Privacy Policy

1. Who this policy covers

This Privacy Policy applies to the Chalk Arcade mobile application for iOS and Android and to this website. “Chalk Arcade,” “we,” “us,” and “our” mean Prabuddha Chakraborty, the developer who publishes Chalk Arcade on the Apple App Store and Google Play.

Chalk Arcade can be used as a local guest without creating an online account. Some features—including cloud progress, account recovery, friends, and supported online rooms—need an account and an internet connection.

2. Data we collect

The data involved depends on how you use Chalk Arcade.

• Account and profile data. If you create an account, we process your email address, an internal user ID, authentication status, a generated account handle and public player alias, and an optional country code. Chalk Arcade does not ask you to enter a legal name or choose an editable public display name. Authentication credentials are handled by our authentication provider; we do not receive your plain-text password.
• Google and Apple sign-in. Where offered, signing in with Google or Apple shares a provider account identifier, email address or Apple private relay address, and authentication information with Supabase, our account service. Google may also supply your name and profile-image URL, which are retained in authentication metadata and the saved session. From 1.1.0 build 20, a name supplied by your connected Apple or Google account may be used as a room display label. It does not replace your generated account handle. Your provider photo is not shown in friend discovery or online rooms. In versions with Ranks, a connected account name and photo may be selected automatically for your public leaderboard profile. You can choose a generated player name and a preset avatar in Ranks instead. The current Apple browser flow does not normally provide a full name; when none is available, the app uses a connected gaming-profile name or a generated alias. We do not request access to your contacts, email messages, or cloud files.
• Platform gaming profiles. On supported mobile builds, Game Center or Google Play Games can connect to your device's gaming profile. The app receives its player identifier and display name, keeps completion counts and pending achievement reports on your device for that profile, and sends earned achievements to Apple or Google. These gaming profiles are separate from your Chalk Arcade account. When a Game Center or Google Play Games profile is connected and you are signed in to a Chalk Arcade account or an online guest account, the app records the gaming profile's player identifier and display name with that account, together with the platform (iOS or Android) and app build number, so we can understand how many players use a gaming profile. This gaming-profile record is sent to Supabase only while Help improve Chalk Arcade is on. It is not used to sign you in, or to restore, link, or merge Chalk Arcade accounts or cloud progress, and it is deleted with the account. A device-only guest without an online guest account is not recorded. From 1.1.0 build 20, a gaming-profile display name can be sent to Supabase as a room-only label when you use online play, and shown to other participants. It is linked to your room membership, not used to link your gaming account to your Chalk account.
• Gameplay and collection data. We may store favourites, game and level progress, completed levels, best times, scores, settings, collection choices, activity history, and the release of a game you used so progress can be restored and kept compatible.
• Social and online-play data. Friends, friend requests, room membership, matchmaking requests, room and match status, a generated player alias, and bounded game checkpoints or results may be processed to provide supported online play. Your account handle remains a stable generated alias and an app-rendered monogram is used instead of an uploaded profile image. From 1.1.0 build 20, online-room participants may see your connected account or gaming-profile name as a room-only label. The label is sent to Supabase and retained with room membership; without a valid name, a generated alias is used. There is no in-app display-name editor. Chalk Arcade does not currently offer public chat. In versions with Ranks enabled, players with points appear on the public leaderboard with their player name, generated tag, avatar, points and rank. New profiles may automatically use the connected account name and photo, otherwise a connected gaming name or generated name and preset avatar. You can change the name source and avatar in Ranks. The chosen name, photo reference and gaming-provider name are stored with your account to provide this feature; that functional identity use is separate from optional analytics.
• Installation and product-configuration data. The app creates a random, persistent installation identifier and sends a one-way derived form to our product service so it can return a stable, compatible game catalogue and staged feature configuration. If you use an online guest account, the installation identifier is also included in that account's authentication metadata. It is used for app functionality, not advertising or cross-app tracking.
