Stackade Privacy Policy

Effective date: 30 July 2026

This Privacy Policy explains what personal data Stackade (the online arcade at stackade.app) collects, why, and what rights you have. The Service is operated by Soulstack, the data controller ("we", "us", "our"). Contact us at hello@stackade.app.

1. Data we collect

- Account data. Email address, and (if you set them) a display name and an avatar image. We collect none of this until you create an account; guest play before that point stores progress locally in your browser only. - Gameplay and progress. Per-game saves, best scores, game and account XP and levels, achievements, and your coins balance and lifetime totals. - Purchases. Coin-pack purchase records. Card and billing details are collected and held by Paddle (our Merchant of Record), not by us; we receive a confirmation and a record sufficient to credit your coins and reconcile refunds. - Social graph. Who you follow, and your follower count. - Public profile. If you reserve a handle and keep your profile public, a public projection of your handle, display name, avatar, account level, selected badges, top scores, and follower count. - Technical data. Data needed to run and secure the Service, such as App Check verification and standard request metadata.

2. What is shown publicly

If your profile is public, the following are visible to other players and visitors: your handle, display name, avatar, account level, selected badges, top scores, and follower count. Your email address is never shown publicly, and neither is your coins balance, purchase history, follow list, or any other private account state. You can make your profile private at any time (see section 7), which hides the public profile and removes your public leaderboard entries.

3. How we use data and our lawful basis

- To provide the Service (run games, save progress, sync across devices, award and spend coins, show leaderboards and profiles you have chosen to make public): performance of our contract with you. - To process purchases: performance of our contract, carried out through Paddle as Merchant of Record. - To keep the Service secure and fair (anti-cheat, App Check, abuse prevention): our legitimate interests in protecting the Service and other players. - To comply with legal obligations (for example tax and accounting records held via Paddle).

4. Processors and third parties

We do not sell your personal data. We share it only with processors that help us run the Service:

- Google / Firebase (Authentication, Firestore, Hosting, Cloud Functions, Storage, App Check) - our processor for accounts, progress, profiles, and leaderboards. - Paddle.com - the Merchant of Record for purchases. Paddle is an independent controller of the payment and tax data it collects from you at checkout, under its own privacy notice.

5. Cookies and local storage

The Service uses your browser's local storage for game progress and preferences (this is how offline and guest play work), and uses the storage and cookies required for authentication and App Check. We do not use advertising cookies.

6. Retention

We keep account and gameplay data for as long as your account exists. When you delete your account, we delete your personal data within 30 days, except records we must keep for legal, tax, or fraud-prevention reasons (held primarily by Paddle as Merchant of Record for purchase records).

7. Your rights

Under UK GDPR you have the right to:

- access the personal data we hold about you; - correct inaccurate data (for example your display name); - delete your account and personal data - deletion also removes your public profile and public leaderboard entries so you no longer appear to other players. Account deletion is available from the Settings page; - object to or restrict certain processing; - port your data, where applicable; and - make your profile private at any time, which removes your public profile and leaderboard entries (enforced on our servers).

To exercise any of these, contact hello@stackade.app. You also have the right to complain to the Information Commissioner's Office (ico.org.uk).

8. Age policy

The Service is intended for users aged 13 and over. We do not knowingly collect personal data from children below this age without appropriate parental consent. If you believe a child has provided personal data without consent, contact hello@stackade.app and we will delete it.

9. International transfers

Our processors (Google / Firebase and Paddle) may process data outside the UK. Where data is transferred outside the UK it is protected by appropriate safeguards such as UK adequacy regulations or standard contractual clauses.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we make material changes, we will update the effective date and, where appropriate, notify you.

11. Contact

For privacy questions: hello@stackade.app, Soulstack, Office One, 1 Coldbath Square, Farringdon, London, EC1R 5HL, England.