Privacy Policy

1. Who this policy covers

This Privacy Policy applies to the Chalk Arcade mobile application for iOS and Android and to this website. “Chalk Arcade,” “we,” “us,” and “our” mean the Chalk Arcade developer identified on the app's Apple App Store and Google Play listings.

Chalk Arcade can be used as a local guest without creating an online account. Some features—including cloud progress, account recovery, friends, and supported online rooms—need an account and an internet connection.

2. Data we collect

The data involved depends on how you use Chalk Arcade.

• Account and profile data. If you create an account, we process your email address, an internal user ID, authentication status, a generated account handle and public player alias, and an optional country code. Chalk Arcade does not ask for or collect your legal name or an editable display name. Authentication credentials are handled by our authentication provider; we do not receive your plain-text password.
• Gameplay and collection data. We may store favourites, game and level progress, completed levels, best times, scores, settings, collection choices, activity history, and the release of a game you used so progress can be restored and kept compatible.
• Social and online-play data. Friends, friend requests, room membership, matchmaking requests, room and match status, a generated player alias, and bounded game checkpoints or results may be processed to provide supported online play. Other players see a stable generated alias and an app-rendered monogram—not a user-editable name or uploaded profile image. Chalk Arcade does not currently offer public chat, and public leaderboards are disabled for the initial release.
• Installation and product-configuration data. The app creates a random, persistent installation identifier and sends a one-way derived form to our product service so it can return a stable, compatible game catalogue and staged feature configuration. If you use an online guest account, the installation identifier is also included in that account's authentication metadata. It is used for app functionality, not advertising or cross-app tracking.
• Purchase and entitlement data. If paid products are offered in a future release, we may receive product identifiers, transaction or receipt status, storefront, and entitlement status. Apple or Google processes the payment. We do not receive your full payment-card details.
• Mobile analytics. Help improve Chalk Arcade starts on. While it is on, Google Analytics for Firebase may process an app-instance or device identifier, app version and platform, general device and operating-system information, coarse geography derived from technical network information, lifecycle and product-interaction events, and bounded events such as screens viewed, a game launched or completed, duration ranges, and fixed error categories. Our app-authored events do not include your email, user ID, room code, authentication token, or free-form text. You can turn this control off in Settings.
• Mobile crash diagnostics. Share crash diagnostics starts on. While it is on, Firebase Crashlytics may receive crash logs, stack traces, app state, app version, device and operating-system details, installation identifiers, and bounded context such as the current screen or game and a fixed error code. We do not deliberately attach your email or account ID to these reports. You can turn this control off independently in Settings.
• Network and security data. When you use an online feature or visit this site, infrastructure providers may process IP address, date and time, requested resource, response status, device/browser type, and security or abuse signals in ordinary service logs.
• Data kept on your device. A local guest's progress, preferences, audio and display choices, and other app state remain on the device. Signed-in session credentials are stored using protected device storage where available.

If you allow camera access, Chalk Arcade uses it to scan a friend-room QR code. Chalk Arcade does not retain the camera image or upload it to our service. You can also enter a room code without camera access.

3. Where data comes from

We receive data:

• directly from you when you create an account, choose an optional country code, contact support, or make a privacy request;
• from your use of the app, including progress and online-play actions;
• from your device when the app creates its installation identifier for product configuration, and while the corresponding analytics or diagnostics control is on; and
• from Apple or Google when needed to validate a storefront purchase or entitlement.

4. How and why we use data

We use the data described above to:

• create, authenticate, secure, recover, and delete accounts;
• return a stable, compatible game catalogue and staged feature configuration;
• save progress, collections, preferences, and account history;
• provide friends, private rooms, matchmaking, and other requested online features; public leaderboards are disabled for the initial release;
• verify purchases and provide entitlements if paid products are offered;
• answer support, privacy, and deletion requests;
• protect players and the service, enforce limits, prevent abuse, and diagnose availability problems;
• understand feature use and improve reliability while the relevant collection control is on; and
• meet legal, accounting, and store-platform obligations.

Where data-protection law requires a legal basis, we rely on performance of our agreement with you, legitimate interests in security, product improvement and service operation where permitted, consent where we ask for it, and compliance with legal obligations. You can turn either telemetry control off at any time without affecting earlier lawful processing.

