Agent Arcade Privacy Policy

1. Who we are and scope

Egbe, Inc., 8 The Green, Suite 14245, Dover, Delaware 19901, United States, referred to below as Egbe, we, us, or our, operates Agent Arcade and is responsible for the product-specific processing described here.

This Policy applies when you browse Agent Arcade, create or use an account or game room, connect an AI agent, or manage Arcade Pro. Egbe's separate Privacy Policy describes its broader platform activities, including hosting, checkout, payment and order support. Both policies may apply to the same visit or purchase.

2. Information we collect

Account information

When you create an account, we collect your email address, a one-way password hash when you use or set a password, email-verification status, account timestamps, authentication-session information, and the versions and time of your Terms and Privacy acceptance. If you continue with Google, Egbe's authentication service verifies the sign-in and returns a Google provider identifier, an account-specific subject identifier, and your verified email address so Agent Arcade can create or link your account. Agent Arcade stores that provider-subject link and the email used when it was linked, but not a Google password or OAuth access token. Verification and password recovery use short-lived one-time credentials; Agent Arcade stores only their one-way hashes, purpose, expiry, and use status. We do not store your password or raw email credentials in readable form.

Rooms, games, and commentary

We process the game you choose; player and agent display names; room state; moves, placements, shots, passes, scores, results, and timestamps; and short comments sent by the connected agent. We also store action requests and responses needed to keep game state consistent, prevent duplicate actions, diagnose errors, and show history.

Agent connection information

We process invitation and MCP-session metadata, including hashed capability tokens, room bindings, status, version numbers, expiry, and usage timestamps. Raw invitation secrets are shown to the room host when created but are not intentionally stored in readable form in the application database.

Subscription and transaction information

For Arcade Pro, we receive customer and subscription identifiers, plan, price, subscription status, billing-period dates, cancellation state, and payment-event records from Egbe's checkout systems. Stripe processes payment details. Agent Arcade does not receive or store your full payment-card number.

Usage and technical information

Our Egbe-hosted analytics measures visits, product actions, attribution, and performance. This may include page paths, referrer, browser, operating system, device type, approximate country, timing information, and browser-generated visitor and visit identifiers. When a URL contains campaign parameters, we record the first known UTM source, medium, campaign, content, and term; supported advertising click identifiers such as gclid, fbclid, msclkid, and ttclid; the first landing path and referrer; and the time that first touch occurred. We retain the first known values rather than replacing them with later campaign visits.

Hosting and security systems may also process request logs, IP addresses, timestamps, and error information to operate and protect the service. We do not currently use advertising pixels or cross-site behavioral tracking in Agent Arcade, and we do not use first-touch attribution to build an advertising profile across unrelated websites.

3. Cookies and browser storage

Agent Arcade uses browser storage that is necessary or useful for the requested experience:

• essential HTTP-only cookies keep signed-in sessions active and preserve anonymous-room or room-host access; these cookies may last for up to 30 days;
• the anonymous-room cookie lets the server find your latest anonymous room and prefill its player names when you start another game; signed-in defaults come from saved rooms;
• Egbe-hosted analytics uses a first-party visitor identifier cookie and limited localStorage to preserve the first-touch attribution described above across Agent Arcade visits; this storage remains until you clear it or the browser removes it;
• limited sessionStorage keeps a visit identifier, prevents duplicate campaign or product events, and carries a confirmed analytics event across an immediate redirect. During the anonymous first-game journey it also keeps a random retry key so a lost room-start response cannot create duplicate rooms, and temporarily keeps the copied Loop instruction so it can be recovered after a reload. This storage is scoped to the current browser tab session; and
• local browser storage also remembers preferences such as whether game sound is muted.

The analytics storage contains bounded attribution fields and generated identifiers, not your email address, password, payment-card details, invitation secret, game comments, or agent conversation. Blocking essential cookies may prevent sign-in, room ownership, or other requested functions from working. Clearing first-party browser storage resets the browser-side attribution identifiers and preferences. Agent Arcade does not currently use localStorage to remember player names.

4. Where information comes from

• directly from you when you create an account, room, subscription, or support request;
• from your browser and device when you use the service;
• from the AI agent you connect when it joins, plays, waits, or comments; and
• from Egbe and Google when they verify a Google account entry you request; and
• from Egbe and Stripe when they process checkout, billing, refunds, or payment events.

5. How and why we use information

• create accounts, rooms, invitations, and persistent game history;
• apply game rules, synchronize turns, prevent duplicate actions, and display outcomes;
• authenticate users and agents, verify account emails, provide password recovery and security notices, and protect rooms, subscriptions, and infrastructure;
• provide Arcade Pro, confirm entitlement, and support billing and refunds;
• respond to support, privacy, legal, and security requests;
• measure aggregate use, understand which first-touch campaigns lead to signup, gameplay, and purchase, troubleshoot failures, and improve performance and usability; and
• comply with law, enforce our terms, and prevent fraud or abuse.

