Privacy policy

Who we are

Orrery Arcade is run in the UK by the arcade’s owner, a sole trader. It’s a one-person project. We are the “controller” of your personal data under UK data protection law (the UK GDPR and the Data Protection Act 2018). You can reach us at the address shown here before launch.

This policy covers the arcade at arcade.orrery.cx, its welcome page, the phone pages people use to join a party, and emails we send. You need to give an email address to have an account; everything else is up to you.

If the arcade moves to a limited company we set up to run it (see our Terms), your details move with it and that company becomes the controller. We’ll email you before that happens, and it will keep to this policy.

What we keep, and why

When you sign up or sign in

• Your email address, and any other family emails you add, so we can send sign-in codes and know which arcade is yours.
• Your arcade’s name, which you choose. Names are unique, so other people may find out a name is taken, but a name never lets anyone in.
• Sign-in codes and session keys, stored only as one-way hashes (fingerprints), never as the codes or keys themselves.
• Your After Dark PIN, if your family sets one: stored only as a one-way hash, one per arcade, never as the PIN itself.

When your family plays

• Players’ names, scores, stats, saved games and history that you add in your arcade. Use first names or nicknames: we don’t need anyone’s full name. You can remove a player in Stats; you can undo that for 30 days, then it’s gone.
• Party guests type a name on their phone to join. Their moves and answers stay in the party room only while it runs. The name they choose, and their scores and play counts, are saved in the host family’s arcade (its stats and Hall of Fame), like the family’s own players. Guests don’t need an account and give us no email.

Game popularity and thumbs votes

• What’s sent: for each game, how many times your arcade started and finished it each evening, how long finished games lasted, how many people played, and your thumbs up or down. No names, initials, emails, scores, party codes or your arcade’s name.
• How it’s kept: under a one-way code made from your arcade, so the record can’t be traced back to you. It ages out on its own after about 70 days without play.
• What it’s for: to suggest a good order for the games menu (combined across arcades, and only once enough arcades have played) and to help us decide which games to improve. We use it on the basis of our legitimate interest in making the arcade better.

If you join the global leaderboard

• It’s off unless you turn it on. Your account’s main email can choose a public name for your arcade in Settings, and turn the global leaderboard on or off at any time.
• What everyone sees: that name and your arcade’s best score (or most wins) for each game. Never your arcade’s own name, your email, or your players’ names or initials.
• What we keep for it: the name, a reference to your arcade, your best score for each game and when it changed, and when your arcade last opened, so arcades that close or haven’t opened for 60 days drop off.
• Names are unique and must be friendly. We filter rude names, and we can hide an arcade, retire a name or remove a score that looks wrong.

When something goes wrong

• Error reports: if a page hits an error, it sends us a short report: the error, the page address, the device and browser type, the screen size, and the country and Cloudflare data centre it came through.
• Screen check: if you run it from Settings, it sends a similar report on how well this device runs each game, with its browser features, screen size, and processor and memory size.
• We keep both for 14 days, only to fix problems.

To keep the arcade safe

• Your IP address, hashed. To stop people guessing codes or flooding sign-in and offer links, we count attempts against a keyed hash of your IP address. We never store the address itself, and the counts are deleted within a few days.
• Our host, Cloudflare, also handles your IP address to deliver the site and protect it from attacks (see below).

When you pay, or have a free place

• Stripe takes your payment on its own secure page. Your card or wallet details go to Stripe, never to us.
• To know whether your arcade is open, we ask Stripe about your membership: its status (paid, trial, late or cancelled) and the email used to pay. We keep Stripe’s customer and payment references where offers need them, never card details.
• Free places (for family and friends, or from an offer) are recorded in Stripe too: a customer record with your email and a note that your place is free, so the arcade can check it.
• Stripe is also responsible for its own use of your details, for example to prevent fraud and meet its legal duties. See Stripe’s privacy policy.

Offers and invites

• If you use an offer, a free trial or a friend’s invite link, we record your email with that offer and how it’s going (for example, trial started or ended), so the offer works and can’t be used twice.
• These records, and the email records below, are kept in a back office that only we can open, protected by a password and an authenticator app.

When you contact us

• We keep your message and our reply so we can help you.

We don’t sell, rent or share your data for advertising, and we don’t build profiles of you.

Cookies and browser storage

We only use cookies the arcade needs to work. There are no advertising, analytics or tracking cookies, so there’s no cookie banner to click through.

• orrery_gate · the family PIN or a party passLets you past the front gate. Lasts a year after entering the PIN, or 6 hours when you join a party with its code.
• orrery_signin · a sign-in in progressTies your sign-in code to the browser that asked for it, so a code is no use anywhere else. Lasts 10 minutes.
• orrery_account · keeps you signed inA random key; we keep only its one-way hash. Lasts up to 30 days, or until you sign out.
• orrery_fresh · just signed inShows that a sign-in code was typed in this browser in the last 10 minutes, so you can change or remove the After Dark PIN without the old one. Only sent to that one setting. Lasts 10 minutes, or until you sign out.
• orrery_link · signing in a screen with your phoneLets a screen that is showing a sign-in code collect its own sign-in once your phone approves it. Only sent to that one check. Lasts 10 minutes. Only used once signing in with your phone is on.
• orrery_fresh_screens · just signed inShows that a sign-in code was typed in this browser in the last 10 minutes, so you can sign out every screen you signed in with your phone. Only sent to that one setting. Lasts 10 minutes, or until you sign out. Only used once signing in with your phone is on.
• orrery_access · is your arcade open?Remembers whether your membership is paid up, so we don’t ask Stripe on every visit. Lasts up to a week. Only used once paid memberships are on.
• orrery_room · your seat in a partyLets a screen or phone back into the party it joined. Lasts 6 hours.
• orrery_admin and friendsOnly for the owner’s own back office. You’ll never get these.

