Privacy Policy

1. Operator, scope, and effective date

Effective date: October 18, 2026

This Privacy Policy describes how Young Human LLC, operating Arcade Czar (“we,” “us,” or “our”), collects, uses, discloses, and retains personal information in connection with the website, game-creation tools, accounts, hosted games, and support channels. Where applicable data-protection law uses the term, this operator is the controller for processing it determines. Contact information appears in Section 15.

This Policy applies to visitors, account holders, people who submit support requests, and individuals whose information is included in submitted content. It does not govern a third party’s independent website or service. Our Terms of Service govern use of the product; consent to optional processing is requested separately when required.

2. Information you provide

Account and authentication information. We process your account identifier, email address, display name, profile image where available, sign-in provider, verification status, and authentication/session information supplied through the sign-in system. Google Firebase Authentication supports account authentication. Information a sign-in provider sends depends on the method and permissions used. We do not ask you to send a third-party account password to our support channel.

Creation and editing information. We process prompts, selected game references and styles, instructions, uploaded photographs and images, captions, drafts, visibility and PIN settings, generated code and assets, game titles and descriptions, screenshots, and edit requests. Content may contain personal information about you or others. Generation records can include model responses, usage measurements, diagnostic logs, browser-test evidence, and previous versions retained for recovery.

Communications. When you use the contact form, we collect the name, email address, and message you submit, together with submission identifiers and timestamps. We also process information you provide when requesting support, reporting a game, or exercising privacy rights. Provide only the information needed to address the request.

3. Information collected through use of the Service

Our servers and infrastructure providers process technical information needed to deliver and secure requests, including IP addresses, request URLs, timestamps, browser or device information, response/error information, and authentication events, to the extent recorded by the relevant system. We process game-job identifiers, queue status, completion and failure records, and service usage associated with your account. We do not infer a precise physical location from browser location access as part of the creation flow.

The website uses cookies and browser storage for authentication, game-access PIN sessions, local drafts and uploaded reference images, editor recovery, preferences, and interface state. Generated games may store local progress, best scores, or settings. Clearing browser data can remove locally stored work or sign-in state. The campaign landing page may read campaign parameters from a link and store attribution and interaction events in the browser.

Fonts, scripts, and authentication components loaded from third-party infrastructure can transmit technical request information to those providers when your browser connects. Current integrations include Google-hosted fonts and Firebase components and jsDelivr-hosted scripts.

4. Sources and purposes of processing

We obtain information directly from you, from your use of the Service and generated games, from authentication and infrastructure providers, and from other users who lawfully include information in content or reports. We use it to authenticate users; maintain accounts; save drafts; queue, generate, test, and edit games; deliver and host assets; apply visibility settings; display requested public content; troubleshoot failures; restore interrupted work; and provide support.

We also use information as reasonably necessary to detect misuse and unauthorized access, investigate complaints, enforce agreements, respond to legal process, preserve records required by law, and establish or defend legal claims. Service-level usage and technical measurements help us understand reliability and capacity. A new purpose that is incompatible with the purpose for which information was collected requires the notice, authorization, or other lawful basis applicable to that processing.

Providing account information is necessary for authenticated creation. Uploading photographs, publishing a game, and submitting optional descriptions or support details are choices. If necessary information is withheld, we may be unable to provide the requested feature or verify a request.

5. AI processing and generated material

To carry out generation and editing requests, we transmit relevant prompts, uploaded reference images and captions, game code and assets, and test observations or screenshots to the AI provider used for the request. Our generation pipeline uses OpenAI. AI-generated material can reproduce or reveal information from Input; review the entire game and its metadata before publishing.

Our generation code disables ordinary Responses API response storage, but that setting is not a promise of zero retention. OpenAI’s data-control documentation describes separate abuse-monitoring and feature-specific retention, including exceptions. OpenAI states that API data is not used to train its models by default unless the customer opts in.

6. Public, private, and PIN-protected content

New games created by the current generation flow are initially private. When you make a game public, its playable content, packaged assets, title, description, and thumbnail can become accessible to visitors and may appear in the public arcade and homepage examples. Public pages may be indexed or copied by others. Avoid publishing personal information you do not intend to disclose.

A private setting restricts ordinary public access to the game; it does not prevent processing by us and service providers necessary to operate the Service. A public game protected by a PIN may still expose its title, description, and thumbnail in public listings. Anyone with permitted access may record or copy what they see. Changing a game’s visibility does not remove third-party copies, search-engine caches, or prior downloads. Archiving changes availability rather than permanently erasing the stored game.

The public listing API does not intentionally expose private prompts, account identifiers, uploaded reference originals, or internal generation logs. Information incorporated into a published game or thumbnail can nonetheless become public as part of that content.

7. Disclosures and service providers

We disclose information to providers that support authentication, AI processing, hosting, storage, content delivery, security, and other necessary operations, subject to the applicable arrangements and their roles. Firebase’s processing is described in Google’s Firebase privacy and security documentation. Some providers process service data independently under their own terms and notices.

We disclose content to other people when you instruct us to publish or share it. We may disclose information to professional advisers under appropriate confidentiality obligations, where reasonably necessary to comply with law or valid legal process, protect rights or safety, investigate misuse, or resolve disputes. We may disclose limited information to parties evaluating or completing a merger, financing, acquisition, or business transfer, subject to applicable safeguards and notice requirements. We may also disclose information with your specific direction or consent.

