Privacy policy

Effective date: 18 September 2026. Version 2.5.

RetroWorld is a free browser arcade. It has no accounts and no sign-up forms. The only thing it keeps on a server is a bug report you choose to send. This policy explains, in full, the small amount of information that is handled when you use it, who handles it, and the choices you have. Every statement here describes what the site actually does today.

1. Who we are and how to reach us

RetroWorld (retroworld.fun) is an independent studio that makes browser games for fun ("we", "us", "our"). The Site is free: nothing is sold on it, no advertising runs on it, and it takes no payment of any kind. The only way to give anything is a voluntary tip on our page at Ko-fi, a separate service described in section 9; no payment is ever handled by this Site. For any question, request or complaint about this policy or your information, email hello@retroworld.fun. We aim to respond within 30 days.

2. Definitions

• "Site" means retroworld.fun, including every game and activity page on it.
• "Personal information" means information that identifies you or could reasonably identify you, and includes "personal data" as that term is used under the EU and UK General Data Protection Regulation (GDPR).
• "Device storage" means your browser's local storage and its offline cache, small stores that belong to your browser and are not transmitted to us.
• "Consent notice" means the notice that asks whether Google Analytics may run. It offers "Accept all", "Reject all" and "Manage". "Manage" lists each category: device storage and cookie-free statistics are always on, and Google Analytics is a switch. The notice is shown on your first visit if you are in a country whose law requires us to ask before analytics cookies are set (section 7); everywhere else Google Analytics starts on and you can switch it off at any time through Privacy choices in the footer, which opens the same list.

3. Summary of what happens when you use the Site

4. Information stored only in your browser

The Site remembers things between visits by writing to your browser's device storage. This information never leaves your device and we cannot see it. It consists of:

• your best and recent scores for each game, and how many times you have played each game;
• your day streak, today's-pick status and the trophies you have unlocked;
• your tokens (how many you hold and have earned), today's three quests and which are done, the days you finished all three, and the console finishes you have bought and which one you are using. Tokens have no money value, cannot be bought, and exist only in this browser;
• saved progress in games with levels, waves, holes or rounds (the one you reached, your score so far and the details needed to carry on), so you can continue later;
• preferences: sound on or off, on-screen pad shown or hidden, whether each game uses the on-screen pad or the joystick, your answer to the consent notice, and options inside some games (for example hints or tap-twice in Five Stones);
• the time of your last visit, so the welcome animation plays only on a first visit or after 24 hours away;
• the two-letter country code your connection arrives from, kept for up to seven days, used only to decide whether the consent notice has to be shown to you (section 7). It is read from our own address /cdn-cgi/trace, which Cloudflare answers; no third party is contacted and no IP address is stored;
• for games that set a puzzle a day, such as the word game and the card pyramid: which puzzle you have done today and how you did, your day streak and best streak, and your own records for that game, so a puzzle you were halfway through is still there when you come back;
• activity results: the options you typed into the Decision Wheel, your Would You Rather choices, and your best trivia, circle and stillness results;
• activity lists: the names you type into Team Picker, the names you save as favourites in Name Generator (and which kind of name you last chose), and your latest Beat Maker pattern, tempo and swing;
• copies of the pages, game code and pictures you have opened, kept by the Site's offline helper (a "service worker") so that games you have played still work without a connection. These are the same public files anyone can load from the Site. The helper only ever stores files from retroworld.fun and never touches requests to Google, Cloudflare or anyone else.

Anything you type into the Decision Wheel or Team Picker is stored only on your device, only so the activity remembers your list. If you type personal information there, such as the names of people in a class or team, it stays on your device and is never sent to us or anyone else. Clear it with the activity's Clear button or by clearing site data.

Doodle Pad drawings are not stored at all: they disappear when you close the page, and Save picture creates the image file on your own device without uploading it.

You can erase all of this at any time by clearing site data for retroworld.fun in your browser settings. The Site works without it; you will simply start with fresh scores.

