Effective Date: September 24, 2026
Last Updated: September 24, 2026
Controller / Operator: Exotec Inc. ("FriendArcade," "we," "us," or "our"), a company organized under the laws of Delaware, operating the FriendArcade service at https://friendarcade.ai and related hosts (including create.friendarcade.ai, sfx-identity.friendarcade.ai, and friendarcade.games when applicable).
Privacy / Support Contact: hello@friendarcade.ai
Security reports (when published): /.well-known/security.txt (contact should match or cross-reference this Policy)
DMCA / Copyright Agent: FriendArcade Copyright Agent — hello@friendarcade.ai — 1606 N. Hale Ave, Fullerton, CA 92831, United States
1. Scope and acceptance
This Privacy Policy explains how we collect, use, disclose, retain, and protect personal information when you visit or use FriendArcade websites, apps, APIs, waitlists, authentication flows, game creation and play features, friend/invite features, and related services that link to this Policy (collectively, the "Services").
By using the Services, you acknowledge this Policy. If you do not agree, do not use the Services. If this Policy conflicts with our Terms of Service, the Terms control to the extent of the conflict, except where privacy law requires otherwise.
We may update this Policy by posting a revised version and updating the "Last Updated" date. Where required by law, we will provide additional notice or seek consent.
2. Who we are and what FriendArcade does
FriendArcade is a social arcade / AI-assisted game maker. You can describe game ideas (including by voice), generate and refine playable games, browse and play games, connect with friends, use invite / friend codes, join a waitlist, and (when available) manage a credits ledger ("Top up Credits" marked SOON). Some signup flows may be invite-only. Contact: hello@friendarcade.ai.
3. Information we collect
3.1 Information you provide
| Category | Examples |
|---|---|
| Waitlist | Name and email address submitted via the waitlist form |
| Account / profile | Username; Google account email and basic profile obtained via Google OAuth (through Supabase); account tier; accepted Terms version and timestamp; invite / friend codes you enter or share |
| User Content (UGC) | Game prompts, generated or uploaded assets, game configurations, titles/descriptions, and other content you create or submit |
| Speech / microphone | If you use speech-to-text on the homepage or elsewhere, audio captured via your device microphone and resulting transcripts (Permissions-Policy may allow microphone=(self) for this purpose) |
| Communications | Messages you send to hello@friendarcade.ai or other support channels |
| Credits / ledger | Credit balances, grant/spend events, and purchase identifiers, amounts, currency, payment status, and billing metadata from our payment processor when checkout is enabled |
3.2 Information collected automatically
| Category | Examples |
|---|---|
| Device / network | IP address, browser type, device/OS characteristics, approximate location derived from IP; if we offer a mobile app in the future, device identifiers where the operating system permits |
| Usage / play telemetry | Pages viewed, feature usage, session timing, error/performance logs, creation and play telemetry used to operate and improve games and AI features |
| Cookies & similar tech | See Section 5 (including Google Analytics) |
| Guest / design session | A path-scoped guest design cookie (e.g., fa_design_guest) may be set when you interact with design APIs without a full account |
| Security / anti-abuse | Signals used to protect accounts and forms (e.g., waitlist honeypot fields); we do not ask you to submit secrets in those fields |
3.3 Information from third parties
- Google (OAuth): when you sign in with Google, we receive account identifiers and profile fields Google permits (typically email and basic profile).
- Supabase: authentication and backend data storage for accounts and product data.
- Analytics / infrastructure providers: as described in Section 7 (subprocessors).
- Public / social sources: information you choose to share when interacting with us on platforms such as Instagram, X, or Discord.
We do not intentionally collect sensitive categories such as government ID numbers, precise geolocation, health data, or payment card PAN through current product surfaces. When checkout is enabled, card details are collected and processed by Stripe under its own terms; FriendArcade does not store full card numbers.
4. How we use information (purposes)
We use personal information to:
- Operate the Services — create accounts, authenticate via Google OAuth, process invite/friend codes, host and run games, provide speech-to-text, maintain credits ledgers, and respond to support.
- Security and integrity — detect fraud, abuse, spam, and unauthorized access; enforce Terms; protect users and FriendArcade.
- Improve the product — debug, analytics, UX research, feature development, and play and creation data to improve games and AI systems.
- Communicate — service notices, waitlist updates, and (where permitted) product updates; you may opt out of non-essential marketing emails.
- Legal compliance — comply with law, respond to lawful requests, and establish/exercise/defend legal claims.
