Arrow Out! — Privacy Policy

Last updated: 22 October 2026 · Game progress stays on your device. Reminders are local; system notifications and daily push are optional.

What the game stores

Arrow Out! has no accounts or sign-in. There is no server database for game progress. All your progress — current level, stars, coins, owned arrow styles and board themes, streaks, achievements and settings — is saved in your browser's localStorage, on your own device. The game does not upload this save. Reminder preferences and whether permission has already been requested are included in it. Separate local reminder metadata records interaction time and deduplication/test timestamps; it is not uploaded. Using Share sends the level, score or link you choose to share through your browser or clipboard.

• Normal gameplay needs no external API. Loading or updating the public site contacts GitHub Pages (preview builds may use a different host); local reminders make no network requests. Enabling Daily push reminders contacts the developer's Supabase roster and your browser's push service.
• The game itself sets no cookies and runs no analytics or trackers. Progress lives in localStorage, and the service worker keeps cached copies of the game files for offline play — both stay on your device (see Advertising below for what could change if ads are ever enabled).
• Installing the game (PWA) copies it to your device for offline play; it does not add any new data collection.
• The Contact page sends nothing to this site: with JavaScript enabled it prepares a draft locally. Opening its link sends the subject and message to GitHub in URL query parameters, before an issue is submitted. Without JavaScript, submitting the form sends those parameters directly to GitHub. The URL may remain in browser history and GitHub logs; posting makes the issue and your GitHub username public. This is not a private contact channel. See GitHub’s privacy statement.

Local reminders, system notifications and daily push

Reminders are off for new players. An existing reminder preference is preserved as an in-game reminder choice. Settings → Notification & reminder settings offers 1, 1½ or 2 hours of inactivity. Checks run in the game page, with an in-game fallback. A closed, suspended or battery-restricted page cannot schedule them.

• System notifications are separately optional. Permission is requested only by the explicit Allow button; a dismissed prompt can be asked again by the same button. If denied, use browser site settings; in-game reminders still work.
• Where supported, a running background page can ask the site's service worker to display a local notification. Browser/OS settings may suppress it. A local timer never delivers reminders to a closed browser.
• Daily push reminders are a separate optional setting. Your browser stores a Web Push subscription, the game saves it to the developer's free Supabase roster, and a scheduled GitHub Actions sender delivers roughly five short reminders a day even when the game is closed. Toggling Daily push off removes this device from the roster immediately.
• Disabling reminders stops new requests and attempts to close local notifications. You can also revoke permission in browser settings.

Daily push works like this: the device-linked push endpoint and encryption keys are stored in the developer's free Supabase roster table (players can only insert and delete their own row), and the scheduled GitHub Actions sender reads that roster with the developer's service key to send roughly five daily Web Push notifications. Toggling the setting off removes this device's roster row immediately and unsubscribes the browser; subscriptions that the push service reports as expired are pruned from the roster automatically. Provider-side retention (Supabase backups or GitHub logs) is managed by those providers. Do not post subscription identifiers in public issues. See Supabase's privacy policy and GitHub's privacy statement for those services.

Deleting your data

• In the game: Settings → Reset all progress resets game progress and preferences. It also resets local reminder timing and disables reminders, and attempts to close local notifications. It does not clear the offline cache, revoke browser permission or erase provider-side records; toggling Daily push off removes this device from the delivery roster immediately.
• In your browser: clearing site data removes local game data. Use browser notification settings to revoke permission. Clearing local data cannot itself erase provider-side records; toggle Daily push off first to leave the delivery roster.

Advertising

Arrow Out! currently loads no advertising SDK, AdSense code, ad cookies or consent-management system. The rewarded-hint screen is a labelled five-second demo, not a real ad. No advertising provider is integrated. If a future release adds ads, its actual provider, data use and required user choices must be reviewed, implemented and disclosed before enabling that release. No consent or legal-compliance guarantee is made for a future integration.

Security

Your game progress stays on your device, which limits exposure, and the public GitHub Pages site uses HTTPS. Still, no online service can guarantee absolute security: information that travels over the internet (requests to the hosting service or notification providers) can in principle be intercepted or accessed by the parties operating those services. Please keep sensitive personal details out of public GitHub issues.

Privacy requests and limitations

This page describes the implemented behaviour; it is not a legal compliance certification. There is no automated access-request service or private contact form. For a general privacy question, use the Contact page without including personal data. Do not put push endpoints, encryption keys or other identifiers in public issues. This page does not provide a private route for sensitive requests or guarantee provider-side deletion.

Children

Arrow Out! has no accounts, and the game itself never asks for a name or email address; the Contact page asks only for a subject and message. Do not put personal details in them. Local reminders store only preferences and timing on your device; daily push identifiers are described above. Any future advertising integration needs a separate review of age, consent and applicable privacy requirements before launch.

Changes

If this policy ever changes (for example, if advertising or a backup service is added), the updated policy will be published on this page with a new last-updated date.

Contact

General questions: use the Contact page or open an issue directly at github.com/parya5103/Fletch_Game/issues. Both routes lead to public issues; do not include private data.

Arrow Out! is an offline-first PWA. See the About page to learn more, or the Contact page to get in touch.