Privacy Policy

Storage on your device

Guest Arcade records and achievements are saved in this browser. When you sign in, existing guest progress is added to your account and Arcade personal bests, milestones, completed-run history and achievement evidence sync across your devices. Unfinished games and preferences stay on this device. The offline Arcade shell and static assets are cached here. Clearing browser data removes local copies; it does not delete records already saved to your account.

On 0hero.io, Google Analytics loads through 1Consent in Advanced Consent Mode. Before consent, and after rejection, it can send cookieless measurements about visits and page use while analytics storage is denied. Analytics cookies require your permission. 1Consent records your choice; you can change or withdraw it through Cookies in the footer. On 0hero.dev, the 1Consent draft is loaded for testing, with Google Analytics data collection disabled. Local development and the separate offline shell do not load the consent or analytics scripts. Arcade works without allowing analytics cookies. Functional browser storage supports saved games, language, theme and other choices. Online sign-in uses Clerk session/security cookies and contacts hosting and sign-in services.

Accounts and online play

Clerk handles your sign-in details and credentials. Our game database stores your Clerk identifier, separate game identity, chosen Hero Name, privacy settings, friends, blocks, challenges, optional published photo URL, and completed match results and ratings. Arena sends your inputs to the authoritative game server. Passwords are not stored in the game database. Signed-in Arcade progress is also stored privately under your account to support backup and synchronization; it does not affect Arena ratings.

Support and service statistics

Signed-in support conversations store your messages, verified contact email, deliberately attached screenshots and the basic context you choose to include. Authorized staff can read these records; private staff notes are never shown to players. Screenshots are re-encoded without metadata and have no public URL. Notification emails contain a link, not the message or image. Conversations and attached images stay with your account until deletion is handled through support; abandoned uploads are removed after 24 hours. Drafts remain on this device until sent. We also record signed-in Arena lifecycle, outcomes, timing and connection counts, and activity derived from existing synced Arcade runs, for service statistics. Daily activity records are kept for 90 days; first recorded activity and match records stay with the account. Anonymous and offline Arcade play is not fully measured.

What other players can see

Your game identity, Hero Name, published photo and competitive category ratings can be public. TV spectators can see live boards, player profiles and scores. Friend presence is shared with confirmed, unblocked friends. Email addresses, Clerk identifiers and private social settings are not public profile fields. You can remove your published photo and change invitation privacy in the app.

Purposes and legal bases

We process account and game data to provide the requested online service (GDPR Article 6(1)(b)). Optional public photo publication is based on your choice and consent (Article 6(1)(a)); removing it withdraws that publication. Security, abuse prevention and preserving fair competitive records serve legitimate interests (Article 6(1)(f)). Device storage is used for the service and functions you request (§ 25(2) TDDDG).

Service providers and international processing

Cloudflare provides hosting, security, the EU-jurisdiction game database and login email delivery. Clerk provides authentication. Support email is forwarded to Gmail. Providers also process connection information such as IP addresses and request metadata. The EU database setting does not confine all hosting, authentication or email processing to the EU; processing can occur in the USA and other countries. The linked provider documents explain their transfer safeguards, including standard contractual clauses where applicable.

• 1Consent
• Cloudflare
• Clerk
• RevenueCat
• Google Analytics / Gmail

Purchase terms

If you choose Plus or restore a purchase, RevenueCat and the payment store process your game account ID, purchase receipts, subscription status and transaction information. Payment details are handled by the checkout provider, not our game database. We store verified access, credit balances, daily usage, ad attempts and transaction identifiers to deliver purchases and prevent duplicate grants. Optional rewarded ads in the native app use Google AdMob and its consent flow; Google processes ad/device and connection data according to your consent. The server verifies a signed completion containing the game account ID and a random ad-attempt ID. Arcade does not initialize billing or ads. No web rewarded ads are enabled. Financial records may be kept where legally required; account deletion does not cancel a store subscription.

Retention and deletion

Device data remains until you discard it or clear this site’s browser data. Online profile, social and match data is retained for account operation and competitive history. Contact support@0hero.dev to request removal of game data; deleting the Clerk sign-in account alone does not automatically remove game records. Historical results may need to be retained without your public name or photo to preserve opponents’ records. Operational Cloudflare logs currently remain for up to seven days; D1 recovery history can retain older data for up to 30 days. Support correspondence is retained as needed to resolve your request and meet legal obligations. Account-linked Arcade progress is retained for your account; contact us to request its removal.

Your rights

You may request access, correction, erasure, restriction or portability where applicable, withdraw consent, and object to processing based on legitimate interests. Contact support@0hero.dev; we may need to verify that the account is yours. You can also complain to a competent data protection supervisory authority.