PRIVACY POLICY

Gems Arcadia ("we", "us") runs the online arcade at https://gemsarcadia.com. We are the responsible party for your personal information under the Protection of Personal Information Act 4 of 2013 (POPIA). We are established in South Africa.

This notice covers players and game developers who use the website. It does not cover the websites of the payment, video or other services we link to; they have their own privacy notices.

We collect only what the arcade needs to work. Most of it comes from you directly or from your use of the site. Your sign-in details come from Auth4.dev, and payment confirmations come from Paystack.

ACCOUNT

• Your Auth4.dev account ID, email address, whether your email is verified, your name and profile picture link (if your sign-in account has one).
• Your role on the site (player, developer or admin) and when your account was created.

GAMER PROFILE

• Your @handle, display name, bio, chosen pixel-art avatar, favourite genres from the welcome tour, and equipped cosmetics.
• Your XP, level, daily login streak and whether you have finished the welcome tour.
• Your settings: sound preferences you save to your account, notification email choices, and whether you appear in the public activity ticker.

GAMEPLAY

• Game sessions (which game, when it started and ended) and each coin you insert.
• High scores and the three-letter initials you enter with them.
• Achievements, Prize Ticket earnings and spending, Prize Counter items, daily prize wheel spins, and challenge entries and results.
• Games you favourite, players and studios you follow, reviews and star ratings you write, helpful votes, review reports, and in-site notifications.
• Activity ticker highlights about you (for example a new level or a top-ten score).

WALLET AND PURCHASES

• Your coin ledger: every coin credited or spent, and why.
• Purchase records: the coin pack, amount and currency charged, status, and the Paystack transaction reference.
• We never see or store your card number or other card details. You enter those on Paystack's checkout page.

GAME DEVELOPERS

• Studio name, studio page address, bio and website, the games and builds you upload, and your earnings records.
• API keys, which we store only as a one-way (SHA-256) fingerprint, never in readable form.

TECHNICAL INFORMATION

• When you visit, Cloudflare handles your IP address, browser details and the pages you request so it can deliver and protect the site. Our hosting logs record requests and error messages.
• We don't store your IP address, device details, location or date of birth in our database, and we don't use third-party analytics or advertising trackers. The play statistics developers see are counted from our own database.

MUST YOU GIVE IT TO US?

You can browse the arcade without an account. To play, you need an account, and an account needs a verified email address; without one we can't create your account or keep your coins safe. Profile details such as a handle, bio and avatar are optional. To buy coins, Paystack needs your payment details.

POPIA (section 11) only lets us process your information when we have a lawful reason. Here is each purpose and the reason we rely on.

• Creating and securing your account, signing you in and keeping you signed in: needed to provide the service you asked for (performing our agreement with you).
• Running your wallet, selling coin packs, inserting coins and sending purchase receipts: performing our agreement with you.
• Keeping purchase and ledger records: complying with tax and accounting law.
• Running gameplay, scores, leaderboards, achievements, Prize Tickets, the Prize Counter, the daily wheel, challenges, reviews, follows and your gamer profile: performing our agreement with you.
• Showing your highlights in the public activity ticker: our legitimate interest in a lively arcade. You can switch this off in your settings at any time.
• Optional notification emails: your consent, which you give and withdraw in your settings.
• Paying developers their share of coin value and showing them play statistics: performing our agreements with developers, using pseudonymous data only (see “What game developers receive”).
• Preventing fraud, cheating and abuse, moderating reviews, and keeping the site secure: our legitimate interest in a safe, fair arcade, and protecting your interests.

We don't sell your personal information, we don't use it for advertising, and we don't send marketing emails. We don't make decisions about you based solely on automated processing that have legal or similarly significant effects.

These service providers process personal information on our behalf, under written terms that require them to keep it confidential and secure (POPIA sections 20 and 21):

• Auth4.dev: sign-in and account security. It checks your sign-in details and sends us your account ID, email, verification status, name and picture.
• Paystack: coin pack payments. You enter your card or other payment details on Paystack's checkout page; we send Paystack your email address, the amount and our order references.
• Cloudflare: hosting (Cloudflare Workers), network security, request logs, the database connection (Hyperdrive) and storage for game files and cover art (R2).
• Resend: sending our emails, such as your welcome email, purchase receipts and any notification emails you switch on.
• Neon: our PostgreSQL database host, which stores your account, profile, gameplay and wallet records.

We may also disclose information when the law requires it, for example to comply with a court order, or to protect players and the arcade against fraud.

Games run in a sealed-off frame and never see your account. When you play, the developer receives a pseudonymous player ID (a "playerRef"), your coin insertions, scores and session timings, and the achievements their game awards.

• A playerRef is a code we calculate from your account with a secret key. It is the same for every game from the same developer, so they can recognise a returning player, but it is different for every developer, so developers can't link you between studios.
• Developers never receive your email address, name or internal account ID from us.
• Developers can see what you choose to make public on the site, such as your reviews of their games, your @handle and display name, and the leaderboard initials you enter.

Once you pick a @handle, your gamer card is public. It shows your handle, display name, bio, avatar, level and XP, best login streak, cosmetics, top scores, favourite games and achievements. Leaderboards show your initials and scores. Reviews show your display name. The activity ticker shows highlights unless you switch it off. Follower counts are public. Don't put anything in your profile you wouldn't want other people to see.

