Privacy policy
Short version: you can play without giving us anything. If you buy a Supporter pack, we keep a small record of the purchase so it can unlock on your devices.
Who we are
TinyArcadia (tinyarcadia.com) is run by Zehong Liu, who is responsible for the personal data described here (the data controller). In this policy “we” means TinyArcadia. Questions about your data: support@tinyarcadia.com.
Playing the games
You do not need an account, a name or an email address to play. Your game progress, best scores and settings are saved in your own browser (local storage) on the device you play on. They are not sent to us. Your choice of light or dark theme is stored the same way.
Buying a Supporter pack
Checkout takes place on a payment page run by Waffo Pancake, a service of Waffo.com Limited (“Waffo”), which sells the pack to you as our merchant of record. Waffo collects your payment details and email address, sends your receipt and processes this data under its own privacy policy. We never see or store your card number.
When you start a purchase, your browser creates a random unlock code. It is not linked to your name and lets you unlock the pack on other devices. After the payment, we store one purchase record in our database:
- the unlock code and the pack you bought,
- Waffo’s order number and the order status (paid or refunded),
- the email address on the order, as Waffo passes it to us,
- the date and time.
We use this record to unlock the pack, to let you restore it with your code or with your email and order number, to handle refunds and support requests, and to keep the records the law requires for sales. In your browser we keep the unlock code, a signed token that lets the pack open without waiting for our server, and, while a checkout is open, a note of which pack you are buying.
Why we may use it
We keep and use the purchase record to deliver what you bought (performance of a contract), to keep the sales records that tax and accounting rules require (a legal obligation), and to prevent fraud and handle refunds and disputes (our legitimate interest). Hosting logs are kept to run and protect the site (our legitimate interest). Support emails are used to answer you. Analytics, if we add it, will run only with your consent.
Hosting
The site, the payment server and the purchase database run on Cloudflare; the database is hosted in the United States. To deliver pages and protect the service, Cloudflare processes technical data such as your IP address and browser type in its logs. We do not use these logs to identify visitors.
Analytics and cookies
We do not use analytics or advertising, and the site sets no cookies. The local storage entries described above are needed for the games and purchases to work. If we add analytics or advertising later, it will only load after you accept it in a cookie banner, and this policy will be updated first.
Who receives data
We do not sell or rent personal data, we do not use it for advertising, and we do not “sell” or “share” it as those words are used in California law. It is shared only with the services that run the site for us: Waffo (payments, receipts, refunds) and Cloudflare (hosting and database). Email you send to support@tinyarcadia.com is delivered through Cloudflare to a mailbox hosted by Google, so Google processes those emails for us. These services may process data outside your country, including in the United States and Hong Kong.
How long we keep it
We keep purchase records for as long as the pack can be restored and, after that, for as long as tax and accounting rules require. Support emails are kept while we need them to help you. You can ask us to delete your purchase record; after that, the pack can no longer be restored on a new device.
Your rights
Depending on where you live (for example in the EU, the UK or California), you can ask to see, correct or delete your personal data, to receive a copy of it, to object to how we use it, or to withdraw a consent you gave. Write to support@tinyarcadia.com, ideally from the email address you paid with, and we will reply within one month. We will not treat you differently for using these rights. You can also complain to your local data protection authority.
Children
The games are made for a general audience, and some players may be children. The games do not ask for a name, an email address or an account, and nothing you do in a game is sent to us; progress stays in your browser. We do not knowingly collect personal data from children under 13, or under the age at which your country lets children consent on their own. Supporter packs are sold by Waffo, whose terms require buyers to be 18 or older; a child who wants a pack should ask a parent or guardian to buy it. If you believe a child has given us personal data, write to support@tinyarcadia.com and we will delete it.
Changes
If we change this policy, we will update the date at the top of this page.