Privacy

SagaForge Arcade is operated by Secret Castle Games Inc., a company incorporated under the laws of British Columbia, Canada. For privacy questions or requests, email support@secretcastlegames.com or use our Contact page.

We store an internal account identifier, display name, linked sign-in methods, account status and sign-in timestamps to recognize you and protect your account.

If you choose Google sign-in, we use Google’s stable account identifier. Our Google sign-in does not request your name or email address. If X sign-in is offered, we use its account identifier too, not your posts as Arcade profile data. Your sign-in provider also handles its part of the sign-in under its own privacy policy.

If you sign up with email or add an email sign-in method, we store an encrypted copy of the address and a protected lookup value. Passwords are stored as hashes, not plain text. We use the address for account confirmation, recovery and security messages, sent through our email delivery provider.

The __Host-sf_session cookie keeps you signed in. It can last up to 180 days, unless you sign out or the session is revoked earlier. The short-lived __Host-sf_oauth cookie carries sign-in or account-linking state for up to ten minutes. These are functional cookies, not advertising cookies. Blocking them can prevent sign-in.

When you open a checkout to buy Sparks, Stripe’s checkout loads on the page and sets its own cookies for fraud prevention and payment security: __stripe_mid lasts one year, __stripe_sid lasts 30 minutes, and m lasts two years. Stripe’s privacy policy covers them.

When a form uses Turnstile, our hosting provider’s human-verification challenge, that provider handles browser and network signals. We send the challenge response and your IP address to that provider to verify it. We also use protected, keyed hashes of IP addresses and sign-in identifiers for local attempt limits, rather than storing raw IP addresses in those rate-limit records.

Our hosting and security providers receive the network and request information needed to deliver pages and protect the service. This is separate from the cookieless page analytics described below.

We keep wallet balances and an account-linked ledger of Sparks credits, spends, reversals and refunds. Purchase and delivery records identify the game, item, amount, order, outcome and timing. When you confirm a purchase for a site, its Sparks are first held: the hold record names the site, the item, the Sparks held, the identifier that site knows you by, and when the hold was placed and later spent or given back. Entitlement records say which unlocks an account owns. Promo redemption records connect an account to a code’s redemption and credit status so limits and credits work correctly.

Stripe processes payments for Sparks packs and handles your card details. The Arcade keeps payment ids, payment-provider references, amounts, currency and status, never card data. Stripe handles its payment processing under its privacy policy.

We use these records to run the wallet, deliver purchases, settle holds, resolve pending orders and refunds, and prevent fraud or repeated redemptions.

When you play signed in, a game can receive a stable player identifier that is different for each game, your public Arcade display name, and a signed player token that lasts up to ten minutes. The game can use these to recognize its player and check permitted game services. The token does not contain your Arcade email address, underlying account ID or sign-in cookie. When you let a game’s own site connect to your Arcade account, that site gets a connection that lasts up to 12 hours. While you are signed in to the Arcade and have not disconnected the game, its site can renew the connection without asking you again; disconnecting it from your account page ends the connection, and the game must ask you again before it can reconnect.

Buying an item also shares the order and delivery information that game needs to fulfil it. Confirming a purchase for a site lets that site see the hold: the item, the Sparks held, how long they stay held and the identifier the site knows you by. If you let a site ask you to review purchases, it can also see your Sparks balance. The Arcade does not send your password or sign-in session to the game. A game can collect its own gameplay, saved-progress or other data as described in its own notices; deleting an Arcade account does not automatically delete a game’s stored data.

When you ask us to email you about a game before it is playable, we store that email address, encrypted, and the games you chose. No account is created, and we use the address only to email you about those games.

We keep your address for as long as you are on a game’s list, until you unsubscribe or delete it. After you unsubscribe we keep the record that you signed up, with your address, for 90 days as proof, then delete both. “Delete my email address” removes them at once.

We do not share this list. Each signup starts with a confirmation email, and every email we send about a game carries an unsubscribe link. That link’s page takes you off the game’s list, and its “Delete my email address” deletes the address with everything stored beside it. If a link stops working, email support@secretcastlegames.com for a fresh one.

Arcade pages include our hosting provider’s cookieless page analytics. It measures visits, page views and loading performance, with broad details such as country, referring site, browser and device type. It reports page paths, not URL query strings.

The analytics does not use cookies or local storage, does not fingerprint visitors, and does not track individual visitors across other sites. Its purpose here is understanding page use and performance, not advertising profiles.

The provider makes reports available for the previous six months. That is a reporting window, not a promise that every provider-held record is deleted after six months.

We use hosting, database, asset-storage, security and email-delivery providers to operate the Arcade; a sign-in provider when you choose it; and the game you play for its player connection and deliveries. They receive the information needed for those functions. If you contact support, we receive the information you choose to send and use it to handle your request.

We may also disclose information when legally required or necessary to address fraud, security threats or the rights of players and others. The Arcade does not sell account information or use it for targeted advertising.

Using these providers can involve processing outside your province or country, where privacy laws may differ. The operator is a Canadian company; the service is not a promise that every record stays in Canada.

Account and sign-in information stays while the account exists. Expired sessions, email-action tokens and sign-in-attempt records are removed in scheduled batches, so expiry and physical deletion need not happen at the same instant. The local attempt-limit window is one hour; email-action links have their own short validity windows.

Wallet and transaction records, including purchases, holds, delivery history, entitlements and promo redemptions, are retained as ongoing accounting, fulfilment and fraud-prevention records. They remain linked to an internal account identifier after sign-in-account deletion.

A purchase record keeps the amounts and their currency, the invoice number and invoice id, the tax lines, and the payment’s dates and reference. Canadian tax law requires these sales records to be kept for at least six years, and there is no scheduled deletion period for them.

Provider-held operational records and information held by games have their own retention rules. The Arcade’s account-deletion control does not delete those records.

You can manage sign-in methods and delete your sign-in account from your account page after a recent sign-in. Deletion removes the account profile, linked identities, stored email and password record, account email-action tokens and sign-in sessions. It also removes the address a receipt was emailed to and the receipt’s links. It does not erase the transaction records described above or restore access to the old wallet.

To request access, correction or deletion, or if you cannot use the account controls, email support@secretcastlegames.com. Depending on where you live, you may have additional privacy rights or the right to complain to a privacy regulator. We may need to verify that a request concerns your account, and explain any records we must keep. Do not send passwords, sign-in links or player tokens.

The Arcade is for people aged 13 and up; individual games may have higher age ratings. We do not intend to collect account information from children under 13. If you believe a child under 13 has provided information, contact us so we can address it.

We will update this page when our practices change, show the update date, and give reasonable notice of material changes. You can reach us with privacy questions at support@secretcastlegames.com.