Privacy Policy
Last updated: 2026-07-13
Who we are
Data controller: KCSWH, contact@kcswh.pl. This policy covers the Arcade Hub portal, its games, XP system, and optional Supabase-backed user accounts.
What data we collect
- Email address for account login and communications.
- Password hash stored only by Supabase; we never store raw passwords.
- Session tokens and authentication cookies issued by Supabase.
- Account metadata such as display name and avatar initials.
- Public-profile data: a generated or customized handle, display name, optional bio, and avatar identity.
- XP and game progress tied to your user ID for cloud sync.
- Security and activity logs (e.g., sign-in events, error diagnostics).
- Consent and analytics data when you opt in via the consent manager.
Purposes and legal bases
- Account creation, authentication, and email verification – Art. 6(1)(b) GDPR (contract).
- XP cloud sync and account management – Art. 6(1)(b) GDPR.
- Security, fraud prevention, service integrity – Art. 6(1)(f) GDPR (legitimate interest).
- Compliance with legal obligations (e.g., security logging) – Art. 6(1)(c) GDPR.
- Analytics and optional measurements – Art. 6(1)(a) GDPR (consent via the consent manager).
How we use your data
- Provide and secure your account, including sign-in, sign-out, and session management.
- Sync XP, achievements, and game progress across devices.
- Send verification emails and required service notices.
- Maintain security logs, detect abuse, and protect against fraud or cheating.
- Run analytics only after you consent to statistics cookies.
Public gaming profiles
Each authenticated Arcade Hub account receives a public gaming profile. Anyone who knows its URL can view the profile handle, display name, optional bio, avatar, current total XP, and level. Your email address, Supabase user ID, chip balance, ledger, poker data, session data, detailed XP records, daily or weekly XP gains, and private account metadata are not displayed on the public profile.
Default avatars are generated identity visuals. Uploaded avatars are processed into a public profile image; original uploads remain private and temporary.
Public XP leaderboard
Authenticated accounts are included in the public XP leaderboard by default. Leaderboard entries may show rank, profile handle, display name, avatar, XP for the selected period (today, this week, or all time), level, and a link to the public profile. Guest players are not included. The leaderboard does not display email addresses, Supabase user IDs, chip balances, ledger or poker data, session data, or detailed XP events.
You can hide your account from the leaderboard in Settings. This removes it from leaderboard results and rank calculations, but does not make the public profile at /u/<handle> private.
Data processing & Supabase notice
We use Supabase (Supabase Inc., 970 Toa Payoh North #07-04, Singapore; infrastructure in the EU and USA) as our data processor for authentication, database storage, and email verification. Supabase processes email, password hash, session tokens, account metadata, and XP records on our behalf. Data may be transferred to the USA; Supabase applies Standard Contractual Clauses (SCCs) and the safeguards described in their Data Processing Agreement. Supabase stores backups according to its retention policy and secures data with encryption in transit and at rest.
Third-party games and iframes
Some games may be loaded from external providers in iframes. These partners may act as independent controllers for their services and may process data in line with their own terms and privacy policies. When you use such games, please review the notices or links presented with them to understand how your data may be processed.
Cookies and similar technologies
- Authentication cookies from Supabase are strictly necessary and cannot be turned off without disabling sign-in.
- Preferences and consent cookies store your consent manager choices.
- Analytics cookies (e.g., Google Analytics) load only after you provide consent through the consent manager.
- You can revisit choices anytime via the Manage cookies control.
Data retention
- Account data (email, metadata, XP, and public-profile data) is retained until you delete your account or request removal.
- Security and diagnostic logs are kept for approximately 30–90 days unless required longer for safety or legal reasons.
- Backups are retained per Supabase’s backup schedules.
International transfers
Supabase and other providers may process data outside your country, including in the USA. Transfers rely on SCCs and comparable safeguards.
Your rights
You can request access, rectification, deletion, restriction, portability, or objection to processing. You may withdraw consent for analytics at any time via the consent manager. To exercise rights, email contact@kcswh.pl. You may lodge a complaint with the Polish Data Protection Authority (UODO).
Account deletion
You can request deletion by emailing contact@kcswh.pl. Automated in-app deletion is planned; until then, we will process requests manually and remove associated XP records, sessions, and metadata where legally permissible.
Security
We apply industry-standard measures, use Supabase’s managed security controls, and limit access to personal data. No system is perfectly secure; please keep your device and credentials safe.
Links and related terms
See our Terms of Service and Cookies Notice for more details on service rules and cookie choices.
Changes
We may update this policy. Material changes will be posted here with an updated date.