- Content moderation — review reports, enforce Community Guidelines, and remove or restrict unsafe or illegal User Content (including AI-generated games).
- AI / model improvement — train, fine-tune, and evaluate FriendArcade's models and systems using prompts, games, gameplay, and related content (see Section 6).
We do not sell your personal information for money. We may share identifiers and usage data with advertising and analytics partners as described in Section 5, which may count as "sharing" under California law; Section 12 explains how to opt out.
5. Cookies, analytics, and similar technologies
5.1 What we use today
- Google Analytics measurement ID G-LLFLN6FHE9 may load and set cookies and collect identifiers and usage data for measurement and advertising features.
- Advertising partners may set cookies, pixels, and similar identifiers to measure our marketing and show you FriendArcade ads on other sites and apps.
- Google Fonts may be loaded from Google servers.
- First-party / session cookies may be set for authentication (via Supabase/Google OAuth) and product features (including guest design session cookies).
- Cloudflare may set security/performance cookies as part of CDN/WAF operation.
5.2 Advertising, analytics, and your choices
We work with analytics and advertising partners that may use cookies, pixels, device identifiers, and similar technologies to measure how the Services are used, understand which games and features are popular, and show you FriendArcade advertising on other websites and apps based on your activity here. Where your device settings allow, we may also share device identifiers and app usage information with partners to promote the Services and reach new users.
FriendArcade does not currently display a cookie banner. You can control cookies through your browser settings; blocking them may break sign-in or product features. To opt out of interest-based advertising by companies that participate in the Digital Advertising Alliance, visit optout.aboutads.info; for the Network Advertising Initiative, visit optout.networkadvertising.org; on mobile devices, use your operating system's advertising settings. The advertising sharing described above is not active today, so there is nothing to opt out of yet; once it is, we will treat Global Privacy Control signals as an opt-out from sale or sharing where applicable law requires it and say so here. The Services do not respond to browser "Do Not Track" signals, which have no common standard.
Chat / public feed: FriendArcade is friends-first (share links, invite circles). We do not currently operate a public chat feed; if we add messaging or public social surfaces, we may monitor and retain those communications for safety and will update this Policy.
6. Artificial intelligence and training data
- Operate and improve the Services. We use personal information and product telemetry to provide, secure, debug, and improve FriendArcade features.
- Model training. We use prompts, games and other User Content, speech transcripts, gameplay and creation telemetry, and related signals to train, fine-tune, evaluate, and improve FriendArcade's models, safety systems, and game quality, and to develop new products and features. We do not offer a product-level opt-out from this use; if you do not want your content used this way, do not submit it to the Services. Where the law gives you a right to object to or restrict this processing, Section 12 explains how to exercise it.
- Deletion. Deleting content or your account stops future training use of that content. Material already incorporated into trained models or anonymized, aggregated datasets cannot be removed from them.
- No sale of identifiable datasets. We do not sell your personal information for money, and we do not license identifiable User Content datasets to unrelated third-party AI labs.
Generative AI outputs are probabilistic and may be inaccurate or unexpected; see the Terms of Service for related disclaimers.
7. How we share information (subprocessors and others)
We share information with service providers who process it on our behalf under contractual obligations, and in limited other cases:
7.1 Subprocessors visible from public product configuration
| Provider | Role (as observed / intended) |
|---|---|
| Cloudflare | CDN, DNS, security / edge |
Analytics (GA G-LLFLN6FHE9); OAuth sign-in; Fonts; Workspace email (MX for @friendarcade.ai) | |
| Supabase | Auth and backend (unkntjwbhwhhjvigamzi.supabase.co) |
| Stripe | Hosted credit-pack checkout, payment verification, and transaction processing when checkout is enabled |
Each of these providers processes personal information under its standard data processing terms.
To generate game content, we also send prompts and related material to AI model providers, currently OpenAI, Anthropic, and Google (Gemini) for game code and text, and specialized providers for image, animation, and 3D model generation, each under its own API terms. We send the content needed to fulfil your request, not your name or email address. We will update this list when providers change.
7.2 Other disclosures
- Advertising partners: identifiers and usage data for the advertising purposes described in Section 5.
- Legal / safety: to comply with law, or to protect rights, safety, and security.
- Professional advisors: lawyers, auditors, and insurers as needed.
- Affiliates: current or future parents, subsidiaries, and companies under common control, for the purposes in Section 4.
- Corporate transactions: merger, acquisition, financing, or asset sale.
- With your direction: e.g., sharing a game link with friends.