We do not sell personal information for cross-context behavioral advertising. This does not prevent the service-provider disclosures or public sharing described above.

8. Cookies, browser storage, and tracking choices

Essential storage supports sign-in, security, session continuity, and features you request. Browser controls can block or clear cookies and local storage, although doing so may prevent sign-in, remove drafts, or disrupt game progress. Signing out does not necessarily erase locally stored material; clear the relevant browser data when using a shared device.

The website does not implement a separate change in behavior in response to the older “Do Not Track” browser signal. A Global Privacy Control or other legally recognized opt-out signal is a different mechanism; where applicable law requires us to honor it for a processing activity, we must implement that requirement.

Optional analytics or advertising technologies, if introduced, require an updated disclosure and any consent or opt-out mechanism required in the affected locations. A browser-level setting does not withdraw a permission independently granted to a third-party account provider.

9. Retention, deletion, and backups

We retain personal information for the period reasonably necessary for the disclosed purpose, considering account status, whether content remains hosted, support and security needs, applicable legal requirements, and the establishment or defense of legal claims. Different records have different purposes: drafts support continued editing; generated games support hosting; queued requests and checkpoints support completion and recovery; logs support diagnostics and abuse investigation; and contact records support handling and documenting requests.

The current application does not implement a uniform automatic deletion schedule for all of these categories. Archiving a game or signing out does not permanently delete those records.

You may request account or content deletion through the contact channel. We will assess and respond in accordance with applicable law, including lawful exceptions. Deletion may require coordination with relevant providers. Where retained backup copies cannot immediately be selectively erased, access and use must remain limited to the permitted backup purpose and deletion must be addressed through the applicable backup retention process. We do not promise immediate deletion from every backup or removal of independent third-party copies.

10. Regional legal bases and privacy rights

Where European or UK data-protection law applies, processing necessary to provide a service you request may rely on performance of a contract; security, fraud prevention, and proportionate service administration may rely on legitimate interests subject to required balancing; legal compliance may rely on legal obligations; and optional processing may require consent.

Depending on applicable law, you may request access, correction, deletion, a portable copy, restriction of processing, or objection to certain processing. You may withdraw consent for consent-based processing without affecting prior lawful processing, and may complain to a competent supervisory authority. Additional rights concerning significant automated decisions apply where the relevant legal conditions are met; the game-generation feature does not itself decide legal eligibility for employment, credit, housing, or similar matters.

Applicable U.S. state laws may also provide rights to know or access collected information, correct inaccuracies, obtain a copy, delete information, opt out of specified sale, targeted advertising, or qualifying profiling, and appeal a denied request. These rights depend on the law’s applicability and exceptions. We will not unlawfully discriminate against you for exercising them. This Policy does not claim that every state privacy statute applies to this business.

11. Submitting a privacy request

Use the contact details below, identify the request, and provide the account email or other information reasonably necessary to locate the relevant records. Do not send passwords or unnecessary identity documents. We may verify identity in proportion to the request and the sensitivity of the information, and may require appropriate evidence of an authorized agent’s authority. If we cannot verify a request, we will explain the available next steps to the extent required by law.

We will respond within applicable statutory periods and explain permitted extensions or reasons for denial where required. If a right of appeal applies, you may request review through the same contact channel, clearly identifying the earlier decision. An individual whose information appears in another user’s content may report it without owning an Arcade Czar account. A privacy request does not automatically establish ownership of disputed content, and some information may need to be retained for another person’s rights, legal obligations, or a lawful dispute process.

12. Children and information about other people

The Service is intended for users aged 13 and older, subject to any higher minimum age required by applicable law. Users under 18 or below the age of majority where they live must have a parent or legal guardian’s permission and supervision. The Service is not intended for children under 13 to create accounts or submit personal information.

If you believe a child under 13 has provided personal information, or a minor has submitted information without necessary authorization, email czar@czarcade.com with enough information to locate the account or content. We will investigate and take appropriate action under applicable law, including deleting information or restricting access where required. Do not include unnecessary information about the child in your initial report.

Users who submit images or information about others must have appropriate authority. Avoid uploading sensitive information or children’s photographs when unnecessary. Eligible minors may request removal of content they posted by identifying the content and their account through the same email address. Removal from the Service cannot guarantee removal of copies obtained by other people, and legally permitted retention exceptions may apply.

13. International processing and security

The Service and its providers may process information in countries other than where you live.

We use account authentication and access restrictions in the application and maintain operational measures intended to protect information. Security measures must be proportionate to the information and risks involved. No internet service is immune from unauthorized access, loss, or misuse. This statement does not limit duties or liability imposed by applicable law. Please report suspected security incidents without including unnecessary sensitive information in an initial message.

14. Changes to this Policy

We may update this Policy as the Service, processing practices, or applicable requirements change. The revised Policy will show its effective date. For a material change, we will provide additional notice where required and obtain consent where necessary before using previously collected information for a materially different purpose. An updated notice does not itself authorize processing that otherwise requires consent or another lawful basis.

15. Contact

Young Human LLC operates Arcade Czar from California, United States. For privacy questions, access or deletion requests, content-removal requests, or complaints, email czar@czarcade.com. Include “Privacy request” and your account email when relevant. For concerns about a game, include its URL. You may also use our contact form.