Privacy Policy
What Arrow Game collects when you play, why, and what you can do about it
Version 2.0 · Last updated 2026-09-03
1. Who is responsible for your data
Arrow Game is a free browser game published at https://arrow-game.fun. The operator of that site is the data controller for the personal data described in this policy, and you can reach us at support@arrow-game.fun about anything on this page, including any of the requests in section 12.
We are established in the United Kingdom, so our lead supervisory authority is the Information Commissioner's Office (ICO).
2. What this policy covers
This policy covers the personal data we process when you visit arrow-game.fun or email us. It does not cover the sites we link to; those are governed by their own policies, and the one provider that processes data for us is named in the table in section 7.
3. What we collect
The game needs no account, so there is nothing to sign up for and no profile to fill in. What reaches us is this.
Technical and security data
Your IP address, your browser and device type, the pages you request, and the time of each request. Requests reach us through Cloudflare's edge network, which processes your IP address in order to route the request, apply rate limits and block attacks. We use this data to keep the service available and secure, and to investigate abuse.
Messages you send us
If you email us, we receive your email address and the content of your message, along with anything else you choose to include.
What stays on your device
Your level and your sound setting are stored by your browser and are never sent to us. Clearing your browser data clears them.
What we do not collect
We do not buy personal data from data brokers, we do not build advertising profiles, and we do not want special category data such as data about your health, race, religion, political opinions, sex life or biometrics. Please do not send it to us.
4. Our legal bases
Under the UK GDPR we must have a legal basis for every use of your personal data. This is the pairing, use by use.
| What we do | Why | Legal basis |
|---|---|---|
| Detect and prevent abuse | To keep the service available and secure | Legitimate interests |
| Count page views and measure loading speed, with tools that store nothing on your device (Plausible, Cloudflare Web Analytics) | To see which pages are used and to keep the game fast | Legitimate interests |
| Answer the messages you send us | To deal with what you asked us about | Legitimate interests |
We rely on legitimate interests throughout, and we have considered your rights and concluded that our interest in running a secure and functioning game does not override them. You can object at any time; see section 12.
We ask for no consent, because nothing we do requires it. If that changes, this policy changes first.
7. The processors we use
These are the companies that process personal data on our behalf. Each is bound by a contract that limits it to our instructions.
| Provider | What it does for us | Data it processes | Where | Privacy policy |
|---|---|---|---|---|
| Cloudflare, Inc. | Hosting, delivery and page-speed measurement: Workers for compute, plus CDN, edge security and Web Analytics — a cookieless beacon that measures page views and loading speed without fingerprinting you | All data you send to the service, including IP addresses and request metadata | United States, with processing at edge locations worldwide | cloudflare.com/privacypolicy |
| Plausible Insights OÜ | Measuring how the site is used. Sets no cookies and stores nothing on your device, so it runs without consent on our legitimate interest — see section 2 of the Cookie Policy | Pages viewed, referrer, browser, operating system, device type and country, all aggregated without persistent identifiers | European Union | plausible.io/privacy |
8. Sharing and disclosure
We do not sell your personal data, and we do not rent or trade it. We do not share it for cross-context behavioural advertising.
Besides the processors in section 7, we disclose personal data only:
- where you ask us to;
- where we are required to by law, by a court order or by a regulator. Where we are permitted to tell you about such a request, we will;
- to protect our rights, our users or the public, for example when investigating a threat to safety;
- to a buyer, if the site is sold. You will be told before your data becomes subject to a different privacy policy.
9. Sending data outside the UK
We are based in the United Kingdom and our providers are not. Where personal data is transferred outside the UK, we rely on one of the following: an adequacy decision covering the destination country; the UK International Data Transfer Agreement; or the UK Addendum to the European Commission's standard contractual clauses, together with the safeguards our providers publish for those transfers.
10. How long we keep it
| Data | Retention |
|---|---|
| Request and security logs | 90 days |
| Email correspondence | 24 months |
Where the law requires us to keep something for longer, we keep it for that period and no longer.
11. How we protect it
Traffic between your browser and the service is encrypted with TLS. We keep the platform and its dependencies patched, and we rely on Cloudflare's edge for rate limiting and attack mitigation.
No service can promise perfect security. Please tell us at support@arrow-game.fun if you spot a security problem. If a personal data breach occurs, we notify the supervisory authority and affected users as required by law.
12. Your rights
Under the UK GDPR you have the following rights.
- Access. Ask for a copy of the personal data we hold about you.
- Rectification. Ask us to correct data that is wrong or incomplete.
- Erasure. Ask us to delete your personal data.
- Portability. Ask for the data you gave us in a structured, machine-readable format.
- Restriction. Ask us to pause processing while a dispute about accuracy or legitimate interests is resolved.
- Objection. Object to processing we base on legitimate interests, which is all of it. We will stop unless we have compelling grounds that override your rights.
- Complain. Complain to the ICO at ico.org.uk/make-a-complaint or by calling 0303 123 1113. If you are in the EEA, you can complain to the supervisory authority where you live. We would rather you came to us first so we can put it right.
To exercise any of these, email support@arrow-game.fun. We reply within 30 calendar days. If a request is unusually complex we may extend that by up to two further months, and we will tell you why within the first 30 days.
We may ask you to confirm your identity before we act, so that we do not disclose your data to someone else.
13. Children
The service is not intended for children. You must be at least 18 years old to use it, which matches section 2 of our Terms of Service. We do not knowingly collect personal data from children. If you believe a child has given us personal data, write to support@arrow-game.fun and we will delete it.
14. Cookies
The site sets a small number of cookies and none of them track you. Our Cookie Policy lists each one, what it does and how long it lasts. No analytics provider sets a cookie here, so there is no consent banner; the measurement we do use stores nothing on your device, which is why section 4 puts it on legitimate interests and section 12 gives you the right to object to it.
15. Changes to this policy
We may update this policy. The version number and date at the top of this page tell you which text is currently in force. We have no mailing list and cannot notify you individually, so please check this page if it matters to you.
16. Contact us
Write to support@arrow-game.fun. We aim to reply to every message within 3 working days, and to formal data protection requests within 30 calendar days.