Privacy Policy
Last Updated: May 5, 2026
1. Google User Data
When you choose to authenticate with Google or link a Google account to an existing Comfycade profile, Comfycade uses Google OAuth through Supabase Auth to verify your identity, create or access your Comfycade account, link that Google identity to your profile, and keep your progress available across devices. For Google users, we access and process your information in compliance with the Google API Services User Data Policy.
- Data Accessed: We request the
openid,userinfo.email, anduserinfo.profilescopes. These scopes allow us to receive your Google account identifier, primary Google Account email address, email verification status when provided, basic profile information such as your name and publicly available profile information, and profile picture URL when provided by Google. - Data Usage: We use Google user data only to authenticate you, confirm that you control the Google account, create or access your Comfycade account, link a Google account to an existing Comfycade or guest profile, prevent duplicate or incorrect account-link prompts, preserve progress across devices, maintain account security, and provide account support. Comfycade uses its own generated usernames unless you choose to update your profile. We do not use Google user data for advertising, retargeting, personalized ads, marketing, credit decisions, or any purpose unrelated to operating and securing Comfycade account access.
- Data Storage & Protection: Supabase Auth stores the Google identity record needed to recognize and link your Google account, and Comfycade stores the account information needed to operate your profile, such as your Comfycade user ID and email address. Google user data is protected using encryption in transit and at rest, access controls, and Row Level Security policies that limit private profile access to the account owner and authorized administrative support workflows.
- Data Sharing: We do not sell, rent, or transfer Google user data to advertising platforms, data brokers, or information resellers. We share Google user data only with service providers necessary to operate Comfycade account access, such as Supabase for authentication and database hosting, or when required for security, legal compliance, or user-requested account support.
- Data Retention & Deletion: We retain your account data as long as your account is active. You can request the permanent deletion of your account and all associated Google data at any time by contacting us at delete@comfycade.com. Upon request, we will purge all your personal information from our production databases within 30 days.
2. Accounts & Local Data
Comfycade supports signed-in accounts and browser-locked guest accounts through Supabase Auth. We store the account identifiers, username, companion state, coins, prisms, quests, collection, inventory, event progress, and related gameplay metadata needed to operate the arcade. Guest accounts are tied to the browser session that created them and may be deleted after 7 days of inactivity. Local browser storage may keep a recent display snapshot so balances and profile data can remain visible while the app refreshes.
3. Reward Activity
To award coin drops, quest progress, claim-track rewards, and event participation, Comfycade records activity from active signed-in sessions on game and event pages. This can include game identifiers, session timing, claim timestamps, reward grants, and abuse-prevention signals. Signed-out visitors can browse games, the shop, and events, but passive coin drops and event participation are disabled until they sign in or create a guest account.
4. Vercel Analytics
If you accept analytics cookies, we use Vercel Analytics to measure aggregate site performance and page usage. Analytics events may include the page URL, referrer, device and browser details, region-level location data, and anonymous session measurements. We do not send auth callback URLs to Vercel Analytics.
5. Turnstile Protection
We use Cloudflare Turnstile on protected authentication actions, including guest account creation and signed-out magic-link requests when configured. Turnstile helps distinguish real users from automated abuse and may process security signals such as IP address, user agent, browser behavior, and challenge results. This protection is treated as strictly necessary for account security and platform integrity.
6. Magic Link Email
Magic-link and account verification emails are sent through Supabase Auth using our configured email provider. If Resend is enabled as our SMTP provider, Resend processes the email address, message content, delivery timestamps, and delivery status needed to send and troubleshoot those emails. We use these emails only for authentication and account access.
7. Public Social Data
Some gameplay-related data may be visible to other players to support profiles, leaderboards, and social features. This can include your username, companion level, total fortune, badges, and recent game activity. Avoid choosing a username that reveals personal information you do not want public.
8. Third-Party Games
Comfycade acts as a portal for various web-based games, some of which are hosted by third-party partners. When you interact with these games via an iframe, you are subject to the privacy practices of that specific provider. We do not control how these third parties collect or use data within their own game sessions.
9. Your Choices
You can reject non-essential analytics in the cookie banner. Authentication, security, reward integrity, and guest/session storage are necessary for Comfycade to operate and cannot be disabled from the banner. You can clear local browser data to remove local snapshots, but doing so may disconnect a browser-locked guest account unless it has been linked to an email or OAuth account.
10. Advertising
We use Google AdSense to display advertisements. Google may use cookies and web beacons to serve ads based on your prior visits to this site or other sites. You can opt out of personalized advertising by visiting Google's Ads Settings.