CyberCrew Arcade Privacy Policy

Effective Date: September 9, 2026

1. Who we are and what this policy covers

CyberCrew Studios LLC ("CyberCrew Studios," "we," "us," or "our") operates CyberCrew Arcade, including CyberCrewArcade.com, Arcade player accounts, browser games, community features, NFT ownership verification, supported external-game connections, and related services (collectively, the "Arcade").

This Privacy Policy explains what information we collect, how we use and disclose it, and the choices and rights available to you. It applies to the Arcade and to Arcade features used from supported external games, including the optional connection between an Arcade account and Quantum Frame.

This policy does not govern third-party services that have their own privacy policies, such as Epic Games, blockchain networks, wallet applications, or payment providers.

2. Information we collect

The information we collect depends on the features you use.

When you accept the Arcade Terms, we record your authenticated account identifier, the terms version and document fingerprint, the server time, and your declaration of adult eligibility and legal capacity. This is a terms-acceptance record, not consent to optional tracking or marketing, and is removed with automatic Arcade account deletion. Archived document text contains no player acceptance details.

Account and profile information

We may collect or create:

an internal Arcade player identifier;
username, display name, biography, profile visibility, and preferences;
optional email address and authentication information handled through our authentication provider;
active character selection, profile artwork, and other profile customization;
account settings, security history, and support communications.

We do not use a wallet address as the primary identifier for an Arcade player.

Birthday and age eligibility

We ask for your date of birth to determine whether you meet Arcade's minimum age of 18. The website server processes the date for this check without saving it to your Player Profile, database, application logs, or cookies. We keep the eligibility result and its issue and expiration times in an essential cookie on your browser. We also record age-check outcome events without your birthday or account details and use a temporary IP-derived identifier for request limiting. Our hosting providers process ordinary request and connection information to operate and protect the service.

Wallet and NFT information

If you connect a wallet, we may process:

public wallet address and blockchain network;
signed authentication or wallet-linking messages used to verify control of the wallet;
public NFT contract addresses, token identifiers, token standards, balances, ownership state, metadata, and media;
the time and source of ownership verification; and
ownership-refresh and security events.

We never request or collect wallet seed phrases or private keys. Normal wallet authentication does not require NFT or token-transfer approval.

Blockchain records are public and are controlled by the relevant blockchain network, not CyberCrew Studios. We cannot alter or delete information recorded on a public blockchain.

Epic Games and external-game connection information

If you choose to connect Quantum Frame or another supported game, we may process:

the verified Epic account identifier supplied in an Epic-signed identity token;
the connection between that Epic account and your internal Arcade player identifier;
short-lived, one-time pairing challenges;
connection, disconnection, entitlement-check, and security audit events; and
NFT-backed in-game entitlement keys returned to the supported game.

Epic identity tokens are used to verify the request and are not intentionally stored by Arcade. Pairing codes are short-lived, single-use, and stored only as keyed hashes. Arcade does not send the supported game your linked wallet address or complete NFT inventory as part of the entitlement response.

Gameplay and progression information

We may collect:

game participation, actions, match state, results, scores, and rankings;
player XP, level, achievements, ratings, and season history;
NFT-character XP, level, achievements, records, and ownership status;
inventory, cosmetic unlocks, virtual currency balances, and transaction ledgers;
anti-cheat, match-validation, and abuse-prevention information; and
technical data needed to maintain or reconnect an active game session.

Player progression and NFT-character progression are maintained separately. NFT-character history may remain associated with the canonical NFT identity after verified ownership changes. Persistent NFT progression is not intended to retain the identity of a former owner.

Communications and user content

If you use social or support features, we may collect:

global or match chat messages, replies, mentions, and approved GIF links;
inbox messages and issue reports;
screenshots or files you intentionally submit to support; and
content and layout information you choose to publish on a public profile or Cyberspace page.

Do not post private or sensitive information in public areas. Other users may view, copy, or redistribute information you make public.