Some of our operators store or process information outside South Africa. POPIA (section 72) allows this when the recipient is bound by law, binding corporate rules or an agreement that gives protection substantially similar to POPIA, or when the transfer is needed to perform our agreement with you. We rely on those grounds and on our operators' contractual data protection terms.

• Auth4.dev
• Paystack
• Cloudflare: Cloudflare's global network, including data centres outside South Africa
• Resend
• Neon

• Account, profile and gameplay records: while your account is open. After you ask us to delete your account, we delete or de-identify them as soon as reasonably practicable.
• Coin ledger and purchase records: for as long as South African tax and company law requires us to keep accounting records (at least five years after the transaction), even after your account is closed. The coin ledger is append-only so that every balance can be checked.
• Activity ticker highlights: deleted automatically after 30 days.
• Sign-in session: your session cookie expires after 1 day of inactivity and at most 7 days after you sign in.
• Hosting logs: kept by Cloudflare for a short period and then deleted.
• Paystack and Auth4.dev keep their own records under their own retention rules.

We use only what the arcade needs to work, so there is no cookie banner and nothing to opt into. Clearing your browser storage resets these settings.

COOKIES

• auth4_session (sometimes split into auth4_session.0, auth4_session.1 and so on): keeps you signed in. Encrypted, HttpOnly, and expires as described in “How long we keep it”.
• auth4_tx_<id>: protects a single sign-in attempt. Only sent to /auth/callback and expires after 15 minutes.
• Cloudflare may set strictly necessary security cookies to protect the site from bots and attacks.

LOCAL AND SESSION STORAGE (STAYS IN YOUR BROWSER)

• gems-arcadia:audio-settings:v1: your sound settings (mute and volume). Sound stays muted until you interact with the page.
• gems-arcadia:display-settings:v1: whether the CRT scanline effect is on.
• ga:challenge-celebrated:<challenge>: remembers that you've already seen a challenge-winner celebration.
• ga:wallet-return-to (session storage, cleared when you close the tab): the game to return to after buying coins.

Your welcome-tour progress and any sound settings you save in your profile are stored with your account, not in your browser.

VIDEO TRAILERS

Some game pages have a YouTube or Vimeo trailer. Nothing loads from YouTube or Vimeo until you press play. Once you do, that provider may set its own cookies and receive your IP address under its own privacy policy. YouTube trailers use its privacy-enhanced (youtube-nocookie.com) player.

We take reasonable technical and organisational measures to protect your information against loss, damage and unauthorised access (POPIA section 19). They include:

• HTTPS everywhere, and a strict Content Security Policy.
• Payments on Paystack's hosted checkout, so card details never reach our servers.
• Encrypted, HttpOnly session cookies.
• Games run in a sandboxed frame that can't read your cookies or account, and they reach your wallet only through our own coin API.
• Developer API keys stored only as one-way fingerprints.
• Coin changes recorded in an append-only ledger with a duplicate-protection key on every entry.
• Admin access limited to named staff accounts.

If we have reasonable grounds to believe your personal information has been accessed or acquired by an unauthorised person, we will notify the Information Regulator and you as POPIA section 22 requires.

Under POPIA you have the right to:

• ask whether we hold personal information about you, and for a copy of it (section 23);
• ask us to correct, update or delete information that is inaccurate, out of date, incomplete, excessive or unlawfully obtained, or that we no longer may keep (section 24);
• object to processing based on our legitimate interests (section 11(3));
• withdraw consent you gave, for example to notification emails, at any time, without affecting processing that already took place;
• not be subject to a decision based solely on automated processing that significantly affects you (section 71); and
• complain to the Information Regulator (see “Complaints to the Information Regulator”).

HOW TO USE THEM

You can change your profile, notification emails and activity ticker setting yourself on your settings page. There is no self-service export or account deletion yet, so for access, correction, deletion or objection requests, contact us through the Contact page at /contact from the email address on your account. We may ask you to confirm your identity before acting, and we will respond within a reasonable time. Access requests are free. Deleting your account removes your profile and gameplay data; we keep purchase and ledger records for as long as the law requires (see “How long we keep it”). Coins, Prize Tickets and wheel prizes have no cash value, so closing your account doesn't pay out any balance; check our refund policy for any refund you may be due before you ask us to delete your account.

Please contact our Information Officer first so we can try to put things right. If you aren't satisfied, you can complain to the Information Regulator (South Africa):

• Online: lodge a POPIA complaint on the eServices Portal at https://eservices.inforegulator.org.za/complaints/default.aspx
• Website: https://inforegulator.org.za
• Email: enquiries@inforegulator.org.za
• Phone: 010 023 5200 or toll-free 0800 017 160
• Address: Woodmead North Office Park, 54 Maxwell Drive, Woodmead, Johannesburg, 2191

Under POPIA, anyone under 18 is a child, and we process a child's personal information only with the consent of a competent person (such as a parent or guardian). The minimum age to create an account is set out in our Terms of Service. We don't ask for your date of birth. If you are a parent or guardian and believe your child has given us personal information without your consent, contact our Information Officer and we will delete it.

We will update this notice when what we collect, why, or who helps us changes. The date at the top shows when it was last updated. If a change significantly affects how we use your information, we will tell you by email or on the site before it takes effect.