Privacy Policy

1. Who this policy covers

This Privacy Policy applies to the Chalk Arcade mobile application for iOS and Android and to this website. “Chalk Arcade,” “we,” “us,” and “our” mean Prabuddha Chakraborty, the developer who publishes Chalk Arcade on the Apple App Store and Google Play.

Chalk Arcade can be used as a local guest without creating an online account. Some features—including cloud progress, account recovery, friends, and supported online rooms—need an account and an internet connection.

2. Data we collect

The data involved depends on how you use Chalk Arcade.

• Account and profile data. If you create an account, we process your email address, an internal user ID, authentication status, a generated account handle and public player alias, and an optional country code. Chalk Arcade does not ask you to enter a legal name or choose an editable public display name. Authentication credentials are handled by our authentication provider; we do not receive your plain-text password.
• Google and Apple sign-in. Where offered, signing in with Google or Apple shares a provider account identifier, email address or Apple private relay address, and authentication information with Supabase, our account service. Google may also supply your name and profile-image URL, which are retained in authentication metadata and the saved session. From 1.1.0 build 20, a name supplied by your connected Apple or Google account may be used as a room display label. It does not replace your generated account handle. Chalk Arcade does not display your Google photo to other players. The current Apple browser flow does not normally provide a full name; when none is available, the app uses a connected gaming-profile name or a generated alias. We do not request access to your contacts, email messages, or cloud files.
• Platform gaming profiles. On supported mobile builds, Game Center or Google Play Games can connect to your device's gaming profile. The app receives its player identifier and display name, keeps completion counts and pending achievement reports on your device for that profile, and sends earned achievements to Apple or Google. These gaming profiles are separate from your Chalk Arcade account. When a Game Center or Google Play Games profile is connected and you are signed in to a Chalk Arcade account or an online guest account, the app records the gaming profile's player identifier and display name with that account, together with the platform (iOS or Android) and app build number, so we can understand how many players use a gaming profile. This gaming-profile record is sent to Supabase only while Help improve Chalk Arcade is on. It is not used to sign you in, or to restore, link, or merge Chalk Arcade accounts or cloud progress, and it is deleted with the account. A device-only guest without an online guest account is not recorded. From 1.1.0 build 20, a gaming-profile display name can be sent to Supabase as a room-only label when you use online play, and shown to other participants. It is linked to your room membership, not used to link your gaming account to your Chalk account.
• Gameplay and collection data. We may store favourites, game and level progress, completed levels, best times, scores, settings, collection choices, activity history, and the release of a game you used so progress can be restored and kept compatible.
• Social and online-play data. Friends, friend requests, room membership, matchmaking requests, room and match status, a generated player alias, and bounded game checkpoints or results may be processed to provide supported online play. Your account handle remains a stable generated alias and an app-rendered monogram is used instead of an uploaded profile image. From 1.1.0 build 20, online-room participants may see your connected account or gaming-profile name as a room-only label. The label is sent to Supabase and retained with room membership; without a valid name, a generated alias is used. There is no in-app display-name editor. Chalk Arcade does not currently offer public chat, and public leaderboards are disabled for the initial release.
• Installation and product-configuration data. The app creates a random, persistent installation identifier and sends a one-way derived form to our product service so it can return a stable, compatible game catalogue and staged feature configuration. If you use an online guest account, the installation identifier is also included in that account's authentication metadata. It is used for app functionality, not advertising or cross-app tracking.
• Purchase and entitlement data. If paid products are offered in a future release, we may receive product identifiers, transaction or receipt status, storefront, and entitlement status. Apple or Google processes the payment. We do not receive your full payment-card details.
• Mobile analytics. Help improve Chalk Arcade starts on. While it is on, Google Analytics for Firebase may process an app-instance or device identifier, app version and platform, general device and operating-system information, coarse geography derived from technical network information, lifecycle and product-interaction events, and bounded events such as screens viewed, a game launched or completed, duration ranges, and fixed error categories. Supported Android versions also send the default SIM's carrier name when available. In Android versions with advertising measurement enabled, Firebase may use advertising identifiers and these app-interaction events to attribute installs and gameplay to Google Ads campaigns, measure campaign performance, and support personalised advertising where your consent and applicable privacy choices permit. A required regional consent choice also applies to Analytics collection. iOS does not enable this advertising measurement. Our app-authored Firebase events do not include your email, user ID, room code, authentication token, or free-form text. The same control also governs the gaming-profile record described above, which is stored with your account in Supabase rather than sent to Firebase. You can turn this control off in Settings.
• Mobile crash diagnostics. Share crash diagnostics starts on. While it is on, Firebase Crashlytics may receive crash logs, stack traces, app state, app version, device and operating-system details, installation identifiers, and bounded context such as the current screen or game and a fixed error code. We do not deliberately attach your email or account ID to these reports. You can turn this control off independently in Settings.
• Android advertising. In Android versions with advertising enabled, Google AdMob and its User Messaging Platform process consent choices and may process IP address (including approximate location), device or advertising identifiers, app and device information, ad interactions, and diagnostic information to deliver and measure ads and prevent fraud. Personalised ads may use inferred interests or previous activity where your consent and applicable privacy choices permit. Google’s ad services use UMP consent signals and applicable settings to determine whether personalised, non-personalised, or limited ads can be served. Non-personalised ads may still use identifiers for frequency control, reporting, and fraud prevention. Chalk does not send your account email, room codes, game answers, or gaming-profile name to AdMob. Advertising is disabled on iOS.
• Network and security data. When you use an online feature or visit this site, infrastructure providers may process IP address, date and time, requested resource, response status, device/browser type, and security or abuse signals in ordinary service logs.
• Data kept on your device. A local guest's progress, preferences, audio and display choices, and other app state remain on the device. Signed-in session credentials are stored using protected device storage where available.