5. Hosting: Cloudflare

The Site is served by Cloudflare, Inc. (Cloudflare Pages). Like every website, delivering a page requires your browser to send your Internet Protocol (IP) address, the page requested, the referring page, your browser type and version, and the date and time. Cloudflare processes this information to deliver the page, protect the Site from attacks and abuse, and keep short-term security logs. We do not receive a copy of these logs and do not use them to identify visitors.

Cloudflare operates a global network; your request is handled by the data centre nearest to you, and logs may be processed in the United States and other countries. Cloudflare's own privacy policy is at cloudflare.com/privacypolicy.

Legal basis (EU/UK): our legitimate interest in operating a secure, available website (Article 6(1)(f) GDPR). This processing is strictly necessary to provide the Site you requested.

6. Cookie-free visit statistics: Cloudflare Web Analytics

We use Cloudflare Web Analytics (also called Real User Measurements) to count visits and see which pages are popular and how fast they load. Cloudflare states that this tool does not use cookies, local storage or device fingerprinting, and does not track individuals across sites. It records the page visited, the referring site, the browser and device type, the country inferred from the IP address, and page-load timings. The IP address is used to infer the country and is not stored with the statistics we see.

Legal basis (EU/UK): legitimate interest in understanding how the Site is used (Article 6(1)(f) GDPR). Because no information is stored on or read from your device, the cookie consent rules do not apply to it. We mention it here so that nothing about the Site is hidden from you.

7. Google Analytics (your choice)

The Site can load Google Analytics 4, a service of Google LLC (and, for visitors in the European Economic Area, the United Kingdom and Switzerland, Google Ireland Limited). Whether it starts on or off depends on where you are.

If you are in a country whose law requires consent first — the European Economic Area, the United Kingdom, Switzerland, Brazil, India, South Africa, South Korea and Thailand — the consent notice is shown on your first visit and nothing is loaded from Google until you press "Accept all" or switch Google Analytics on under "Manage". This is enforced in the Site's code using Google Consent Mode, with every consent signal set to "denied" by default.

Everywhere else — for example the United States, Canada, New Zealand and Japan, where the law does not require us to ask before setting analytics cookies — no notice is shown and Google Analytics starts on. You can switch it off at any time through Privacy choices in the footer: that stops collection straight away and deletes the Google Analytics cookies. If your browser sends a Global Privacy Control signal, analytics stays off from the start without you doing anything.

To decide which of the two applies, the Site reads the two-letter country code of your connection from our own address /cdn-cgi/trace, answered by Cloudflare (section 5). Your IP address is not stored and no third party is involved. If that address cannot be reached, your browser's time zone is used, and anything unrecognised is treated as "ask first". The country code is kept in your browser for up to seven days (section 4). This is not legal advice about your own country; it is how the Site behaves, and you always have the "Privacy choices" switch either way.

What is sent to Google

• page views, with the page address and referrer;
• a game_start event naming the game;
• a game_over event naming the game, the score and the seconds played;
• standard technical details Google collects with every event: browser and device type, screen size, language, approximate location derived from the IP address, and a random client identifier stored in cookies named _ga and _ga_RZM143EBF2 (the second name contains our property identifier).

We do not send names, email addresses or any content you type. We have not enabled Google Signals, advertising features, remarketing or User-ID, and we do not link Analytics to any advertising account. Google Analytics 4 does not log or store full IP addresses.

Why

To learn which games and activities people enjoy, how long they play and where the Site could be better.

Retention

Google retains event-level data for the period configured in our Analytics property, which is at most 14 months, after which it is deleted automatically. Aggregated reports do not identify individuals. The _ga cookie expires after two years unless you delete it sooner.

Legal basis and your choice

Legal basis (EU/UK): your consent (Article 6(1)(a) GDPR) — visitors in those countries are always asked first — which you may withdraw at any time by choosing Privacy choices in the footer, switching Google Analytics off and pressing "Save choices". Withdrawal stops collection straight away and deletes the Google Analytics cookies from your browser; it does not affect processing that already happened. Pressing "Reject all" sets no Google cookies and loads nothing from Google.

Google's privacy policy is at policies.google.com/privacy, and Google explains how it uses information from sites that use its services at policies.google.com/technologies/partner-sites. You can also block Google Analytics in every website with Google's browser add-on at tools.google.com/dlpage/gaoptout.

