Privacy Policy

Storage on your device

Guest Arcade records and achievements are saved in this browser. When you sign in, existing guest progress is added to your account and Arcade personal bests, milestones, completed-run history and achievement evidence sync across your devices. Unfinished games and preferences stay on this device. The offline Arcade shell and static assets are cached here. Clearing browser data removes local copies; it does not delete records already saved to your account.

On 0hero.io, Google Analytics loads through 1Consent in Advanced Consent Mode. Before consent, and after rejection, it can send cookieless measurements about visits and page use while analytics storage is denied. Analytics cookies require your permission. 1Consent records your choice; you can change or withdraw it through Cookies in the footer. On 0hero.dev, the 1Consent draft is loaded for testing, with Google Analytics data collection disabled. Local development and the separate offline shell do not load the consent or analytics scripts. Arcade works without allowing analytics cookies. Functional browser storage supports saved games, language, theme and other choices. Online sign-in uses Clerk session/security cookies and contacts hosting and sign-in services.

Accounts and online play

Clerk handles your sign-in details and credentials. Our game database stores your Clerk identifier, separate game identity, chosen Hero Name, privacy settings, friends, blocks, challenges, optional published photo URL, and completed match results and ratings. Arena sends your inputs to the authoritative game server. Passwords are not stored in the game database. Signed-in Arcade progress is also stored privately under your account to support backup and synchronization; it does not affect Arena ratings.

Support and service statistics

Signed-in support conversations store your messages, verified contact email, deliberately attached screenshots and the basic context you choose to include. Authorized staff can read these records; private staff notes are never shown to players. Screenshots are re-encoded without metadata and have no public URL. Notification emails contain a link, not the message or image. Conversations and attached images stay with your account until you delete the account; abandoned uploads are removed after 24 hours. Drafts remain on this device until sent. We also record signed-in Arena lifecycle, outcomes, timing and connection counts, and activity derived from existing synced Arcade runs, for service statistics. Daily activity records are kept for 90 days; first recorded activity and match records stay with the account. Anonymous and offline Arcade play is not fully measured.

What other players can see

Your game identity, Hero Name, published photo and competitive category ratings can be public. TV spectators can see live boards, player profiles and scores. Friend presence is shared with confirmed, unblocked friends. Email addresses, Clerk identifiers and private social settings are not public profile fields. You can remove your published photo and change invitation privacy in the app.

Purposes and legal bases

We process account and game data to provide the requested online service (GDPR Article 6(1)(b)). Optional public photo publication is based on your choice and consent (Article 6(1)(a)); removing it withdraws that publication. Security, abuse prevention and preserving fair competitive records serve legitimate interests (Article 6(1)(f)). Device storage is used for the service and functions you request (§ 25(2) TDDDG).

Service providers and international processing

Cloudflare provides hosting, security, the EU-jurisdiction game database and login email delivery. Clerk provides authentication. Support email is forwarded to Gmail. Providers also process connection information such as IP addresses and request metadata. The EU database setting does not confine all hosting, authentication or email processing to the EU; processing can occur in the USA and other countries. The linked provider documents explain their transfer safeguards, including standard contractual clauses where applicable. On native devices, Firebase Cloud Messaging and Apple’s push service deliver optional notifications. We associate a device registration token with your signed-in game account and send the alert text and identifiers needed to open the correct invitation or friend request. You can turn notifications off in Settings.

• 1Consent
• Cloudflare
• Clerk
• RevenueCat
• Google Analytics / Firebase / AdMob / Gmail

Purchase terms

If you choose Plus or restore a purchase, RevenueCat and the payment store process your game account ID, purchase receipts, subscription status and transaction information. Payment details are handled by the checkout provider, not our game database. We store verified access, credit balances, daily usage, ad attempts and transaction identifiers to deliver purchases and prevent duplicate grants. Optional rewarded ads in the native app use Google AdMob and its consent flow; Google processes ad/device and connection data according to your consent. The server verifies a signed completion containing the game account ID and a random ad-attempt ID. Mobile Arcade may show automatic ads between completed runs under the published pacing rules, after its consent checks. Plus and verified legacy ad-free owners are exempt; ad privacy controls remain available from Arcade. Offline play never waits for an ad. No web rewarded ads are enabled. Financial records may be kept where legally required; account deletion does not cancel a store subscription.

Retention and deletion

Delete your sign-in account, online profile, cloud progress, friends, invitations, notifications and support conversations. Local Arcade saves stay on this device. Your name and photo are removed from retained opponents’ match records. A security receipt stays for seven days; backups may retain older data for up to 30 days.

Your rights

You may request access, correction, erasure, restriction or portability where applicable, withdraw consent, and object to processing based on legitimate interests. Contact support@0hero.dev; we may need to verify that the account is yours. You can also complain to a competent data protection supervisory authority.