Privacy Policy

Effective 2 November 2026.

This privacy policy is for Doodly Arcade (doodlyarcade.com), an indie browser-game arcade operated by Doodly Arcade. The operator is Adil Akbar, based in Pakistan. Effective date: 2 November 2026. The site is a general-audience arcade. It is not directed at children under 13.

What we collect

If you play as a guest, the games keep progress in your browser (localStorage) — scores, trophies, Blockyard looks, and similar cabinet state. That data stays on your device unless you sign in.

If you create an optional account we store it in Cloudflare D1: a username, a per-user salt, a PBKDF2-SHA-256 password hash (never the password itself), the game progress you choose to sync, and a created time. After sign-in we set an HTTP-only session cookie named arcade_session (about 30 days).

If you send the contact form we store your name, email, and message in D1 so we can reply. Ordinary server logs may include IP address, browser type, and the page you asked for.

First-party analytics

Doodly Arcade runs a first-party, privacy-friendly tracker on our own Worker (`/api/track`). It records a random visitor id from localStorage, the route, a referrer host, and coarse play time so the owner desk can see which cabinets are used. IP addresses are hashed with a daily salt. We do not use Google Analytics, Meta Pixel, or other third-party analytics. The only third-party scripts that may run on the hub are advertising scripts you allow.

Cookies and local storage

Essential storage runs the site you asked for. Advertising cookies are optional. Details live on the Cookie Policy.

Sign-in session cookie (arcade_session) — HTTP-only, SameSite=Lax, needed to stay signed in.
Game saves in localStorage — guest scores, trophies, and Blockyard looks.
Consent choice in localStorage — so we remember Accept, Reject, or Manage.
First-party analytics visitor id in localStorage — a random value, not your name.
Google AdSense / DoubleClick cookies — only if you allow advertising; they support personalised ads.

Advertising (Google AdSense)

The hub may show Google AdSense advertisements, including personalised ads. Third-party vendors, including Google, use cookies to serve ads based on a user's prior visits to this website or other websites. Google's use of advertising cookies enables it and its partners to serve ads to you based on your visit to doodlyarcade.com and/or other sites on the Internet.

You may opt out of personalised advertising by visiting Google's ad settings and the industry pages at aboutads.info or Your Online Choices. How Google uses information on partner sites is described at policies.google.com/technologies/partner-sites.

We do not load ad scripts inside a running game. Hub ad slots stay empty until a publisher id is live. When Google AdSense Privacy & messaging (a certified CMP using the IAB TCF) is turned on, that tool will handle the advertising consent signal. Until then, visitors in the EEA, UK, and Switzerland see our first-party Accept / Reject / Manage banner. Anyone can reopen that banner with Cookie settings in the footer.

Legal bases and rights (GDPR / UK GDPR)

We process guest game data and accounts to perform the service you asked for (contract). We process contact mail to answer you (contract / legitimate interests). We process first-party analytics and security logs as a legitimate interest in running a small arcade. We process advertising cookies only with consent where that is required.

You may ask for a copy of the account data we hold, ask us to correct it, delete it, restrict or object to certain processing, or receive a portable copy. You may withdraw advertising consent at any time with Cookie settings. You may also complain to your local data protection authority (in the UK, the ICO).

California (CCPA / CPRA)

Doodly Arcade does not sell your personal information for money. Advertising cookies can count as “sharing” for cross-context behavioural advertising. You can opt out by rejecting advertising cookies, by using Cookie settings, or by the Google and industry links above. California residents may also request to know, delete, or correct personal information we hold, and we will not discriminate for exercising those rights. Email hello@doodlyarcade.com.

Children

Doodly Arcade is a general-audience site. It is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child sent us an account or a contact message, write to us and we will delete it.

Data retention

Guest localStorage stays on your device until you clear it. Account rows in D1 stay until you ask us to delete the account or we close it for abuse. Session cookies expire after about 30 days or when you sign out. Contact messages are kept long enough to reply, then removed within 12 months. First-party analytics events are kept to operate the owner desk and are aggregated or dropped when they are no longer useful (typically within 24 months).

Contact

Questions: hello@doodlyarcade.com or the form on the contact page. Operator: Doodly Arcade, Adil Akbar, Pakistan. Effective date: 2 November 2026.