← BACK TO Q-BALL ARCADE
Q-Ball Arcade

PLAYER DATA & SAFETY

Privacy Policy

Effective and last updated: August 8, 2026

1. Scope

This Privacy Policy explains how Q-Ball Arcade (“Q-Ball,” “we,” “us,” or “our”) collects, uses, discloses, and retains information when you use playqball.com, its installable web app, player accounts, multiplayer tables, private Friends Lounges, and any wallet feature we expressly make available (collectively, the “Service”).

2. Information we collect

Guest play and browser storage

You may play without an account. The browser can store your chosen player name and visual preference locally. During a table session, it stores the room code, play mode, and a random resume token in browser storage. The resume record is kept only for a short reconnect window so a recently closed app can offer Rejoin, and it is removed when you leave, the window expires, or the table rejects the saved seat. The installable web app caches game assets for performance and offline loading.

Accounts and player profiles

If you sign in, we process your email address, Supabase user ID, authentication and session data, account role, and timestamps. A player profile may contain a display name, avatar selection, bio, and favorite game. Account profile records are private to the signed-in player and trusted service operations. Your current table name and game state are still shared with the other player during a multiplayer session, so do not use a sensitive name there.

Gameplay and multiplayer data

We process room codes, per-room participant identifiers, player names, game type, seat, connection state, game actions and state, reconnect information, match outcome, opponent information, shots, and timestamps. Player names, per-room identifiers, and shared game state are visible to the other player at the table. Signed-in match history is associated with the player account.

Private Friends Lounges and communications

Eligible signed-in players may create or join a private Friends Lounge using an eight-character invite code. We process the lounge name and settings, a per-lounge member identifier, display name, membership role, join and leave times, and text- or voice-mute status. Current lounge members can see one another’s lounge display name, per-lounge identifier, role, mute status, and approximate online Presence. Presence uses a recent authenticated heartbeat and last-seen timestamp. The last-seen timestamp is retained only with the related membership and lounge lifecycle, not as chat history. Members do not receive another member’s email address or underlying account ID. During controlled feature testing, we also process whether the signed-in account is eligible to access the feature; players do not receive another account’s eligibility record.

If the creator enables text chat, we store messages and timestamps so authorized members can reconnect while that exact Lounge remains active. Each Lounge has its own chat, and its messages are erased when the Lounge closes. We also process invitations, blocks, moderation actions, lounge bans, and player-submitted reports and supporting details to operate the lounge and protect players. Invite codes grant access to a private lounge, so share them only with people you intend to invite.

Voice chat defaults off. If a creator enables it and you expressly tap Join Voice, Q-Ball requests microphone permission and LiveKit transports your live audio to current voice participants. You can mute or leave voice, and Q-Ball disconnects voice when the app goes into the background; returning requires another explicit join. Q-Ball does not enable LiveKit recording, egress, camera, or product analytics and does not store the audio stream. Another participant or device may still record locally outside Q-Ball’s control.

Inventory and wallet information

Account storage can include inventory, equipment, achievements, and related provenance. The current wallet feature is restricted to the founder on Ronin’s Saigon testnet. If used, we process the public wallet address, Saigon chain ID, wallet provider and type, and verification time.

Wallet verification uses a single-use challenge containing an ID, public address, domain, URI, nonce, opaque player binding, message, attempt count, and timestamps. The challenge expires after five minutes. The signature is sent to Q-Ball Arcade for verification but is not written to the application database or intentionally logged. We do not request or store seed phrases, private keys, wallet passwords, recovery codes, or signing shares.

Technical and security information

We and our service providers may process IP address, browser and device type, operating system, request and response metadata, timestamps, approximate region, protocol information, security events, and error information to deliver and protect the Service. Cloudflare Turnstile collects browser and device signals only when the protected email sign-in flow loads. Reown/WalletConnect and Ronin process connection metadata when the authorized wallet flow is used. When you expressly join voice, LiveKit and network providers may process device, connection, IP address, diagnostic, room, participant, and audio-transport metadata needed to establish and protect the live session.

3. How we use information

  • provide guest, solo, multiplayer, private lounge, chat, profile, and account features;
  • authenticate players and maintain signed-in sessions;
  • save player preferences, rooms, inventory, and match history;
  • verify founder control of a public Saigon address by signed message;
  • prevent bots, cheating, abuse, fraud, replay, and security incidents;
  • troubleshoot, maintain, and protect the Service;
  • respond to requests and enforce our Terms of Service; and
  • comply with legal obligations and protect players, Q-Ball Arcade, and others.

Where applicable law requires a legal basis, we rely on performance of our agreement with you, our legitimate interests in operating and securing the Service, compliance with law, and consent where required.