• Chalk purchases and entitlements. If paid products are offered in a future release, we may receive product identifiers, transaction or receipt status, storefront, and entitlement status. Apple or Google processes the payment. We do not receive your full payment-card details. Advertising-related purchase information is described separately below.
• Mobile analytics. Help improve Chalk Arcade starts on. While it is on, Google Analytics for Firebase may process an app-instance or device identifier, app version and platform, general device and operating-system information, coarse geography derived from technical network information, lifecycle and product-interaction events, and bounded events such as screens viewed, a game launched or completed, duration ranges, and fixed error categories. Supported Android versions also send the default SIM's carrier name when available. In Android versions with advertising measurement enabled, Firebase may use advertising identifiers and these app-interaction events to attribute installs and gameplay to Google Ads campaigns, measure campaign performance, and support personalised advertising where your consent and applicable privacy choices permit. A required regional consent choice also applies to Analytics collection. iOS advertising measurement uses permitted app-scoped signals without IDFA access; regional consent and your Analytics setting still apply. Our app-authored Firebase events do not include your email, user ID, room code, authentication token, or free-form text. The same control also governs the gaming-profile record described above, which is stored with your account in Supabase rather than sent to Firebase. You can turn this control off in Settings.
• Mobile crash diagnostics. Share crash diagnostics starts on. While it is on, Firebase Crashlytics may receive crash logs, stack traces, app state, app version, device and operating-system details, installation identifiers, and bounded context such as the current screen or game and a fixed error code. We do not deliberately attach your email or account ID to these reports. You can turn this control off independently in Settings.
• Mobile advertising. In Android and iOS versions with advertising enabled, Google AdMob and its User Messaging Platform process consent choices and may process IP address (including approximate location), device or advertising identifiers, app and device information, ad interactions, and diagnostic information to deliver and measure ads and prevent fraud. Personalised ads may use inferred interests or previous activity where your consent and applicable privacy choices permit. Google’s ad services use UMP consent signals and applicable settings to determine whether personalised, non-personalised, or limited ads can be served. Non-personalised ads may still use identifiers for frequency control, reporting, and fraud prevention. Chalk does not send your account email, room codes, game answers, or gaming-profile name to AdMob. On iOS, an allowlisted tester may explicitly request ATT permission in Settings to display and optionally copy the IDFA for AdMob test-device registration. This diagnostic screen does not persist or upload the IDFA to Chalk, Supabase or Firebase. After permission is granted, advertising SDKs may also access it for advertising and measurement, subject to regional consent. Removing tester access does not revoke Apple’s permission; testers can revoke it in iOS Settings under Privacy & Security → Tracking. Google can still use contextual and app- or developer-scoped signals as permitted. For an optional Ranks points boost, we send Google a pseudonymous Chalk account ID and one-time reward-intent ID so our server can verify the signed completion receipt and grant the bonus once; the SDK callback alone does not grant points.
• Mediated advertising data. Optional providers Meta Audience Network, Unity Ads and Liftoff Monetize (formerly Vungle) may process device or app identifiers, IP-derived approximate location, app and device information, ad views and interactions, and advertising-related crash, performance and diagnostic data to deliver and measure ads, operate their services and prevent fraud. Unity Ads also identifies purchase history as data used for advertising and analytics in its SDK disclosure; this is separate from Chalk’s own paid features. Unity may measure app usage times when its optional ad-optimization feature is enabled. Liftoff describes device and advertising identifiers, ad interactions, approximate location and consent information. This integration does not add access to GPS location, contacts, microphone, camera or your photo library. Processing depends on the provider, platform, configuration and applicable privacy choices.
• Network and security data. When you use an online feature or visit this site, infrastructure providers may process IP address, date and time, requested resource, response status, device/browser type, and security or abuse signals in ordinary service logs.
• Data kept on your device. A local guest's progress, preferences, audio and display choices, and other app state remain on the device. Signed-in session credentials are stored using protected device storage where available.

