Privacy policy

Effective date: 10 September 2026. Version 1.0.

RetroWorld is a free browser arcade. It has no accounts, no sign-up forms and no server of its own. This policy explains, in full, the small amount of information that is handled when you use it, who handles it, and the choices you have. Every statement here describes what the site actually does today.

1. Who we are and how to reach us

RetroWorld (retroworld.fun) is operated by AroraLabs, an independent software studio based in Australia ("we", "us", "our"). For any question, request or complaint about this policy or your information, email hello@retroworld.fun. We aim to respond within 30 days.

2. Definitions

• "Site" means retroworld.fun, including every game and activity page on it.
• "Personal information" means information that identifies you or could reasonably identify you, and includes "personal data" as that term is used under the EU and UK General Data Protection Regulation (GDPR).
• "Device storage" means your browser's local storage, a small store that belongs to your browser and is not transmitted to us.
• "Consent notice" means the notice shown on your first visit that asks whether Google Analytics may run.

3. Summary of what happens when you use the Site

4. Information stored only in your browser

The Site remembers things between visits by writing to your browser's device storage. This information never leaves your device and we cannot see it. It consists of:

• your best and recent scores for each game, and how many times you have played each game;
• your day streak, today's-pick status and the trophies you have unlocked;
• preferences: sound on or off, on-screen pad shown or hidden, and your answer to the consent notice;
• activity results: the options you typed into the Decision Wheel, your Would You Rather choices, and your best trivia, circle and stillness results.

Anything you type into the Decision Wheel is stored only on your device and only so the wheel remembers your list. If you type personal information there, it stays on your device; please do not enter other people's personal information.

You can erase all of this at any time by clearing site data for retroworld.fun in your browser settings. The Site works without it; you will simply start with fresh scores.

5. Hosting: Cloudflare

The Site is served by Cloudflare, Inc. (Cloudflare Pages). Like every website, delivering a page requires your browser to send your Internet Protocol (IP) address, the page requested, the referring page, your browser type and version, and the date and time. Cloudflare processes this information to deliver the page, protect the Site from attacks and abuse, and keep short-term security logs. We do not receive a copy of these logs and do not use them to identify visitors.

Cloudflare operates a global network; your request is handled by the data centre nearest to you, and logs may be processed in the United States and other countries. Cloudflare's own privacy policy is at cloudflare.com/privacypolicy.

Legal basis (EU/UK): our legitimate interest in operating a secure, available website (Article 6(1)(f) GDPR). This processing is strictly necessary to provide the Site you requested.

6. Cookie-free visit statistics: Cloudflare Web Analytics

We use Cloudflare Web Analytics (also called Real User Measurements) to count visits and see which pages are popular and how fast they load. Cloudflare states that this tool does not use cookies, local storage or device fingerprinting, and does not track individuals across sites. It records the page visited, the referring site, the browser and device type, the country inferred from the IP address, and page-load timings. The IP address is used to infer the country and is not stored with the statistics we see.

Legal basis (EU/UK): legitimate interest in understanding how the Site is used (Article 6(1)(f) GDPR). Because no information is stored on or read from your device, the cookie consent rules do not apply to it. We mention it here so that nothing about the Site is hidden from you.

7. Google Analytics (only with your consent)

If you press Accept on the consent notice, the Site loads Google Analytics 4, a service of Google LLC (and, for visitors in the European Economic Area, the United Kingdom and Switzerland, Google Ireland Limited). Until you accept, the Google script is not loaded and no request is made to Google. This is enforced in the Site's code using Google Consent Mode, with all consent signals set to "denied" by default.

What is sent to Google

• page views, with the page address and referrer;
• a game_start event naming the game;
• a game_over event naming the game, the score and the seconds played;
• standard technical details Google collects with every event: browser and device type, screen size, language, approximate location derived from the IP address, and a random client identifier stored in cookies named _ga and _ga_RZM143EBF2 (the second name contains our property identifier).

We do not send names, email addresses or any content you type. We have not enabled Google Signals, advertising features, remarketing or User-ID, and we do not link Analytics to any advertising account. Google Analytics 4 does not log or store full IP addresses.

Why

To learn which games and activities people enjoy, how long they play and where the Site could be better.

Retention

Google retains event-level data for the period configured in our Analytics property, which is at most 14 months, after which it is deleted automatically. Aggregated reports do not identify individuals. The _ga cookie expires after two years unless you delete it sooner.

Legal basis and your choice

Legal basis (EU/UK): your consent (Article 6(1)(a) GDPR), which you may withdraw at any time by choosing Privacy choices in the footer and pressing "No thanks". Withdrawal stops future collection; it does not affect processing that already happened. Pressing "No thanks" sets no Google cookies and loads nothing from Google.

Google's privacy policy is at policies.google.com/privacy, and Google explains how it uses information from sites that use its services at policies.google.com/technologies/partner-sites. You can also block Google Analytics in every website with Google's browser add-on at tools.google.com/dlpage/gaoptout.