5. When data is shared

We do not sell personal data. We do not share personal data for cross-context behavioural advertising. We disclose data only as needed for the purposes above:

• Supabase. Provides hosted authentication, product configuration, database, storage, and realtime services for installation rollout, accounts, profiles, progress, collections, friends, online rooms, and related service data.
• Google Firebase. Provides mobile Analytics and Crashlytics while the matching default-on control remains enabled. The controls are independent, and turning either one off stops future app-authorised collection for that product.
• Apple and Google. Operate the app stores and may process downloads, purchases, subscriptions, refunds, and device/storefront information under their own terms and privacy policies.
• Cloudflare. Delivers this public website and may process ordinary network and security logs. This site does not load Firebase, advertising technology, or third-party analytics.
• Professional and legal recipients. We may disclose information to advisers, authorities, or other parties when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or handle a business reorganisation. Where required, we will provide notice or seek consent.

Other players see only information needed for the feature you use. Friend discovery and private rooms show a stable, generated player alias and a monogram drawn locally by the app. They do not show your email, legal name, user-editable display name, or an uploaded profile image.

6. Your controls and choices

• Analytics: Settings → Privacy → Help improve Chalk Arcade.
• Crash diagnostics: Settings → Privacy → Share crash diagnostics.
• Camera: use your device settings to revoke access; manual room-code entry remains available.
• Profile: view your generated player alias and edit the optional country field in the app. The alias and local monogram are not user-editable.
• Account deletion: use Settings → Privacy → Delete account, or follow the outside-app path on our Delete account page.
• Local guest data: clear Chalk Arcade's storage in device settings or uninstall the app.

Depending on where you live, you may also have rights to request access, correction, portability, restriction, objection, or deletion; withdraw consent; and complain to a data-protection authority. To make a request, email [email protected]. We may need to verify that the account belongs to you before acting.

7. Retention and deletion

We keep account and progress data while your account is active and as needed to provide requested features. Live room and matchmaking data expires quickly; operational room records are ordinarily removed within 30 days. Some account activity records are capped at about 400 days. Security logs, support records, transaction evidence, and provider backups may remain for a limited period when reasonably needed for security, dispute handling, accounting, or law.

Direct in-app deletion removes the authenticated account and account-owned cloud data designed to cascade with it, including the profile, friends, progress, and history. A small amount of legally required transaction evidence, security records, temporary backups, or non-personal aggregate information may remain until its applicable retention period ends. See Delete your account for the exact steps and categories.

Turning off Analytics or Crashlytics stops future app-authorised collection for that control. Provider-held information already sent is retained under the applicable configuration and provider obligations; contact us if you want to make a rights request about it.

8. Security and international processing

We use access controls, encrypted HTTPS transport, protected device credential storage where available, row-level account access rules, bounded telemetry fields, native fail-closed startup, and persistent telemetry opt-outs. No method of storage or transmission is completely secure, so we cannot promise absolute security.

Our service providers may process data in countries other than yours. Where required, we use provider contracts and recognised transfer mechanisms intended to protect personal data across borders.

9. Children

Chalk Arcade is intended for people aged 13 and older and is not directed to children under 13. You must be at least 13 to use the app, including Guest Mode, create an account, or use online features. If the law where you live requires a higher minimum age to consent to digital services or personal-data processing, that higher age applies unless a parent or legal guardian can lawfully provide the required authorisation.

We do not knowingly collect personal data from children under 13 and do not currently offer a child account or parent-managed account process. If you believe a child under 13 has used Chalk Arcade or provided personal data, contact us so we can investigate and delete it as appropriate.

10. This website

This site does not set cookies or run analytics. After store links are published, the homepage may use browser session storage solely to avoid repeatedly redirecting you to the same mobile app store. That value is not sent to us and normally disappears when the browser session ends. Cloudflare may keep ordinary delivery and security logs as described above.

11. Changes to this policy

We may update this policy when the app, service providers, law, or store requirements change. We will change the date above and provide additional notice in the app when a change is material and notice is required. Earlier versions may be requested from us.

12. Contact

The data controller is the Chalk Arcade developer identified on the app's store listing. For privacy questions or rights requests, email [email protected]. Please do not send a password, one-time code, room code, or authentication token.