Privacy Policy

1. Who this policy covers

This Privacy Policy applies to the Chalk Arcade mobile application for iOS and Android and to this website. “Chalk Arcade,” “we,” “us,” and “our” mean the Chalk Arcade developer identified on the app's Apple App Store and Google Play listings.

Chalk Arcade can be used as a local guest without creating an online account. Some features—including cloud progress, account recovery, friends, and supported online rooms—need an account and an internet connection.

2. Data we collect

The data involved depends on how you use Chalk Arcade.

• Account and profile data. If you create an account, we process your email address, an internal user ID, authentication status, generated or chosen username and display name, and any optional profile information you add, such as an avatar or country code. Authentication credentials are handled by our authentication provider; we do not receive your plain-text password.
• Gameplay and collection data. We may store favourites, game and level progress, completed levels, best times, scores, settings, collection choices, activity history, and the release of a game you used so progress can be restored and kept compatible.
• Social and online-play data. Friends, friend requests, room membership, matchmaking requests, room and match status, display name and avatar shown to other room members, and bounded game checkpoints or results may be processed to provide supported online play. Chalk Arcade does not currently offer public chat.
• Purchase and entitlement data. If paid products are offered in a future release, we may receive product identifiers, transaction or receipt status, storefront, and entitlement status. Apple or Google processes the payment. We do not receive your full payment-card details.
• Optional analytics. Only after you enable Help improve Chalk Arcade, Google Analytics for Firebase may process an app-instance or device identifier, app version and platform, general device and operating-system information, coarse geography derived from technical network information, lifecycle and product-interaction events, and bounded events such as screens viewed, a game launched or completed, duration ranges, and fixed error categories. Our app-authored events do not include your email, user ID, room code, authentication token, or free-form text.
• Optional crash diagnostics. Only after you enable Share crash diagnostics, Firebase Crashlytics may receive crash logs, stack traces, app state, app version, device and operating-system details, installation identifiers, and bounded context such as the current screen or game and a fixed error code. We do not deliberately attach your email or account ID to these reports.
• Network and security data. When you use an online feature or visit this site, infrastructure providers may process IP address, date and time, requested resource, response status, device/browser type, and security or abuse signals in ordinary service logs.
• Data kept on your device. A local guest's progress, preferences, audio and display choices, and other app state remain on the device. Signed-in session credentials are stored using protected device storage where available.

If you allow camera access, Chalk Arcade uses it to scan a friend-room QR code. Chalk Arcade does not retain the camera image or upload it to our service. You can also enter a room code without camera access.

3. Where data comes from

We receive data:

• directly from you when you create or edit an account, contact support, or make a privacy request;
• from your use of the app, including progress and online-play actions;
• from your device when you choose to enable analytics or diagnostics; and
• from Apple or Google when needed to validate a storefront purchase or entitlement.

4. How and why we use data

We use the data described above to:

• create, authenticate, secure, recover, and delete accounts;
• save progress, collections, preferences, and account history;
• provide friends, private rooms, matchmaking, leaderboards, and other requested online features;
• verify purchases and provide entitlements if paid products are offered;
• answer support, privacy, and deletion requests;
• protect players and the service, enforce limits, prevent abuse, and diagnose availability problems;
• understand feature use and improve reliability when you have enabled the relevant optional control; and
• meet legal, accounting, and store-platform obligations.

Where data-protection law requires a legal basis, we rely on performance of our agreement with you, your consent for optional analytics or diagnostics, legitimate interests in security and service operation, and compliance with legal obligations. You may withdraw optional consent at any time in Settings without affecting earlier lawful processing.

5. When data is shared

We do not sell personal data. We do not share personal data for cross-context behavioural advertising. We disclose data only as needed for the purposes above:

• Supabase. Provides hosted authentication, database, storage, and realtime services for accounts, profiles, progress, collections, friends, online rooms, and related service data.
• Google Firebase. Provides optional mobile Analytics and Crashlytics after the matching control is enabled. Enabling one does not enable the other.
• Apple and Google. Operate the app stores and may process downloads, purchases, subscriptions, refunds, and device/storefront information under their own terms and privacy policies.
• Cloudflare. Delivers this public website and may process ordinary network and security logs. This site does not load Firebase, advertising technology, or third-party analytics.
• Professional and legal recipients. We may disclose information to advisers, authorities, or other parties when reasonably necessary to comply with law, protect rights and safety, investigate abuse, or handle a business reorganisation. Where required, we will provide notice or seek consent.

Other players see only information needed for the feature you use, such as a display name and avatar in friend discovery or a private room. Do not put sensitive information in your display name or avatar.

6. Your controls and choices

• Analytics: Settings → Privacy → Help improve Chalk Arcade.
• Crash diagnostics: Settings → Privacy → Share crash diagnostics.
• Camera: use your device settings to revoke access; manual room-code entry remains available.
• Profile: edit available profile fields in the app.
• Account deletion: use Settings → Privacy → Delete account, or follow the outside-app path on our Delete account page.
• Local guest data: clear Chalk Arcade's storage in device settings or uninstall the app.

Depending on where you live, you may also have rights to request access, correction, portability, restriction, objection, or deletion; withdraw consent; and complain to a data-protection authority. To make a request, email [email protected]. We may need to verify that the account belongs to you before acting.

7. Retention and deletion

We keep account and progress data while your account is active and as needed to provide requested features. Live room and matchmaking data expires quickly; operational room records are ordinarily removed within 30 days. Some account activity records are capped at about 400 days. Security logs, support records, transaction evidence, and provider backups may remain for a limited period when reasonably needed for security, dispute handling, accounting, or law.

Direct in-app deletion removes the authenticated account and account-owned cloud data designed to cascade with it, including the profile, friends, progress, and history. A small amount of legally required transaction evidence, security records, temporary backups, or non-personal aggregate information may remain until its applicable retention period ends. See Delete your account for the exact steps and categories.

Turning off Analytics or Crashlytics stops future app-authorised collection for that control. Provider-held information already sent is retained under the applicable configuration and provider obligations; contact us if you want to make a rights request about it.

8. Security and international processing

We use access controls, encrypted HTTPS transport, protected device credential storage where available, row-level account access rules, bounded telemetry fields, and collection-off defaults. No method of storage or transmission is completely secure, so we cannot promise absolute security.

Our service providers may process data in countries other than yours. Where required, we use provider contracts and recognised transfer mechanisms intended to protect personal data across borders.

9. Children

Chalk Arcade's game content and local Guest Mode are designed for players aged 4 and older. A player below the minimum age for independent digital consent where they live may use local Guest Mode with supervision from a parent or guardian, but must not independently create or manage an online account, use account-based social features, or enable optional analytics or crash diagnostics.

We do not currently offer a parent-managed account process for younger players. If we introduce one, we will provide the required notice and obtain any parent or guardian authorisation required by law before collecting personal data through those features. If you believe a child provided personal data without appropriate authorisation, contact us so we can investigate and delete it.

10. This website

This site does not set cookies or run analytics. After store links are published, the homepage may use browser session storage solely to avoid repeatedly redirecting you to the same mobile app store. That value is not sent to us and normally disappears when the browser session ends. Cloudflare may keep ordinary delivery and security logs as described above.

11. Changes to this policy

We may update this policy when the app, service providers, law, or store requirements change. We will change the date above and provide additional notice in the app when a change is material and notice is required. Earlier versions may be requested from us.

12. Contact

The data controller is the Chalk Arcade developer identified on the app's store listing. For privacy questions or rights requests, email [email protected]. Please do not send a password, one-time code, room code, or authentication token.