Privacy Policy

Effective September 1, 2026

ArrKaboom ("ArrKaboom", "we", "us") is a browser game operated by Edward Packard, doing business as ArrKaboom, in New York, United States. This policy explains what information we collect when you play at arrkaboom.app, why we collect it, and the choices you have. Questions: support@arrkaboom.app.

The short version. You can play against a bot without giving us anything. Online rooms need an account (Google, email link, or a guest account tied to your device). Payments are handled by Stripe; we never see your card number. We keep aggregate daily counters to understand how the game is doing, with no identifiers, and we honor your browser's Do Not Track setting. We do not show ads and we do not sell your personal information.

1. Information we collect

What	When	Details
Account information	When you sign in	Google Sign-In: your name, email address and Google account identifier, provided by Google. Email link: your email address. Guest: an anonymous account identifier created by Firebase Authentication; guest accounts are tied to the device and browser you used.
Game profile and progress	While you play online	Your captain name, chosen character, games played, victory points, ships sunk, empires eliminated, defeats, saved games, subscription status, the start date of any free trial, and — if you arrived through another player's invite link — that player's account identifier, so they can earn an affiliate commission (they see counts and amounts, never your name). If you refer others we also store your chosen reward mode (Premium time or cash).
Room and match data	In online rooms	The state of each game you join — including your captain name, character, moves, trades and in-game messages — is shared in real time with the other players in that room.
Device settings	Stored in your browser	We use browser storage (localStorage) for a random device identifier that keeps your seat in a room, your language, captain name and character preferences, home-screen prompts, the link that first brought you to the game (for example "reddit"), any promo code you arrived with, and when you last visited. We do not use advertising cookies.
Usage counters	As you use the game	Aggregate daily counts — for example how many devices landed on the page, started a game, finished a game, signed up, or subscribed, and which channel they came from. These counters contain no names, identifiers or IP addresses. They are not recorded when your browser sends a Do Not Track signal.
Affiliate payouts	If you enrol in the affiliate program	Stripe collects your identity, tax and bank details directly through Stripe Connect; we never see the bank or ID details. We store your Stripe account identifier and payout status, and a ledger of commissions (amounts, dates, status, and the account identifier of the referred subscriber) so we can pay you and reverse commissions for refunds.
Payment information	When you subscribe	Payments are processed by Stripe. We receive your subscription status, a Stripe customer identifier and billing events (renewals, cancellations). We never receive or store card numbers.
Technical data	Automatically	Our service providers (Netlify for hosting and serverless functions, Google Firebase for accounts and real-time data, Google Fonts, and Cloudflare cdnjs for a graphics library) receive your IP address and standard request metadata when the game loads, and may keep short-term logs for security and operations.

2. How we use information

To run the game: keep you signed in, hold your seat in a room, sync moves between players, save your progress and unlock Premium features you have paid for or are trialling.
To bill subscriptions and honor cancellations and refunds.
To understand, in aggregate, whether the game is working and where players come from.
To keep the game safe and fair: filter offensive names, remove disruptive players, and protect our systems from abuse.
To answer your messages.

We do not use your information for advertising, we do not build profiles for marketing, and we do not sell or "share" personal information as those terms are defined in U.S. state privacy laws.

3. Who we share information with

Other players see your captain name, character and in-game actions in rooms you join, and your captain name in the public room list if you host a public game.
Service providers that process data for us: Google (Firebase Authentication, Realtime Database, Fonts), Stripe (payments, and affiliate payouts through Stripe Connect), Netlify (hosting), Cloudflare (content delivery). Each is bound by its own privacy terms and only processes data to provide its service.
Legal reasons: if required by law, or to protect the rights, safety or property of players, the public or ArrKaboom.
Business transfers: if ArrKaboom is sold or merged, your information may transfer to the new owner under this policy.

4. How long we keep it

Account and progress data stay until you delete your account or ask us to delete it. Room data for finished games is retained briefly for reconnection and then cleared. Aggregate counters contain no personal data and are kept indefinitely. Stripe retains billing records as required by financial regulations.

5. Your choices and rights

Play without an account. "Play now" (you versus a bot) and Pass & Play work without signing in.
Sign out at any time from the online menu.
Do Not Track. When your browser sends the DNT signal, no usage counters are recorded from your device.
Access, correct or delete. Email support@arrkaboom.app from the address on your account and we will export, correct or delete your data within 30 days. Deleting your account ends any active subscription.
Cancel a subscription from "Manage subscription" in the online menu (Stripe's billing portal) or by email.
State privacy rights. Residents of California, Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, New Jersey, New York and other states with privacy laws may have rights to access, delete, correct and port their data and to opt out of sales, targeted advertising and profiling. We do not sell, target-advertise or profile, but you may exercise any of these rights by email. We will not treat you differently for doing so. If we decline a request you may appeal by replying to our response.

6. Children

ArrKaboom is designed to be enjoyable for families, but accounts, online rooms and Premium subscriptions are intended for people aged 13 and older; anyone under 18 should use them with a parent or guardian's permission, and purchases must be made by an adult. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, email support@arrkaboom.app and we will delete it promptly.

7. Security

Data travels over HTTPS. Accounts are protected by Google's authentication infrastructure; database access is restricted by server-side rules so that players can only read and write their own records. Subscription status can only be set by our payment webhook, never by a player's browser. No system is perfectly secure; if we learn of a breach affecting your personal information we will notify you as required by law, including New York's SHIELD Act.

8. International players

ArrKaboom is operated from the United States and our providers store data primarily in the United States. If you play from elsewhere, your information is transferred to and processed in the U.S. under this policy.

9. Changes

We will post any changes here and update the effective date. If a change materially reduces your rights we will tell you in the game or by email before it takes effect.

10. Contact

Edward Packard, doing business as ArrKaboom · New York, USA · support@arrkaboom.app