If you allow camera access, Chalk Arcade uses it to scan a friend-room QR code. Chalk Arcade does not retain the camera image or upload it to our service. You can also enter a room code without camera access.

3. Where data comes from

We receive data:

• directly from you when you create an account, choose an optional country code, contact support, or make a privacy request;
• from your use of the app, including progress and online-play actions;
• from your device when the app creates its installation identifier for product configuration, and while the corresponding analytics or diagnostics control is on; and
• from Google or Apple when you use their sign-in or platform gaming services, and when needed to validate a storefront purchase or entitlement.

4. How and why we use data

We use the data described above to:

• create, authenticate, secure, recover, and delete accounts;
• return a stable, compatible game catalogue and staged feature configuration;
• save progress, collections, preferences, and account history;
• recognise the connected platform gaming profile and report earned achievements;
• provide friends, private rooms, matchmaking, and other requested online features; public leaderboards are disabled for the initial release;
• verify purchases and provide entitlements if paid products are offered;
• answer support, privacy, and deletion requests;
• protect players and the service, enforce limits, prevent abuse, and diagnose availability problems;
• understand feature use and improve reliability while the relevant collection control is on, such as measuring how many players, including online guests, use a connected Game Center or Google Play Games profile; and
• deliver, personalise where permitted, measure, and prevent fraud in advertising on enabled Android versions, subject to your consent and applicable privacy choices; and
• meet legal, accounting, and store-platform obligations.

Where data-protection law requires a legal basis, we rely on performance of our agreement with you, legitimate interests in security, product improvement and service operation where permitted, consent where we ask for it, and compliance with legal obligations. You can turn either telemetry control off at any time without affecting earlier lawful processing.

5. When data is shared

We disclose data to the providers below for the purposes described in this policy. In enabled Android versions, this includes Google’s processing of advertising data for personalised advertising where your consent and applicable privacy choices permit:

• Supabase. Provides hosted authentication, product configuration, database, storage, and realtime services for installation rollout, accounts, profiles, progress, collections, friends, online rooms, gaming-profile records, and related service data.
• Google AdMob and UMP (Android only). Provide advertising and consent management in Android versions where ads are enabled. Google may use the advertising data described above to personalise ads where permitted, including based on activity across apps or services. See How Google uses advertising data and Google’s Privacy Policy. These services are separate from Firebase analytics and diagnostics. The website and iOS app do not request or display AdMob ads.
• Google Firebase. Provides mobile Analytics and Crashlytics while the matching default-on control remains enabled. The controls are independent, and turning either one off stops future app-authorised collection for that product. On supported Android versions, Analytics data may also be used with Google Ads for attribution, campaign measurement and personalised advertising where permitted. Turning Analytics off stops this Analytics-based advertising measurement too.
• Apple and Google. Provide account sign-in and platform gaming services where available, including processing gaming-profile connections and achievement reports. They also operate the app stores and may process downloads, purchases, subscriptions, refunds, and device/storefront information under their own terms and privacy policies.
• Cloudflare. Delivers this public website and may process ordinary network and security logs. This site does not load Firebase, advertising technology, or third-party analytics.
• Professional and legal recipients. We may disclose information to advisers, authorities, or other parties when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or handle a business reorganisation. Where required, we will provide notice or seek consent.

Other players see only information needed for the feature you use. Friend discovery keeps the generated account alias. From 1.1.0 build 20, online rooms may show a connected account or gaming-profile name to other room participants, with an app-rendered monogram. Your email and provider photo are not shown. Earlier clients send generated aliases but can receive newer participants' room labels through the shared service. Apple's and Google's own gaming-profile and achievement screens follow your settings for those services.