4. How we disclose information

We disclose information only as reasonably necessary to:

  • Vercel for frontend hosting, delivery, runtime, and operational security;
  • Render for dedicated authoritative multiplayer hosting when that game service is enabled;
  • Supabase for passwordless email authentication, sessions, database storage, and APIs;
  • Resend for authentication-email delivery;
  • Cloudflare Turnstile for interaction-only bot protection on email sign-in;
  • LiveKit for opt-in live Friends Lounge voice transport when enabled, subject to LiveKit’s Privacy Policy;
  • Reown/WalletConnect for the authorized external mobile wallet relay and verification transport;
  • Ronin Wallet and Sky Mavis when you direct your wallet to connect, select an account, use Saigon, or sign the ownership message; and
  • Other players at your current table for your table name, per-room participant identifier, and shared game state, and current members of a private Friends Lounge for your lounge display name, per-lounge member identifier, role, mute status, Presence, and messages—not your email, private player-card record, or underlying account ID.

We may also disclose information when required by law, to protect rights and safety, during a security investigation, with your direction, or as part of a merger, financing, reorganization, or sale of the Service subject to appropriate protections.

Q-Ball Arcade does not currently sell personal information, share it for cross-context behavioral advertising, use it for targeted advertising, or enable product analytics.

5. Browser storage, cookies, and privacy signals

Q-Ball Arcade uses browser storage and similar necessary technology for sign-in sessions, local preferences, reconnecting to a table, WalletConnect pairing when authorized, and the PWA asset cache. We do not place advertising cookies. You can clear local data through your browser or device settings, but doing so can sign you out, remove preferences, or prevent reconnecting to an active table.

Because Q-Ball Arcade does not currently sell or share personal information for targeted advertising or track users across unrelated services, Do Not Track and Global Privacy Control signals do not change Q-Ball Arcade’s current behavior.

6. Retention

We retain account, profile, wallet-link, inventory, room, match, and security records while reasonably needed to provide and protect the Service, comply with law, resolve disputes, and enforce agreements. Active-lounge text messages are scheduled for deletion once they are 90 days old. Lounge text messages are deleted immediately when that Lounge closes. Other content associated with a closed lounge is scheduled for deletion once the lounge has been closed for 30 days. Pending lounge invitations expire after 24 hours, and expired, accepted, declined, or revoked invitation records are scheduled for deletion once they are 30 days old. Lobby request-rate records are scheduled for deletion once they are 24 hours old. Blocks remain until the blocking player removes them or the relevant account is deleted.

Q-Ball does not retain Friends Lounge voice audio because recording and egress are disabled. LiveKit and network providers may retain limited operational or security metadata under their policies. Muting, leaving voice, closing the lounge, or backgrounding the app ends Q-Ball’s live microphone transport for that session.

Moderation actions, lounge bans, reports, and associated evidence are scheduled for deletion once they are 24 months old. We may retain a specific safety record longer when reasonably required for an active investigation, legal hold, or enforceable obligation. Identifiers are deleted or de-identified where appropriate when an account is deleted, without deleting another player’s records.

Wallet challenges expire after five minutes, but limited challenge records may remain temporarily for replay protection and abuse prevention. A recent online-status and last-seen timestamp is retained only with its membership and lounge lifecycle, not as separate chat history. Browser data remains until the relevant session ends or you clear it. Service providers retain data under their own agreements and policies. Retention periods may also be extended briefly in backups or where law requires.

7. Your choices and privacy rights

You can play as a guest, edit available player-card fields, sign out, decline a wallet request, disconnect through your wallet, and clear browser storage. When the signed-in privacy controls are available, you can also download a private JSON copy of your Q-Ball account data. Ordinary accounts without purchase records can request permanent deletion after leaving any active table and Friends Lounge, completing a recent passwordless sign-in, and entering an explicit typed confirmation. Shared match and room records may be retained only in de-identified form. Protected operator accounts and accounts with purchase records require manual review so required security or transaction records are not destroyed accidentally. Depending on where you live, you may have rights to know or access, correct, delete, or obtain a copy of personal information; opt out of certain processing; use an authorized agent; appeal a request decision; and receive equal service without unlawful discrimination.

You may use the signed-in Player Card privacy controls when they are available. For a manual privacy or account-deletion request, email joebedarts@gmail.com with “Q-Ball Arcade” and the request type in the subject. We may ask for information reasonably necessary to verify the request. Never send a seed phrase, private key, recovery code, wallet password, or one-time sign-in code.

8. Third-party privacy notices

Our providers explain their own practices here:

9. International processing and security

Q-Ball Arcade and its providers may process information in the United States and other countries where privacy laws may differ from those where you live. We use reasonable administrative, technical, and organizational safeguards designed to protect information, including restricted database access, encrypted transport, server-side authorization, rate limits, content restrictions, and single-use wallet challenges. No system can guarantee perfect security.

10. Children

The Service is not directed to children under 13, and we do not knowingly collect personal information from them. Wallet features are restricted to adults age 18 or older. If you believe a child under 13 provided personal information, contact us so we can investigate and delete it where required.

11. Changes to this Policy

We may update this Policy as Q-Ball Arcade changes. We will post the updated version here and revise the date above. If a change is material, we will provide additional notice when reasonably appropriate.

12. Contact

Questions, privacy requests, and account-deletion requests may be sent to joebedarts@gmail.com.