8. Advertising: none

The Site shows no advertisements and loads no advertising service, no advertising cookies and no advertising identifiers. Nothing is sold on the Site: there is no shop, no checkout and no payment provider, and we never receive or handle payment details. If this ever changes, we will update this policy before it does, and visitors in countries that require consent for advertising cookies will be asked first.

9. Tips: the Ko-fi links

Tips are how the Site pays for itself. Our page is at ko-fi.com/retroworld, run by Ko-fi Labs Ltd, and there are three ways to reach it: the "Support Us" button in the corner of the page, the "Buy me a coffee" link in the footer, and the support box under each game. All three are ordinary links. No code from Ko-fi runs on this Site, nothing is fetched from Ko-fi or from any font or script service to draw them, and no frame from Ko-fi is embedded in any page. Until you choose to press one, Ko-fi does not know you were here.

Pressing one opens ko-fi.com in a new tab. From that point you are on Ko-fi's site and Ko-fi's own privacy policy applies, at more.ko-fi.com/privacy. Whatever you give Ko-fi, including payment details, is collected and handled entirely by Ko-fi; we never see or receive card details. What Ko-fi then shows us about a tip is a display name, a message if you choose to leave one, and the email address you gave Ko-fi at its checkout — Ko-fi requires one so it can send you a receipt, and it passes it to the creator. We cannot switch that off from our side, and we do not use it: it is never added to any list, never used to contact you unless you asked us something, and never shared or sold. If you would rather we never saw an address, use a forwarding or alias address at Ko-fi's checkout, or ask us to delete it by emailing hello@retroworld.fun.

Tips are voluntary gifts: they buy nothing on the Site, unlock nothing, and change nothing about how the games play.

10. Sharing and device features

The "Share" buttons use your device's built-in share sheet or copy text to your clipboard. Nothing is sent to us. The Site may ask your device to vibrate briefly for game feedback and may switch the game to full screen; these are handled entirely by your browser and involve no data collection. If you choose "Install app" or add the Site to your home screen, your browser creates the shortcut itself and nothing is sent to us.

Beat Maker's "Copy link" puts only the drum pattern, tempo and swing into the web address it copies; whoever opens that link sees the same beat, and nothing about you is included or sent to us.

All fonts and images are served from the Site itself, so no third party is contacted to display the pages other than those named in sections 5 to 7.

11. Bug reports you send us

Every page has a "Report a bug" link that opens a short form. Nothing is sent unless you fill it in and press "Send report". When you do, we store:

• the kind of problem you picked and the message you typed;
• the page it was sent from, the title of that page, and the game or activity the report is about (picked for you on a game page, and changeable in the form);
• when the report is about the game on the page you are on: what the game was doing when you opened the form (start screen, playing, paused, game over or crashed), your score, level and seconds played, the technical error message if the game crashed, whether sound and full-screen play were on, whether your device asks for reduced motion, whether you were online, and which button opened the form. None of this identifies you;
• your email address, only if you fill in the optional email box. We use it only to reply about that report and never add it to a mailing list;
• if "Include device info" is left on (you can switch it off before sending): your browser's user-agent text (browser name and version, and operating system), the size of your browser window, whether the screen is a touch screen, and the version of the Site's code that was running;
• the date and time it arrived.

Your IP address is not stored with the report. To stop the form being flooded, a one-way scrambled code (a "hash") made from your IP address and the current hour is used to count how many reports arrive from one connection in that hour; it is not stored with the report, it cannot be turned back into your IP address without guessing, and it is deleted after the hour it counts.

Reports are kept in a database on Cloudflare D1, a service of Cloudflare, Inc. (section 5). Only we can read them, and we use them only to find and fix problems on the Site. We do not sell or share them. Please do not put anything in the message that the report does not need, such as other people's details.

Legal basis (EU/UK): our legitimate interest in fixing the faults you tell us about (Article 6(1)(f) GDPR) and, for the optional email address, your consent (Article 6(1)(a)), which you can withdraw by asking us to delete it.