6. Your controls and choices

• Android ad privacy: where required, a Google consent message appears before ad requests are permitted. Use Settings → Privacy → Ad privacy choices to revisit your choices when this entry is available. Turning off app analytics or crash diagnostics does not change advertising consent. Refusing consent does not block access to games. Depending on your choices and applicable settings, Google may serve non-personalised or limited ads, or no ads. Ads are requested only when the consent SDK permits them.
• Analytics: Settings → Privacy → Help improve Chalk Arcade. Turning it off also stops future gaming-profile records; a record already stored stays with your account until the account is deleted or you ask us to delete it.
• Crash diagnostics: Settings → Privacy → Share crash diagnostics.
• Camera: use your device settings to revoke access; manual room-code entry remains available.
• Profile: view your automatic name and generated account handle, and edit the optional country field in the app. Neither the generated handle nor the room label has an in-app editor. A connected provider or gaming profile may supply a name you set with that provider.
• Online-room names: in build 20 and later, your connected account or gaming-profile name may be visible to other room participants. You can avoid this sharing by using solo/offline play; the app does not yet offer a separate room-name opt-out. Changing or disconnecting a provider affects future labels, not room records already retained.
• Connected services: manage Google or Apple sign-in permission and gaming-profile visibility in the provider's account or device settings. Removing provider permission does not itself delete your Chalk Arcade account. Signing out of Chalk Arcade does not sign you out of Game Center or Google Play Games.
• Account deletion: use Settings → Privacy → Delete account, or follow the outside-app path on our Delete account page.
• Local guest data: clear Chalk Arcade's storage in device settings or uninstall the app.

Depending on where you live, you may also have rights to request access, correction, portability, restriction, objection, or deletion; withdraw consent; and complain to a data-protection authority. To make a request, email [email protected]. We may need to verify that the account belongs to you before acting.

7. Retention and deletion

We keep account and progress data while your account is active and as needed to provide requested features. Live room and matchmaking data expires quickly; room display labels follow room-record retention, and operational room records are ordinarily removed within 30 days. Some account activity records are capped at about 400 days. A gaming-profile record keeps the first and most recent time the app saw that profile with your account; it is kept while the account exists and is deleted with it. Security logs, support records, transaction evidence, and provider backups may remain for a limited period when reasonably needed for security, dispute handling, accounting, or law.

Direct in-app deletion removes the authenticated account and account-owned cloud data designed to cascade with it, including the profile, friends, progress, history, and gaming-profile records. Online guest accounts can use the same in-app deletion. A small amount of legally required transaction evidence, security records, temporary backups, or non-personal aggregate information may remain until its applicable retention period ends. See Delete your account for the exact steps and categories.

Turning off Analytics or Crashlytics stops future app-authorised collection for that control. Provider-held information already sent is retained under the applicable configuration and provider obligations; contact us if you want to make a rights request about it. Turning off Help improve Chalk Arcade also stops future gaming-profile records but does not by itself delete a record already stored with your account.

8. Security and international processing

We use access controls, encrypted HTTPS transport, protected device credential storage where available, row-level account access rules, bounded telemetry fields, native fail-closed startup, and persistent telemetry opt-outs. No method of storage or transmission is completely secure, so we cannot promise absolute security.

Our service providers may process data in countries other than yours. Where required, we use provider contracts and recognised transfer mechanisms intended to protect personal data across borders.

9. Children

Chalk Arcade is intended for people aged 13 and older and is not directed to children under 13. You must be at least 13 to use the app, including Guest Mode, create an account, or use online features. If the law where you live requires a higher minimum age to consent to digital services or personal-data processing, that higher age applies unless a parent or legal guardian can lawfully provide the required authorisation.

We do not knowingly collect personal data from children under 13 and do not currently offer a child account or parent-managed account process. If you believe a child under 13 has used Chalk Arcade or provided personal data, contact us so we can investigate and delete it as appropriate.

10. This website

This site does not set cookies or run analytics. After store links are published, the homepage may use browser session storage solely to avoid repeatedly redirecting you to the same mobile app store. That value is not sent to us and normally disappears when the browser session ends. Cloudflare may keep ordinary delivery and security logs as described above.

11. Changes to this policy

We may update this policy when the app, service providers, law, or store requirements change. We will change the date above and provide additional notice in the app when a change is material and notice is required. Earlier versions may be requested from us.

12. Contact

The data controller is Prabuddha Chakraborty, the developer of Chalk Arcade. For privacy questions or rights requests, email [email protected]. Please do not send a password, one-time code, room code, or authentication token.