Cloudflare may set its own short-lived security cookie, for example when Turnstile checks you’re a person, and Stripe sets its own cookies on its checkout and membership pages. They’re for security and payments only; see Cloudflare’s and Stripe’s cookie policies.

The arcade and the phone page also keep a few things in your browser’s own storage, on your device only: settings such as sound and picture quality, a copy of your boards and stats with any scores still waiting to be saved, and on a phone, its seat in the party and the last name typed, so a phone that drops out can rejoin. Clearing your browser’s data removes them.

Emails we send

• Sign-in codes, when you ask for one.
• Notices about your membership, such as a price change, sent to the address on your account.
• Trial reminders, if you’re on a free trial from an offer: a reminder before it ends, and a note when it has. You can unsubscribe from them.
• Offers and news, only if you’ve told us you want them. We record when and how you told us.

Every trial, offer or news email has an unsubscribe link. Use it and we stop; we keep your address on a “don’t email” list so it stays that way. Sign-in codes and membership notices still arrive.

Who helps us run it

Two companies process data for us, only to run the arcade:

• Cloudflare hosts the arcade and stores its data (Cloudflare Pages, Workers, Durable Objects and KV), sends sign-in and other emails (Cloudflare Email Service), and, once the arcade opens to the public, runs Turnstile on the welcome page: a quick check that you’re a person, instead of a puzzle.
• Stripe takes payments and keeps payment records.

The arcade’s fonts and pictures come from our own site, so no other company sees you load them.

Cloudflare and Stripe work worldwide, so some data may be handled outside the UK, including in the USA. They protect it under the UK Extension to the EU-US Data Privacy Framework and the UK’s International Data Transfer Agreement or Addendum, as set out in their data processing agreements (Cloudflare’s and Stripe’s).

If you choose to follow a link to another site (for example the “buy me a coffee” link), that site’s own privacy policy applies.

How long we keep it

• Game popularity and votes: until about 70 days after your arcade last played; the shared menu ranking uses only the last 63 evenings.
• Sign-in codes: 10 minutes. Sign-in sessions: up to 30 days. Hashed IP counts: a few days. Error reports and screen checks: 14 days.
• Party rooms: a party’s moves and answers are cleared after the party ends and its devices have gone, usually within hours. Names and scores saved to the host’s arcade are kept like its other players.
• Your account and arcade: for as long as you have them.
• When an arcade closes (after cancelling, or 15 days after a missed payment), it’s locked straight away. Its players, scores and your account are deleted when you choose Start again, when you ask us to, or otherwise within 12 months of it closing.
• Payment records are kept by Stripe for as long as the law requires (usually 6 years, for tax). Stripe also keeps its customer record, including any free-place note.
• Global leaderboard: while your arcade is on it. Turning it off takes your scores off straight away; your chosen name is kept so you can come back to it. Starting again (removing your account) deletes the name too. An arcade that hasn’t opened for 12 months is taken off for good. A name we retire for breaking the rules is kept so no one can use it again.
• Offer records: while the offer runs and for 2 years after, so an offer can’t be used twice.
• Email records: your choice to get offers, until you unsubscribe; the “don’t email” list, for good, so we never email you again; and a log of the last 500 emails sent (address, which email, and whether it went).

Our legal basis

• To provide the arcade you signed up for (a contract): your email, sign-in, your arcade and payments.
• Legitimate interests (ours, and your family’s) in running your family’s arcade: the names and scores of family members and party guests.
• Our legitimate interests in keeping the arcade safe, fair and working: rate limits, security checks, error reports, offer records, trial reminders and the “don’t email” list.
• Your consent for offer and news emails. You can take it back any time.
• Legal obligations, such as keeping payment records for tax.

Children

Accounts are for adults (18 and over). Children can play in a family’s arcade or join a party with a code, with a grown-up in charge. The account holder is responsible for the family members they add as players. Party guests often use a first name or nickname, and that’s all the arcade needs. We don’t ask children for an email address or any other contact details.

Your rights

Under UK data protection law you can ask us to:

• give you a copy of the personal data we hold about you;
• correct anything that’s wrong;
• delete your data;
• limit or object to how we use it, or move it elsewhere.

Email the address shown here before launch. We’ll reply within a month, and it’s free.

If you’re not happy with how we’ve handled your data, please tell us first. You can also complain to the Information Commissioner’s Office (ICO), the UK’s data protection regulator: ico.org.uk/make-a-complaint or 0303 123 1113.

Changes and contact

If we change this policy in a way that matters, we’ll email the address on your account before it applies.

Questions? Email the address shown here before launch. Postal address: to follow before launch