Privacy notice

We collect as little as we can to run the arcade. You can play without an account, we don't sell your data, and we don't show ads or use tracking cookies.

This notice explains how your personal data is handled when you use this website, as required by the EU General Data Protection Regulation (GDPR, Regulation 2016/679) and the Italian Privacy Code (D.Lgs. 196/2003).

Who is responsible

We are the data controller. Write to the address above for anything about your data.

What we collect and why

When you just play

• Gameplay events: which level of which game you started, cleared, failed or quit, how long it took and the stars earned. Without an account these aren't linked to you or your device. We use them to balance difficulty and fix games.
• Page counts: how often each game is opened, and which spots on the home page lead to which games. These are counted as totals per day, not per person.
• Your IP address: briefly held in the server's memory to stop abuse (for example, too many scores sent at once). It isn't written to our database.
• Leaderboard entries: if you submit a score, we store the score, the name you type and the date, and show them publicly on that game's leaderboard.

Legal basis: our legitimate interest in running, securing and improving the arcade (GDPR art. 6(1)(f)).

When you create an account

• Account details: your email address and a securely hashed password. If you sign in with Google, we receive your Google account ID, email and profile picture instead of a password. We don't show your Google name publicly: new accounts get a random handle you can change.
• Sign-in sessions: a random session key, stored as a hash, so you stay signed in.
• Your activity: your gameplay events (as above, now linked to your account), your progress and saved games (the levels you've reached, your best on each, and any game's saved state, including what you played on this device before signing in), the star ratings you give games, and scores you post while signed in.
• Your purchases: the games you have unlocked, your token history and your subscription status and renewal dates. Card and payment details are handled by our payment provider and never reach our servers.

Legal basis: performing our contract with you, that is, giving you the account and what you've bought (art. 6(1)(b)); for payment records, our legal obligations under tax and accounting law (art. 6(1)(c)).

When you comment, write to us or join the creators list

• Your handle: shown publicly next to your scores and comments. Your Google profile picture, if you have one, is shown only to you, never to other players.
• Comments: what you write under a game, with your handle and the date, shown publicly until you or we remove it.
• Messages to us: feedback, support questions and withdrawal requests you send through the site, and our replies. Only our team reads them.
• Reports: if you email us to report a comment, your email and what you tell us, to look into it and answer you.
• The creators waitlist: if you join it, what you tell us about the games you make and the link you give.

Legal basis: performing our contract with you (art. 6(1)(b)), and our legitimate interest in keeping the community safe and answering reports (art. 6(1)(f)).

Moderation

If you break the fair-play rules, our team may remove your content or suspend or restrict your account. We record what was done, by whom, when and why, so we can explain it, review it if you disagree, and meet our duties under the EU Digital Services Act. These decisions are made by people, not automatically. We email you the reasons, except for spam and bot accounts.

Legal basis: our legitimate interest in a safe arcade and our legal obligations (art. 6(1)(f) and (c)).

Emails we send

Only what your account needs: confirming your email, password resets, payment receipts (sent by Stripe), and confirmations when you cancel your pass, withdraw, or when we act on your account. No newsletters or marketing.

We don't use your data for automated decisions that significantly affect you, and we don't build advertising profiles.

Who else sees it

• Our hosting provider, which runs the servers and database on our behalf under a data processing agreement.
• Google, if you choose "Continue with Google": Google handles that sign-in under its own privacy policy.
• Stripe, our payment provider, when you buy the pass: it handles your card and billing details under its own privacy policy. We only see what you bought, when, and your billing country.
• Resend, which delivers the emails we send you, such as password reset links and confirmations.
• Sentry, which receives technical reports when something breaks on our server (the page and the error, never your password or payment details).
• Everyone: your handle, leaderboard scores and comments are public.
• Authorities, only when the law requires it.

Some of these providers may process data outside the European Economic Area, notably in the United States. When they do, the transfer relies on an EU adequacy decision (such as the EU-US Data Privacy Framework) or the European Commission's standard contractual clauses.

How long we keep it

• Account details, ratings, linked gameplay events, comments and messages to us: until you delete your account. Comments you delete or we remove are hidden at once and kept, out of sight, until then as a record.
• Moderation records (what was done, why and by whom): up to 2 years, so a decision can be explained and reviewed.
• Creators waitlist entries: until you leave the list or delete your account.
• Sign-in sessions: 30 days after you last use them, or until you log out.
• Records of payments: 10 years, as Italian accounting law requires (art. 2220 of the Civil Code), even after the account is deleted.
• Leaderboard entries: as long as the leaderboard exists. Deleting your account unlinks your scores and replaces your name on the board with "Anonymous"; the score itself stays unless you ask us to remove it.
• Guest gameplay events and daily totals: these don't identify anyone, and we keep them for statistics.
• IP addresses for abuse protection: a few minutes, in memory only.

On your device

We only use cookies and browser storage that the site needs to work: keeping you signed in, securing Google sign-in, remembering things like your recent games and sound settings, and keeping your game progress and the games you've played on the device so they work offline. The cookie policy lists every one.

Your rights

You can ask us to:

• show you the personal data we hold about you and give you a copy (access and portability);
• correct it (rectification);
• delete your account and data (erasure), within the limits of what the law makes us keep;
• limit how we use it (restriction);
• stop using it where we rely on legitimate interest (objection).

You can delete your account yourself from your account page. For a copy of your data or anything else, write to [email protected] from the email address on your account. We answer within one month. It's free.

If you think we've handled your data wrongly, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali, or to the authority where you live in the EU.

Children

You need to be at least 14 to create an account, which is the age of digital consent in Italy. If you live in a country where it's higher, you need a parent's or guardian's consent. If you believe a child under that age has given us personal data, write to us and we'll delete it.

Security

The site is served only over HTTPS. Passwords are stored as salted hashes, sign-in sessions as hashes of random keys, and access to the database is restricted to the people who run the arcade.

Changes

If we change how we handle your data, we'll update this page and the date at the top. For significant changes we'll tell signed-in players on the site or by email before they take effect.