Purchases and economy information

If paid features are enabled, we may collect purchase status, product, price, currency, order identifiers, subscription status, and the Stripe customer or transaction identifiers needed to provide the purchase. Payment-card information is entered on Stripe-hosted pages and is not received or stored by CyberCrew Arcade. Arcade may support cryptocurrency payments in the future; if enabled, relevant public blockchain transaction information may also be processed.

Technical, security, and usage information

We and our service providers may automatically process:

IP address and an irreversibly derived or keyed IP fingerprint used for rate limiting and security;
browser, operating system, device type, language, referring page, and user-agent information;
session cookies and similar technology needed to keep you signed in and protect requests;
pages viewed, feature interactions, performance measurements, and approximate traffic information;
timestamps, request identifiers, errors, crash information, and diagnostic logs; and
suspected fraud, abuse, unauthorized access, or violation information.

Technical and gameplay information may be personal information when it identifies, relates to, or can reasonably be linked with a player.

3. How we collect information

We collect information:

directly from you when you create or edit an account, connect a wallet, communicate, play, make a purchase, or submit content;
automatically from your browser, device, game client, and interactions with the Arcade;
from public blockchain networks and blockchain data providers;
from Epic Games when you ask to connect an Epic-authenticated game session;
from payment and infrastructure providers; and
from other players when required to operate multiplayer, social, moderation, or reporting features.

4. How we use information

We use information to:

create, authenticate, secure, and support Arcade accounts;
check the birthday you provide against our minimum-age requirement and process your account-deletion or other privacy requests;
verify wallet control and current NFT ownership;
display player-selected profiles, characters, achievements, and leaderboard information;
operate games, matchmaking, realtime sessions, chat, progression, rewards, and content delivery;
link a verified Epic identity and return approved NFT-backed entitlement keys;
process purchases and maintain accurate virtual-economy records when payments are enabled;
prevent fraud, cheating, abuse, unauthorized access, and service disruption;
investigate reports, enforce our rules, and protect players and the Arcade;
diagnose errors, measure performance, and improve our services;
communicate important service, security, support, and policy information; and
comply with law and establish, exercise, or defend legal claims.

We will not use an email address as evidence of wallet control or NFT ownership.

5. Legal bases for users in the EEA and United Kingdom

Where applicable law requires a legal basis, we process personal data as necessary to:

perform our contract with you by providing the Arcade features you request;
pursue legitimate interests such as security, fraud prevention, service reliability, product improvement, and protection of our legal rights, where those interests are not overridden by your rights;
comply with legal obligations; or
act with your consent, where we specifically request consent.

You may withdraw consent for future processing where consent is the applicable basis. Withdrawal does not affect processing already performed and may prevent us from providing an optional feature.

6. How we disclose information

We may disclose information in the following circumstances.

Service providers

We use providers to host, secure, and operate the Arcade. Depending on the features enabled, providers may include:

Supabase for authentication, databases, storage, and realtime capabilities;
Vercel for website hosting, server functions, performance, and web analytics;
Epic Games for Epic account authentication and distribution of Quantum Frame;
blockchain networks, RPC services, and NFT indexing or metadata services for ownership verification;
Colyseus or another realtime-game host for active multiplayer sessions;
Cloudflare and Microsoft for approved private asset-vault storage and synchronization;
GIPHY for optional GIF search and display; and
Stripe for hosted checkout, subscriptions, billing management, and payment processing.

These providers process information for their own stated purposes or on our behalf under their terms and privacy commitments.

Other players and the public

Your username and information you deliberately make public may appear on profiles, leaderboards, game lobbies, match records, chat, collection pages, or other social features. Privacy settings may limit some profile information, but actions taken in public or multiplayer spaces may remain visible to other participants.