12. Information we do not collect

We do not have user accounts, sign-up forms, comment sections, newsletters, file uploads or chat. Apart from an email address you choose to add to a bug report (section 11), and the one Ko-fi passes to us if you leave a tip (section 9), we do not collect names, email addresses, phone numbers, payment details, precise location, or contact lists. We do not sell personal information, we do not share personal information for cross-context behavioural advertising, and we take no payment of any kind ourselves — tips go through Ko-fi (section 9), never through this Site.

13. Children

The games are suitable for all ages, and the Site is offered to a general audience. We do not knowingly collect personal information from children under 13 (or under the age at which a child can consent in your country), and the Site is designed so that it does not need any. The only optional processing, Google Analytics, requires a deliberate choice on the consent notice; parents and guardians who prefer that no analytics run on a child's device can press "Reject all", or block Google Analytics using the add-on in section 7. The bug report form asks for no personal information and its email box is optional. If you believe a child has sent us personal information in a bug report or by email, contact us and we will delete it; anything given to Ko-fi has to be raised with Ko-fi, whose own terms set a minimum age.

14. International transfers

Cloudflare and Google are global companies; information described in sections 5 to 7 and 11 may be processed in the United States and in other countries where they operate. For visitors in the European Economic Area, the United Kingdom and Switzerland, these providers rely on approved safeguards such as the EU–US Data Privacy Framework and Standard Contractual Clauses, described in their own policies linked above.

15. How long we keep information

• Device storage (section 4): until you clear it. Offline copies are refreshed as you browse and the oldest are removed automatically. We never hold a copy.
• Cloudflare security logs (section 5): retained by Cloudflare for a short period under its policy; we hold none.
• Cloudflare Web Analytics (section 6): aggregated statistics only, retained by Cloudflare for the reporting period.
• Google Analytics (section 7): event data at most 14 months; cookies up to two years.
• Bug reports (section 11): deleted automatically once they are about 12 months old, or sooner if you ask. The hashed spam counter: deleted after the hour it counts.
• Emails you send us: as long as needed to answer you and for our records, then deleted.

16. Security

The Site is served only over HTTPS, and Cloudflare forces encrypted connections. Pages carry a Content Security Policy that restricts which scripts may run and which servers the page may contact to those named in this policy. The Site has no accounts, so there is no account data to breach. The only information we hold on a server is the bug reports people choose to send (section 11), in a database that can only be written to through the Site's own form and read only by us. Google and Cloudflare protect the information they process under their own security programmes.

17. Your rights

Everyone

You may ask us what information we hold about you, ask us to correct or delete it, or object to how it is used, by emailing hello@retroworld.fun. In practice the only information we ourselves hold is any email you send us and any bug report you send (section 11). To have a bug report deleted, email us from the address you gave, or tell us roughly when you sent it and which game it was about. Information in your browser is under your direct control (section 4). Information processed by Google under your consent can be stopped by withdrawing consent (section 7).

European Economic Area, United Kingdom and Switzerland

Under the GDPR and UK GDPR you have the rights of access, rectification, erasure, restriction, portability and objection, and the right to withdraw consent at any time (section 7). You may lodge a complaint with your local supervisory authority; in the UK this is the Information Commissioner's Office at ico.org.uk. We are not established in the EU or UK and do not carry out large-scale or systematic monitoring, so we have not appointed a representative or a data protection officer; this policy and the contact address above are the routes for exercising your rights.

California and other US states

We do not sell or share personal information as those terms are defined in the California Consumer Privacy Act, and we do not use sensitive personal information. Our business is below the thresholds at which the CCPA and similar state laws apply, but we honour the same rights voluntarily: you may request access to or deletion of personal information we hold, and we will not treat you differently for exercising those rights. Pressing "Reject all" on the consent notice, or switching Google Analytics off under Privacy choices in the footer, is an effective opt-out from Google Analytics; the "Privacy choices" link is on every page, including for visitors who never see the consent notice. We treat browser-level Global Privacy Control signals as an opt-out from Google Analytics where no choice of your own has been recorded.

18. Changes to this policy

When the Site changes in a way that affects your information, we will update this policy first, change the effective date at the top, and, for changes that need your consent, show the consent notice again. Earlier versions are available on request.

19. Contact

RetroWorld · hello@retroworld.fun