraud. Only if you accept them. They last 13 months (__eoi 6 months).
• If you accept, Google and its partners may store other cookies on their own domains, for example doubleclick.net. The full list, with how long each lasts: business.safety.google/adscookies.

If you reject or don't choose, no advertising cookies: you only see limited ads. You can change your mind at any time from «Cookie preferences», at the end of every page. The suggestions of other games use no advertising or profiling cookies.

5. Business details

Polyphorm di A.M., sede legale: Via Generale Armando Diaz 6, 73054 Presicce-Acquarica (LE), P.IVA 05496490755, REA LE-371288, email support@dunno.world, PEC micoccio@pec.it

6. Credits and licences

Dunno is also made with free software and fonts, which remain their authors' and follow their own licences. Thanks to all of them.

• Next.js (Vercel, Inc.) and React (Meta Platforms, Inc. and affiliates), which the site runs on: MIT licence.
• three.js (the three.js authors), for the 3D games: MIT licence.
• SimpleWebAuthn (Matthew Miller), for the profile's passkeys: MIT licence.
• uqr (Project Nayuki, Anthony Fu), for the QR code of "Add a device": MIT licence.
• posthog-js (PostHog / Hiberly, Inc.), for usage statistics, off today: Apache 2.0 and MIT licences.
• Anthropic TypeScript SDK (Anthropic, PBC), only on our server, for the automatic check of content: MIT licence.
• MediaPipe Tasks Vision and the magic_touch model (The MediaPipe Authors), which cut out Peel Me's photos on your device: Apache 2.0 licence. We serve them unmodified, with the licence text next to them: /stickers/mp/LICENSE.
• Fonts: Nunito Sans (The Nunito Sans Project Authors) and DM Mono (The DM Mono Project Authors) for the site's text, Lilita One (Juan Montoreano) for Kingillion, Bagel Fat One (The Bagel Fat Project Authors) and Bricolage Grotesque (The Bricolage Grotesque Project Authors) for link previews and the games for portals, Overpass (The Overpass Project Authors) for Il Posto a Sedere: SIL Open Font License 1.1 (Overpass with its licence next to it: /fonts/metro/OFL.txt).

These programs use others in turn, each under its own licence. The licence texts: MIT, Apache 2.0, SIL Open Font License 1.1.