Legal, safety, and business purposes

We may disclose information when reasonably necessary to comply with law, respond to valid legal process, investigate fraud or security incidents, enforce agreements, protect rights or safety, or complete a merger, financing, acquisition, reorganization, or sale of assets subject to appropriate safeguards.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising, and we do not use targeted advertising in the Arcade. If those practices change, we will update this policy and provide legally required choices before the change applies.

7. Public blockchain and NFT information

Wallet addresses, NFT contracts, token identifiers, transfers, balances, and transaction histories may already be publicly available on a blockchain. Connecting a wallet lets Arcade associate selected public blockchain information with your private Arcade account. We do not automatically publish all linked wallets merely because they are connected to one account.

Public blockchain data may remain available permanently through parties outside our control, even if you disconnect a wallet or delete your Arcade account.

8. Cookies and analytics

Arcade uses essential cookies or similar technology to maintain authentication, remember security state, and provide requested features. Blocking essential cookies may prevent sign-in or other account functions.

Our age-eligibility cookie lasts up to 30 days for an eligible result or 24 hours for an ineligible result. It contains the result and its issue and expiration times, not your birthday. The cookie is necessary to enforce the entry requirement and is not used for advertising. You may decline to submit your birthday, but you cannot enter Arcade without completing the check.

Arcade currently uses Vercel Web Analytics to understand aggregate site use and performance. We do not use third-party advertising cookies or behavioral-advertising trackers. If optional analytics or marketing technology is added, we will update this policy and provide any consent controls required by law.

9. Retention

We retain personal information only for as long as reasonably necessary for the purposes described in this policy, including providing an active account, preserving reliable game and economy records, maintaining security and audit trails, resolving disputes, enforcing agreements, and satisfying legal obligations.

Retention depends on the type of information:

Birthdays submitted for the age check are processed transiently and not retained. Age-eligibility cookies expire after up to 30 days for an eligible result or 24 hours for an ineligible result. The age-check request limiter retains its IP-derived identifier in server memory for up to one minute. Age-check outcome events and ordinary host logs follow the security and operational retention purposes described in this policy.
Epic identity tokens are processed transiently and are not intentionally stored by Arcade.
Pairing codes are short-lived, single-use credentials stored in a protected form.
Active-session information may be short-lived, while validated match, progression, achievement, entitlement, economy, and security records may be retained longer to preserve integrity and prevent fraud.
Support submissions and public content may be retained until resolved, removed, or no longer needed, subject to safety, legal, and backup requirements.
Account information is generally retained while the account is active and as reasonably necessary for security, fraud prevention, legal compliance, transaction records, dispute resolution, backups, or protection of the rights of others.

Deletion from active systems may not immediately remove information from encrypted backups. Public blockchain records cannot be deleted by CyberCrew Studios.

10. Security

We use administrative, technical, and organizational safeguards designed to protect information. These include encrypted transport, access controls, server-side authorization, rate limits, audit events, and separation of browser, game-client, wallet, and privileged service credentials.

No service can guarantee absolute security. You are responsible for protecting access to your wallet, Epic account, email account, and devices. CyberCrew Studios will never ask for your seed phrase or private key.

11. Your choices and privacy rights

Depending on where you live, you may have rights to request access, correction, deletion, restriction, objection, portability, or information about how we process and disclose your personal information. You may also have the right to appeal a denied request or complain to a privacy regulator.

You may:

edit supported profile and privacy settings in Arcade;
disconnect eligible linked wallets or your Epic connection;
request access or correction by contacting us, and request account deletion from your Player Profile or by contacting us; and
use legally recognized browser signals where applicable to a practice covered by those signals.

We may need to verify your identity before completing a request. We will not discriminate against you for exercising an applicable privacy right. Some information may be retained where permitted or required for security, fraud prevention, legal compliance, transaction records, or the rights of others.

To submit a privacy request, contact support@cybercrewstudios.com with the subject Arcade Privacy Request. Do not send a seed phrase, private key, password, or complete Epic identity token.

