Privacy Policy

Last Updated: April 28, 2026

Cookie Policy

We use browser storage to keep Couchcade working, remember your choices, and, when you choose to allow it, understand aggregate site usage.

Strictly Necessary: Required for authentication, security, guest-session persistence, account linking, and reward eligibility checks.
Preferences: Used to remember site-wide settings such as theme and your cookie consent choice.
Analytics: Vercel Analytics is loaded only after you choose Accept All in the cookie banner. Auth callback URLs are filtered before analytics events are sent.

1. Accounts & Local Data

Couchcade supports signed-in accounts and browser-locked guest accounts through Supabase Auth. We store the account identifiers, username, companion state, coins, prisms, quests, collection, inventory, event progress, and related gameplay metadata needed to operate the arcade. Guest accounts are tied to the browser session that created them and may be deleted after 7 days of inactivity. Local browser storage may keep a recent display snapshot so balances and profile data can remain visible while the app refreshes.

2. Reward Activity

To award coin drops, quest progress, claim-track rewards, and event participation, Couchcade records activity from active signed-in sessions on game and event pages. This can include game identifiers, session timing, claim timestamps, reward grants, and abuse-prevention signals. Signed-out visitors can browse games, the shop, and events, but passive coin drops and event participation are disabled until they sign in or create a guest account.

3. Vercel Analytics

If you accept analytics cookies, we use Vercel Analytics to measure aggregate site performance and page usage. Analytics events may include the page URL, referrer, device and browser details, region-level location data, and anonymous session measurements. We do not send auth callback URLs to Vercel Analytics.

4. Turnstile Protection

We use Cloudflare Turnstile on protected authentication actions, including guest account creation and signed-out magic-link requests when configured. Turnstile helps distinguish real users from automated abuse and may process security signals such as IP address, user agent, browser behavior, and challenge results. This protection is treated as strictly necessary for account security and platform integrity.

5. Magic Link Email

Magic-link and account verification emails are sent through Supabase Auth using our configured email provider. If Resend is enabled as our SMTP provider, Resend processes the email address, message content, delivery timestamps, and delivery status needed to send and troubleshoot those emails. We use these emails only for authentication and account access.

6. Public Social Data

Some gameplay-related data may be visible to other players to support profiles, leaderboards, and social features. This can include your username, companion level, total fortune, badges, and recent game activity. Avoid choosing a username that reveals personal information you do not want public.

7. Third-Party Games

Couchcade acts as a portal for various web-based games, some of which are hosted by third-party partners. When you interact with these games via an iframe, you are subject to the privacy practices of that specific provider. We do not control how these third parties collect or use data within their own game sessions.

8. Your Choices

You can reject non-essential analytics in the cookie banner. Authentication, security, reward integrity, and guest/session storage are necessary for Couchcade to operate and cannot be disabled from the banner. You can clear local browser data to remove local snapshots, but doing so may disconnect a browser-locked guest account unless it has been linked to an email or OAuth account.