Privacy Policy

Overview

AutoArcade is a browser-based gaming platform. We collect minimal data to make the platform work. We do not sell your data, run targeted ads, or share personal information with third parties.

What we collect

• Session ID — a random identifier stored in your browser's localStorage to track votes, feedback, and play sessions. This is not linked to your identity.
• Player name — optionally provided when submitting a leaderboard score or feedback. Stored as plain text.
• Game play data — score, session duration, and completion status for each play session. Used to improve games.
• Votes and feedback — your ratings and bug reports, linked to your session ID.
• Analytics — anonymized page view analytics via Vercel Analytics. Vercel processes IP addresses transiently to derive country/device info but does not store raw IPs and does not set cookies.

What we do NOT collect

• Email addresses or account information (there are no accounts)
• Cookies for tracking or advertising
• Persistent IP address logs (IPs are processed transiently for rate limiting and analytics, never stored in plain text)
• Location data beyond country-level, device fingerprints, or browsing history

Legal basis (Art. 6 GDPR)

We process the data described above on the basis of our legitimate interest (Art. 6(1)(f) GDPR) in operating, securing, and improving the platform — specifically: enabling voting and feedback without requiring accounts, preventing abuse, and improving AI-generated games based on player input. No processing relies on consent (Art. 6(1)(a)) because we do not use tracking cookies or marketing tools.

Data storage and processors

Data is stored and processed by the following services (acting as processors under Art. 28 GDPR; data processing agreements are in place):

• Supabase (PostgreSQL database, EU region: Ireland) — primary data storage
• Vercel Inc. (USA) — application hosting and analytics. Data transfers to the USA are covered by the EU-US Data Privacy Framework.
• Hostinger (EU) — VPS hosting for the AI agent worker

Third-country transfers (USA)

The following content you submit may be transferred to service providers in the USA:

• Anthropic PBC (USA) — when you submit feedback or bug reports, the text content (and game metadata) is sent to Anthropic's Claude API so the AI can triage it into actionable tasks. No session ID, IP, or player name is sent. Anthropic processes this under their commercial terms.
• Discord Inc. (USA) — feedback, bug reports, and platform events are forwarded to a Discord channel via webhook for monitoring. This may include the player name (if you provided one) and the feedback text.
• Vercel Inc. (USA) — see above.

These transfers are based on Art. 49(1)(b) GDPR (necessary for the performance of the service you requested) and, where applicable, the EU-US Data Privacy Framework. If you do not want your feedback shared with these processors, simply do not submit feedback.

Your rights (GDPR)

Since we don't collect personal data that identifies you, most GDPR rights (access, rectification, deletion) apply only to data linked to your session ID. If you clear your browser's localStorage, your session ID is gone and we have no way to link stored data back to you.

If you want your data deleted, contact us at hello@marcoschlichting.com with your session ID (found in browser DevTools under Application > Local Storage).

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). For Germany, the competent authority is the data protection commissioner of the state of North Rhine-Westphalia (LDI NRW).

AI-generated content

Games on this platform are generated by AI models. The platform itself — including its code and automation — has also been largely developed with AI assistance. Player feedback and play session data are used as input to improve games. No personal data is included in AI prompts — only aggregated statistics (average scores, session counts, etc.).

Contact

For privacy questions: hello@marcoschlichting.com