- Aggregated / de-identified data: for analytics, research, and product improvement as described above.
We do not sell personal information for money. Content you choose to share via links or friend features may be visible to recipients.
8. Retention
We retain personal information only as long as needed for the purposes above, including:
| Data type | Typical retention approach |
|---|---|
| Waitlist (name + email) | Until we close the waitlist process, convert you to an account, or you request deletion — unless law requires longer retention |
| Account / profile | While your account remains active and for a reasonable period afterward |
| UGC / games | While hosted on the Services and for a short period after deletion requests (to complete removals and backups) |
| Logs / security | Typically shorter rolling windows, unless needed for investigations |
| Credits / transaction records | As required for accounting and fraud prevention when payments ship |
| Anonymized / aggregated artifacts | May be retained indefinitely |
Deletion requests: email hello@friendarcade.ai from the address on your account. After verifying the request, we will delete or anonymize account-linked personal information within a reasonable time, unless we must retain information for legal, security, accounting, or dispute-resolution reasons. Backup copies may take additional time to roll off, and content already used for training is handled as described in Section 6.
9. Security
We use commercially reasonable administrative, technical, and organizational measures (including HTTPS, provider access controls, and Cloudflare edge protections). No method of transmission or storage is 100% secure. Report suspected security issues to hello@friendarcade.ai (and, when published, via /.well-known/security.txt — contact should be consistent with this Policy).
10. Children's privacy
The Services are directed to users 13 years of age or older (or the minimum digital-consent age in your country, if higher). We do not knowingly collect personal information from children under 13 (COPPA).
Invite codes and parental responsibility: FriendArcade may use invite-only signup. Invite codes can still be shared with minors. If you are a parent or guardian, you are responsible for supervising any use by a minor who meets the age minimum, and for ensuring under-13 users do not create accounts or submit personal information. If you believe we have collected information from a child under 13, contact hello@friendarcade.ai and we will take appropriate steps to delete it.
FriendArcade does not offer a classroom or school program for users under 13.
11. International transfers
FriendArcade is operated from the United States. Personal information may be processed in the U.S. and other countries where we or our subprocessors operate. Those countries may have different data-protection laws than your home country. Where required, we rely on appropriate transfer mechanisms, such as Standard Contractual Clauses.
12. Your privacy rights
12.1 California / CPRA (and similar U.S. state laws)
Depending on your state of residence, you may have rights to:
- Know / access categories and specific pieces of personal information collected;
- Delete personal information (subject to exceptions);
- Correct inaccurate personal information;
- Opt out of "sale" or "sharing" of personal information (including certain advertising uses), if applicable;
- Limit use of sensitive personal information, if applicable;
- Non-discrimination for exercising rights.
Categories collected (summary): identifiers (name, email, username, IP); internet/electronic activity (analytics, usage); audio (if mic used); commercial information related to credits when paid features ship; inferences limited to product improvement.
To exercise rights, email hello@friendarcade.ai. We may verify your identity. An authorized agent may submit a request on your behalf where the law allows; we may ask for proof of the agent's authority and confirm the request with you directly.
"Do Not Sell or Share": We do not sell personal information for money. We may in the future share identifiers and usage data with advertising partners for cross-context behavioral advertising; we do not do so today. Before we start, we will add an opt-out link here, honor Global Privacy Control signals, and accept requests by email to hello@friendarcade.ai with the subject "Do Not Sell or Share." You can already limit interest-based advertising through the Digital Advertising Alliance tool at optout.aboutads.info and your device's advertising settings.
12.2 GDPR / UK GDPR-style rights (EEA, UK, Switzerland)
Where FriendArcade is a controller, you may have rights of access, rectification, erasure, restriction, portability, and objection (including to processing based on legitimate interests), and the right to withdraw consent where processing is consent-based.
Typical legal bases we rely on:
- Contract — providing the Services you request;
- Legitimate interests — security, product improvement, analytics, advertising measurement, and model training;
- Consent — non-essential cookies and marketing where required;
- Legal obligation — compliance.
Contact hello@friendarcade.ai. You may also lodge a complaint with your local supervisory authority.
13. Third-party links and services
The Services may link to third-party sites or rely on third-party auth/analytics. Their privacy practices are governed by their own policies (e.g., Google, Supabase, Cloudflare).
14. Changes
We will post updates to this page. Material changes may require additional notice or consent where required by law.
15. Contact
Email: hello@friendarcade.ai
For privacy requests, include enough detail for us to locate your account or waitlist entry (e.g., Google account email / username).