Policies · Beta-2 draft

Privacy Policy

Last updated: 10 November 2026

This is a beta-2 policy draft for review before launch. It is not legal advice. If anything is unclear, contact support@awaitarcade.com.

Who we are

Await Arcade (“we”, “us”) operates the hosted arcade at awaitarcade.com and the OpenCode Desktop and Antigravity clients. The data controller is Await Arcade, Ontario, Canada. This policy explains what we collect, why, and how to remove it.

What we collect

Account and identity

• Your GitHub numeric ID, login, display name, and avatar URL when you sign in.
• Your chosen arcade display name. It is public on leaderboards.
• Your GitHub login is used for sign-in and support; it is not shown on public boards.

Gameplay

• Seed, mode, input log, replay, elapsed time, score, timestamps, and verification result.
• Daily-challenge attempts, XP totals, levels, medals, and ghost-practice records.
• Replays contain game inputs only. They do not contain chat, files, or your screen.

Session and technical data

• Session identifiers, hashed refresh/access tokens, host name, and expiry times.
• The raw refresh token is stored on your device; Firestore stores a hash.
• IP addresses are used for rate limiting and abuse prevention; Cloud Run/Cloud Logging may retain request metadata for up to 30 days for security and operations.
• We do not use analytics, advertising cookies, or third-party trackers.

How we use it

• Provide sign-in, run issuance, replay verification, boards, daily challenges, XP, medals, and ghost practice.
• Detect cheating, abuse, and rate-limit violations.
• Respond to support, privacy, security, and deletion requests.
• Operate, debug, and improve the service.

What is public

Leaderboards show your arcade display name, score, board rank, XP level, global XP rank, medals, and ghost-practice seed/mode/anchor. Board responses also include a random playerId used by the API; it is not your GitHub ID and is not publicly linked to your login. We do not show your email, GitHub login, tokens, or IP address.

Legal bases

Where required, we rely on performance of our contract with you (providing the service), our legitimate interests (security, abuse prevention, and operating the service), and consent where we ask for it. You can withdraw consent at any time.

Processors and transfers

We use GitHub for authentication and Google Cloud for Firestore, Cloud Run, Secret Manager, and Firebase Hosting. If you email us, Zoho processes that message. These providers may process data outside Canada under their standard safeguards. We do not sell personal data.

Retention

• Runs: about 24 hours (Firestore TTL).
• Access tokens: about 15 minutes; refresh sessions: up to 180 days.
• Auth flows: about 15 minutes.
• Boards, XP, medals, ghosts, and daily attempt counters: until you delete your account or we clean up the service.
• Local host state (auth files, bests, queue): until you sign out, clear it, or uninstall.

Cookies and local storage

The website uses no cookies and no analytics. The host clients use local storage for settings, personal bests, and the offline submission queue. That data stays on your device unless you sign in and submit a run.

Security

We hash session tokens, verify replays on the server, use TLS, and restrict service accounts. No service is perfectly secure; report issues to security@awaitarcade.com.

Your rights

You can access, correct, delete, or request a copy of your data, object to processing, and complain to a privacy regulator. Delete your account from the account panel, or email privacy@awaitarcade.com. We aim to respond within 30 days. See Data Deletion for details.

Children

The service is not directed to children under 13. GitHub accounts are subject to GitHub’s age requirements. Contact us if you believe a child provided personal data.

Changes

If a data breach creates a risk of significant harm, we will notify affected users and the appropriate regulator as required by law. We may update this policy as the beta changes. We will change the date above and, for material changes, post a notice on the site.

Contact

Privacy: privacy@awaitarcade.com
General: support@awaitarcade.com