If you allow camera access, Chalk Arcade uses it to scan a friend-room QR code. Chalk Arcade does not retain the camera image or upload it to our service. You can also enter a room code without camera access.

3. Where data comes from

We receive data:

• directly from you when you create an account, choose an optional country code, contact support, or make a privacy request;
• from your use of the app, including progress and online-play actions;
• from your device when the app creates its installation identifier for product configuration, while the corresponding analytics or diagnostics control is on, and through permitted advertising requests and interactions; and
• from Google or Apple when you use their sign-in or platform gaming services, and when needed to validate a storefront purchase or entitlement.

4. How and why we use data

We use the data described above to:

• create, authenticate, secure, recover, and delete accounts;
• return a stable, compatible game catalogue and staged feature configuration;
• save progress, collections, preferences, and account history;
• recognise the connected platform gaming profile and report earned achievements;
• provide friends, private rooms, matchmaking, public Ranks listings, and other requested online features;
• verify purchases and provide entitlements if paid products are offered;
• answer support, privacy, and deletion requests;
• protect players and the service, enforce limits, prevent abuse, and diagnose availability problems;
• understand feature use and improve reliability while the relevant collection control is on, such as measuring how many players, including online guests, use a connected Game Center or Google Play Games profile; and
• deliver, personalise where permitted, measure, and prevent fraud in advertising on enabled Android and iOS versions, subject to your consent and applicable privacy choices; and
• meet legal, accounting, and store-platform obligations.

Where data-protection law requires a legal basis, we rely on performance of our agreement with you, legitimate interests in security, product improvement and service operation where permitted, consent where we ask for it, and compliance with legal obligations. You can turn either telemetry control off at any time without affecting earlier lawful processing.

5. When data is shared

We disclose data to the providers below for the purposes described in this policy. In enabled mobile versions, this includes Google’s and configured mediation partners’ processing of advertising data for personalised advertising where your consent and applicable privacy choices permit:

• Supabase. Provides hosted authentication, product configuration, database, storage, and realtime services for installation rollout, accounts, profiles, progress, collections, friends, online rooms, gaming-profile records, and related service data.
• Google AdMob and UMP. Provide advertising and consent management in Android and iOS versions where ads are enabled. Google may use the advertising data described above to personalise ads where permitted, including based on activity across apps or services. See How Google uses advertising data and Google’s Privacy Policy. These services are separate from Firebase analytics and diagnostics. The website does not request or display AdMob ads. The iOS app normally uses permitted contextual and app- or developer-scoped signals. Allowlisted testers can explicitly grant ATT permission as described above; advertising SDKs may then use IDFA where their other consent requirements permit.
• Optional AdMob mediation partners. Mobile versions may include Meta Audience Network, Unity Ads and Liftoff Monetize (formerly Vungle) to supply advertising through AdMob when those sources are configured and available. They process the advertising data described above subject to platform restrictions and applicable privacy choices. SDK initialization can occur even when a partner’s ad is not displayed. This integration does not add partner sign-in to Chalk or send partners your account email for ad targeting. See Meta’s Privacy Policy, Unity’s Game Player and App User Privacy Policy and Liftoff’s Privacy Policy for their collection, use, retention and privacy-request options.
• Google Firebase. Provides mobile Analytics and Crashlytics while the matching default-on control remains enabled. The controls are independent, and turning either one off stops future app-authorised collection for that product. On supported mobile versions, Analytics data may also be used with Google Ads for attribution, campaign measurement and personalised advertising where permitted. Turning Analytics off stops this Analytics-based advertising measurement too.
• Apple and Google. Provide account sign-in and platform gaming services where available, including processing gaming-profile connections and achievement reports. They also operate the app stores and may process downloads, purchases, subscriptions, refunds, and device/storefront information under their own terms and privacy policies.
• Cloudflare. Delivers this public website and may process ordinary network and security logs. This site does not load Firebase, advertising technology, or third-party analytics.
• Professional and legal recipients. We may disclose information to advisers, authorities, or other parties when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or handle a business reorganisation. Where required, we will provide notice or seek consent.

Other players see only information needed for the feature you use. Friend discovery keeps the generated account alias. From 1.1.0 build 20, online rooms may show a connected account or gaming-profile name to other room participants, with an app-rendered monogram. Your email is not shown to other players. Provider photos are not shown in rooms or friend discovery. Ranks may automatically display a connected account name and photo; you can choose a generated name and preset avatar instead. Earlier clients send generated aliases but can receive newer participants' room labels through the shared service. Apple's and Google's own gaming-profile and achievement screens follow your settings for those services.