12. California privacy notice

California residents may have rights to know, access, correct, or delete personal information; opt out of sale or sharing; limit certain uses of sensitive personal information; and receive equal service when exercising those rights, subject to legal scope and exceptions.

The categories described in this policy may include identifiers, customer records, commercial information, internet or electronic activity, geolocation at an approximate level derived from IP address, user-generated content, and inferences related to gameplay or preferences. We collect these categories from the sources in Section 3, use them for the purposes in Section 4, and disclose them to the categories of recipients in Section 6.

We do not sell personal information or share it for cross-context behavioral advertising. We do not knowingly sell or share the personal information of consumers under 16.

13. Account Deletion

You can permanently delete your Arcade account using Delete Account in your Player Profile. After a recent sign-in, typing DELETE and acknowledging the consequences, the in-app option automatically deletes your login and personal account data and signs you out. This cannot be undone. Active matches must be left or completed and active billing resolved first; administrator accounts may require an ownership handoff. If you cannot sign in, encounter an error, or need help, contact support@cybercrewstudios.com with the subject Arcade Account Deletion Request. We may take reasonable steps to verify that a person requesting deletion is authorized to control the applicable account.

When an account is deleted, we will delete or de-identify account information as required by applicable law, subject to information that may reasonably need to be retained for security, fraud prevention, legal compliance, transaction records, dispute resolution, backups, or protection of the rights of others.

Deletion removes the login identity, public profile fields, wallet and Epic account links, personal progression, preferences, chat messages, and available virtual balances from active account systems. A non-login historical player identifier remains to keep match, NFT progression, transaction, and safety records consistent. Private support reports and evidence, security and fraud-prevention logs, and necessary transaction records may retain personal information where needed for those purposes, subject to the retention criteria in this policy. These retained records are not all anonymous. Contact Support to exercise applicable rights regarding retained information.

Account deletion does not alter public blockchain records or transfer, burn, or remove assets from your wallet. NFT-specific progression is retained separately from your login. ERC-721 canonical progression is preserved; owner-scoped ERC-1155 progression remains inactive under the historical account identifier and is not automatically restored to a new account. Account-specific progression, preferences, and available virtual balances cannot be restored by signing up again. Deletion does not by itself cancel an external subscription or erase a billing obligation; contact Support to resolve any paid service before proceeding.

14. Age Requirement

CyberCrew Arcade is intended only for individuals who are 18 years of age or older. You may not create or use a CyberCrew Arcade account if you are under 18.

CyberCrew Studios does not knowingly permit individuals under 18 to maintain Arcade accounts or knowingly collect personal information through Arcade from individuals under 18. If we learn that an individual under 18 has created an Arcade account or provided personal information through Arcade, we may suspend or delete the account and take reasonable steps to delete the associated personal information, subject to applicable law, security requirements, legitimate recordkeeping requirements, and information that CyberCrew Studios cannot alter or remove from public blockchain networks.

A parent or guardian who believes that an individual under 18 is using CyberCrew Arcade may contact support@cybercrewstudios.com.

15. International Data Transfers

CyberCrew Studios is based in the United States. We and our providers may process information in the United States and other countries where privacy laws may differ from those where you live. Where required, we use recognized transfer mechanisms or other appropriate safeguards.

16. Third-Party Services

Wallet applications, blockchain networks, Epic Games, payment providers, external links, and other third-party services operate under their own terms and privacy policies. Review those policies before using the applicable service. CyberCrew Studios does not control public blockchain operation or a third party's independent data practices.

17. Changes to This Privacy Policy

We may update this policy as the Arcade changes. We will post the revised policy and its effective date. If a change materially affects how we use personal information, we will provide additional notice or obtain consent where required by law.

18. Contact Us

CyberCrew Studios LLC

8 The Green, Suite B

Dover, Delaware 19901

United States

Email: support@cybercrewstudios.com

Subject: Arcade Privacy Request

If you are in a jurisdiction that gives you the right to contact a data protection authority, you may also submit a complaint to the authority where you live or work.