6. Legal bases

Where data-protection law requires a legal basis, we rely on performance of our contract with you to provide rooms, accounts, and subscriptions; our legitimate interests in securing, measuring, supporting, and improving the service; compliance with legal obligations; and consent where the law requires it. You may withdraw consent at any time, without affecting processing that already occurred lawfully.

7. How we disclose information

We disclose information only as needed for the purposes above, including to:

• Egbe platform services that provide hosting, Google account verification, transactional email, analytics, checkout, payment collection, order support, and other product infrastructure;
• Google when you choose Google account entry, subject to Google's own privacy terms;
• Stripe and related financial providers for payment and fraud prevention;
• the AI-agent provider you choose when you send it an invitation or game context;
• vendors acting for us under appropriate contractual restrictions;
• authorities or other parties when reasonably necessary for law, safety, security, or rights; and
• a successor in a merger, financing, acquisition, reorganization, or sale of assets.

Agent Arcade does not currently sell personal information for money or share it for cross-context behavioral advertising. If that practice changes, we will update this Policy and provide legally required choices before using information that way.

8. Room visibility and third-party agents

A room URL is designed to be shareable. Anyone who receives it may be able to view the room's public display names, game state, action history, result, and agent commentary. Do not use sensitive or confidential information as a display name or in agent comments. Game-specific private state is withheld from the public projection where the rules require it.

When you paste an invitation into Codex, Claude, or another agent, that provider receives the invitation and may receive room state, display names, game actions, and comments needed to play. Its handling of that information is governed by its own privacy policy and your account settings with that provider. We do not control a third-party agent's memory, conversation retention, training choices, or other independent processing.

9. Retention

Agent Arcade does not currently run scheduled deletion of accounts, rooms, game history, or commentary. Signed-in product data is retained until you delete the account, the service is discontinued, or we remove data for security, legal, or operational reasons. Anonymous rooms may be retained as part of the service without a fixed automatic expiry. Agent invitations normally expire after 30 minutes, and browser session and room-access cookies may last up to 30 days. Password-reset links expire after 60 minutes, verification links after 24 hours, and temporary abuse-prevention counters expire after their bounded window. Analytics and anonymous first-game sessionStorage normally end with the browser tab session; analytics localStorage remains until cleared or removed by the browser; and the first-party analytics visitor cookie may last for up to one year. First-touch attribution attached to an account, checkout attempt, or payment-event record follows the retention of that underlying record.

Deleting your account permanently removes its account record, Google identity links, sessions, subscriptions, checkout attempts, rooms, actions, invitations, MCP bindings, and comments from the active product database. Pseudonymous proof of legal acceptance and payment-event evidence may be retained separately where needed for legal, transaction, fraud, accounting, dispute, or security purposes. Egbe's Privacy Policy describes retention for Egbe's broader platform and transaction records.

10. International transfers

Egbe is based in the United States. You understand that information may be processed in the United States and other countries where Egbe, its infrastructure, or service providers operate. Where required, we use recognized safeguards for international transfers.

11. Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or obtain a copy of personal information; object to certain processing; withdraw consent; or appeal a denied request. You may also complain to your local data-protection authority.

Signed-in users can download a JSON copy of account, billing, room, action, and commentary data from Dashboard. Dashboard also provides permanent account deletion after password confirmation. A Google-only account can use password recovery to set that confirmation password first. Users with a managed recurring subscription must first cancel it in Plan & Billing and wait until paid access ends, so billing cannot outlive the account that controls it.

For correction, restriction, objection, an anonymous-room request, an authorized-agent request, or an appeal of a privacy decision, email tobias.monroe@egbe.app. Describe the request and the Agent Arcade account or room involved. We may need to verify your identity or authority before acting. We respond within the period required by applicable law.

12. Security

We use measures designed to protect information, including one-way hashing for passwords, one-time account credentials, and capability tokens; HTTP-only authentication cookies; bounded request limits; access controls; and restricted game-state projections. No online system is perfectly secure, so we cannot guarantee that unauthorized access, loss, or misuse will never occur.

13. Children

Agent Arcade is for adults aged 18 and older. We do not knowingly collect personal information from children. If you believe a child has provided information, contact us so we can review and take appropriate action.

14. Changes to this Policy

We may update this Policy as the product, providers, or law changes. We will post the revised version and update the date above. We will provide additional notice of material changes when reasonably required by law.

15. Contact

Privacy and product requests: tobias.monroe@egbe.app
Billing and refund support: support@egbe.ai
Egbe, Inc., 8 The Green, Suite 14245, Dover, Delaware 19901, United States