Privacy Policy
Last updated: 2025‑05‑06
Who we are
Data controller: KCSWH, contact@kcswh.pl. This policy covers the Arcade Hub portal, its games, XP system, and optional Supabase-backed user accounts.
What data we collect
- Email address for account login and communications.
- Password hash stored only by Supabase; we never store raw passwords.
- Session tokens and authentication cookies issued by Supabase.
- Account metadata such as display name and avatar initials.
- XP and game progress tied to your user ID for cloud sync.
- Security and activity logs (e.g., sign-in events, error diagnostics).
- Consent and analytics data when you opt in via Cookiebot.
Purposes and legal bases
- Account creation, authentication, and email verification – Art. 6(1)(b) GDPR (contract).
- XP cloud sync and account management – Art. 6(1)(b) GDPR.
- Security, fraud prevention, service integrity – Art. 6(1)(f) GDPR (legitimate interest).
- Compliance with legal obligations (e.g., security logging) – Art. 6(1)(c) GDPR.
- Analytics and optional measurements – Art. 6(1)(a) GDPR (consent via Cookiebot).
How we use your data
- Provide and secure your account, including sign-in, sign-out, and session management.
- Sync XP, achievements, and game progress across devices.
- Send verification emails and required service notices.
- Maintain security logs, detect abuse, and protect against fraud or cheating.
- Run analytics only after you consent to statistics cookies.
Data processing & Supabase notice
We use Supabase (Supabase Inc., 970 Toa Payoh North #07-04, Singapore; infrastructure in the EU and USA) as our data processor for authentication, database storage, and email verification. Supabase processes email, password hash, session tokens, account metadata, and XP records on our behalf. Data may be transferred to the USA; Supabase applies Standard Contractual Clauses (SCCs) and the safeguards described in their Data Processing Agreement. Supabase stores backups according to its retention policy and secures data with encryption in transit and at rest.
Third-party games and iframes
Some games may be loaded from external providers in iframes. These partners may act as independent controllers for their services and may process data in line with their own terms and privacy policies. When you use such games, please review the notices or links presented with them to understand how your data may be processed.
Cookies and similar technologies
- Authentication cookies from Supabase are strictly necessary and cannot be turned off without disabling sign-in.
- Preferences and consent cookies store your Cookiebot choices.
- Analytics cookies (e.g., Google Analytics) load only after you provide consent through Cookiebot.
- You can revisit choices anytime via the Manage cookies control.
Data retention
- Account data (email, metadata, XP) is retained until you delete your account or request removal.
- Security and diagnostic logs are kept for approximately 30–90 days unless required longer for safety or legal reasons.
- Backups are retained per Supabase’s backup schedules.
International transfers
Supabase and other providers may process data outside your country, including in the USA. Transfers rely on SCCs and comparable safeguards.
Your rights
You can request access, rectification, deletion, restriction, portability, or objection to processing. You may withdraw consent for analytics at any time via Cookiebot. To exercise rights, email contact@kcswh.pl. You may lodge a complaint with the Polish Data Protection Authority (UODO).
Account deletion
You can request deletion by emailing contact@kcswh.pl. Automated in-app deletion is planned; until then, we will process requests manually and remove associated XP records, sessions, and metadata where legally permissible.
Security
We apply industry-standard measures, use Supabase’s managed security controls, and limit access to personal data. No system is perfectly secure; please keep your device and credentials safe.
Links and related terms
See our Terms of Service and Cookies Notice for more details on service rules and cookie choices.
Changes
We may update this policy. Material changes will be posted here with an updated date.