6. Your controls and choices

• Mobile ad privacy: where required, a Google consent message appears before ad requests are permitted. Use Settings → Privacy → Ad privacy choices to revisit your choices when this entry is available. Turning off app analytics or crash diagnostics does not change advertising consent or disable advertising SDK diagnostics. Refusing consent does not block access to games. Depending on your choices and applicable settings, providers may serve non-personalised or limited ads, or no ads. Ads are requested only when the consent SDK permits them. A displayed ad may also offer AdChoices or a Data Privacy icon with the provider’s controls and information.
• Analytics: Settings → Privacy → Help improve Chalk Arcade. Turning it off also stops future gaming-profile records; a record already stored stays with your account until the account is deleted or you ask us to delete it.
• Crash diagnostics: Settings → Privacy → Share crash diagnostics.
• Camera: use your device settings to revoke access; manual room-code entry remains available.
• Profile: view your automatic name and generated account handle, and edit the optional country field in the app. Neither the generated handle nor the room label has an in-app editor. A connected provider or gaming profile may supply a name you set with that provider.
• Online-room names: in build 20 and later, your connected account or gaming-profile name may be visible to other room participants. You can avoid this sharing by using solo/offline play; the app does not yet offer a separate room-name opt-out. Changing or disconnecting a provider affects future labels, not room records already retained.
• Connected services: manage Google or Apple sign-in permission and gaming-profile visibility in the provider's account or device settings. Removing provider permission does not itself delete your Chalk Arcade account. Signing out of Chalk Arcade does not sign you out of Game Center or Google Play Games.
• Account deletion: use Settings → Privacy → Delete account, or follow the outside-app path on our Delete account page.
• Local guest data: clear Chalk Arcade's storage in device settings or uninstall the app.

Depending on where you live, you may also have rights to request access, correction, portability, restriction, objection, or deletion; withdraw consent; and complain to a data-protection authority. To make a request, email [email protected]. We may need to verify that the account belongs to you before acting.

7. Retention and deletion

We keep account and progress data while your account is active and as needed to provide requested features. Live room and matchmaking data expires quickly; room display labels follow room-record retention, and operational room records are ordinarily removed within 30 days. Some account activity records are capped at about 400 days. A gaming-profile record keeps the first and most recent time the app saw that profile with your account; it is kept while the account exists and is deleted with it. Security logs, support records, transaction evidence, and provider backups may remain for a limited period when reasonably needed for security, dispute handling, accounting, or law.

Direct in-app deletion removes the authenticated account and account-owned cloud data designed to cascade with it, including the profile, friends, progress, history, and gaming-profile records. Online guest accounts can use the same in-app deletion. A small amount of legally required transaction evidence, security records, temporary backups, or non-personal aggregate information may remain until its applicable retention period ends. See Delete your account for the exact steps and categories.

Turning off Analytics or Crashlytics stops future app-authorised collection for that control. Provider-held information already sent is retained under the applicable configuration and provider obligations; contact us if you want to make a rights request about it. Turning off Help improve Chalk Arcade also stops future gaming-profile records but does not by itself delete a record already stored with your account.

Advertising providers retain information under their own published policies, including where needed for measurement, billing, security, fraud prevention or legal obligations. Deleting your Chalk account or uninstalling the app does not automatically erase records already held separately by those providers. You can use their linked privacy policies or available ad privacy controls to make a request, or contact us for help identifying the relevant provider.

8. Security and international processing

We use access controls, encrypted HTTPS transport, protected device credential storage where available, row-level account access rules, bounded telemetry fields, native fail-closed startup, and persistent telemetry opt-outs. No method of storage or transmission is completely secure, so we cannot promise absolute security.

Our service providers may process data in countries other than yours. Where required, we use provider contracts and recognised transfer mechanisms intended to protect personal data across borders.

9. Children

Chalk Arcade is intended for people aged 13 and older and is not directed to children under 13. You must be at least 13 to use the app, including Guest Mode, create an account, or use online features. If the law where you live requires a higher minimum age to consent to digital services or personal-data processing, that higher age applies unless a parent or legal guardian can lawfully provide the required authorisation.

We do not knowingly collect personal data from children under 13 and do not currently offer a child account or parent-managed account process. If you believe a child under 13 has used Chalk Arcade or provided personal data, contact us so we can investigate and delete it as appropriate.

10. This website

This site does not set cookies or run analytics. After store links are published, the homepage may use browser session storage solely to avoid repeatedly redirecting you to the same mobile app store. That value is not sent to us and normally disappears when the browser session ends. Cloudflare may keep ordinary delivery and security logs as described above.

11. Changes to this policy

We may update this policy when the app, service providers, law, or store requirements change. We will change the date above and provide additional notice in the app when a change is material and notice is required. Earlier versions may be requested from us.

12. Contact

The data controller is Prabuddha Chakraborty, the developer of Chalk Arcade. For privacy questions or rights requests, email [email protected]. Please do not send a password, one-time code, room code, or authentication token.