8. Advertising

The Site does not currently show advertisements and no advertising service is loaded. The Site is prepared to show Google AdSense advertisements in future. If we switch advertising on, we will update this policy before doing so, the consent notice will describe advertising cookies, and visitors in the European Economic Area, the United Kingdom and Switzerland will be asked for consent through a Google-certified consent tool before any personalised advertising is shown.

9. Donations: Ko-fi

The "Support" and "Buy me a coffee" buttons link to our page on Ko-fi (ko-fi.com), a third-party service. Following that link takes you off the Site. Any information you give Ko-fi, including payment details, is collected and handled by Ko-fi under its own privacy policy at more.ko-fi.com/privacy. We receive from Ko-fi only what its service shows us about a donation, such as a display name and message if you choose to leave one. We never receive card details.

10. Sharing and device features

The "Share" buttons use your device's built-in share sheet or copy text to your clipboard. Nothing is sent to us. The Site may ask your device to vibrate briefly for game feedback and may switch the game to full screen; these are handled entirely by your browser and involve no data collection.

All fonts and images are served from the Site itself, so no third party is contacted to display the pages other than those named in sections 5 to 7.

11. Information we do not collect

We do not have user accounts, sign-up forms, comment sections, newsletters, file uploads or chat. We do not collect names, email addresses, phone numbers, payment details, precise location, or contact lists. We do not sell personal information, and we do not share personal information for cross-context behavioural advertising.

12. Children

The games are suitable for all ages, and the Site is offered to a general audience. We do not knowingly collect personal information from children under 13 (or under the age at which a child can consent in your country), and the Site is designed so that it does not need any. The only optional processing, Google Analytics, requires a deliberate choice on the consent notice; parents and guardians who prefer that no analytics run on a child's device can press "No thanks", or block Google Analytics using the add-on in section 7. If you believe a child has provided personal information through Ko-fi or by email, contact us and we will delete it.

13. International transfers

We are based in Australia. Cloudflare and Google are global companies; information described in sections 5 to 7 may be processed in the United States and in other countries where they operate. For visitors in the European Economic Area, the United Kingdom and Switzerland, these providers rely on approved safeguards such as the EU–US Data Privacy Framework and Standard Contractual Clauses, described in their own policies linked above.

14. How long we keep information

• Device storage (section 4): until you clear it. We never hold a copy.
• Cloudflare security logs (section 5): retained by Cloudflare for a short period under its policy; we hold none.
• Cloudflare Web Analytics (section 6): aggregated statistics only, retained by Cloudflare for the reporting period.
• Google Analytics (section 7): event data at most 14 months; cookies up to two years.
• Emails you send us: as long as needed to answer you and for our records, then deleted.

15. Security

The Site is served only over HTTPS, and Cloudflare forces encrypted connections. Pages carry a Content Security Policy that restricts which scripts may run and which servers the page may contact to those named in this policy. Because the Site has no database and stores nothing about you on a server, there is no account data to breach. Google and Cloudflare protect the information they process under their own security programmes.

16. Your rights

Everyone

You may ask us what information we hold about you, ask us to correct or delete it, or object to how it is used, by emailing hello@retroworld.fun. In practice the only information we ourselves hold is any email you send us. Information in your browser is under your direct control (section 4). Information processed by Google under your consent can be stopped by withdrawing consent (section 7).

Australia

We handle personal information in accordance with the Australian Privacy Principles in the Privacy Act 1988 (Cth). If you are unhappy with our response to a complaint, you may contact the Office of the Australian Information Commissioner at oaic.gov.au.

European Economic Area, United Kingdom and Switzerland

Under the GDPR and UK GDPR you have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time (section 7). You may lodge a complaint with your local supervisory authority; in the UK this is the Information Commissioner's Office at ico.org.uk. We are not established in the EU or UK and do not carry out large-scale or systematic monitoring, so we have not appointed a representative or a data protection officer; this policy and the contact address above are the routes for exercising your rights.

California and other US states

We do not sell or share personal information as those terms are defined in the California Consumer Privacy Act, and we do not use sensitive personal information. Our business is below the thresholds at which the CCPA and similar state laws apply, but we honour the same rights voluntarily: you may request access to or deletion of personal information we hold, and we will not treat you differently for exercising those rights. Pressing "No thanks" on the consent notice is also an effective opt-out from Google Analytics. We treat browser-level Global Privacy Control signals as an opt-out from Google Analytics where our consent notice has not already recorded a choice.

17. Changes to this policy

When the Site changes in a way that affects your information, for example if advertising is switched on, we will update this policy first, change the effective date at the top, and, for changes that need your consent, show the consent notice again. Earlier versions are available on request.

18. Contact

AroraLabs · hello@retroworld.fun · aroralabs.org