The short version
ARCADEBOX.AI is an AI game maker: you describe a game in plain English and we build you a playable game. To do that, we keep an account for you, run your prompts through AI services, store the games you make (their designs, game code, and version history), and handle your plan and payments. This page explains, in plain English, what we collect, why, who we share it with, and the controls you have. No jargon dumps — promise.
If you only read one thing: we don't sell your personal data, your typed prompts and any images you upload are sent to the AI providers that build your game, and you can delete your account (and everything in it) at any time.
1. Who we are (the data controller)
ARCADEBOX.AI is operated by Ailora Limited ("ARCADEBOX.AI", "we", "us", "our").
For privacy questions, requests, or complaints, contact us at privacy@arcadebox.ai.
For the purposes of UK and EU data protection law, ARCADEBOX.AI is the "data controller" of your personal data — meaning we decide what we collect and why.
2. What we collect
We try to collect only what we need to run ARCADEBOX.AI. Here's the full list.
Information you give us
- Account & sign-in details. Sign-in is handled by our authentication provider. You can create an account with an email address and a password (plus an optional display name), continue with Google, Discord, or GitHub, or use a one-time magic email link. If you continue with Google, Discord, or GitHub, that provider shares the basic profile it holds with us — typically your email, name, and avatar — under its own terms when you choose it. Some sign-in methods may still be rolling out.
- Your password. If you create an email-and-password account, we collect a password so you can sign back in — but it's stored only as a secure salted hash by our authentication provider. We never see or store your password in plaintext, and you can reset it at any time via a link we email you.
- Your profile. A username and display name, and an optional avatar.
- The prompts you type. The plain-English descriptions and instructions you send to BIT in the Studio to build and iterate on your game.
- Reference images you upload. Any image you attach to a prompt (for example, to "vibe-match" a look, or a photo/picture you upload to turn into a 3D model).
- The games you create. Depending on the engine, that's the structured game design we generate from your prompts (your "GameSpec") or the real, per-game game code the AI writes for you, plus your game's title, theme, full version history, and any 3D models or other assets you generate or upload. (More on what a "game" is in section 6.)
- Community content you post. Comments you leave on game pages, scores you submit to leaderboards, likes, and creators you follow — shown publicly with your username where the game page is public.
- Teams you create or join. If you use Teams, we store the team's name, who belongs to it, and which games are shared with it. Your username is visible to your teammates, and teammates can see and edit the games shared with that team (each change is recorded as a version with its author). Leaving a team removes your access; it doesn't delete your games.
- Support messages. Anything you send us when you ask for help or contact us.
Information created as you use ARCADEBOX.AI
- Plan, subscription & Credits. Which plan you're on (Free, Starter, Player, Studio, or Developer), your subscription state, and your Credits ledger — your current Credit balance and a record of Credit transactions (grants and top-ups in, and what each AI build, edit, or 3D model spent), tied to your account. We keep this to run the service, show you an accurate balance, and apply the fair-use and anti-abuse limits described in our Terms.
- Play & social activity. Records of games you play, play counts, likes, scores, comments, and follows — used to power The Arcade (our public gallery) and game pages.
- Payment information. When you buy a plan, Stripe processes the payment. We receive confirmation that you paid plus limited billing details (such as a Stripe customer ID and the last four digits / card brand for your records). We never see or store your full card number — Stripe handles that directly.
- Usage, log & device data. Standard technical data such as IP address, browser/device type, timestamps, pages and features used, and error logs. This helps us keep the service running, secure, and reliable.
- Cookies & local storage. Small bits of data stored in your browser to keep you signed in and remember session state (see section 11).
Information we do not collect
- We don't collect special-category data (like health or biometric data) on purpose. Please don't put sensitive personal information into prompts or uploaded images.
- We don't store your card numbers.
3. How we use your information
We use your data to:
- Run ARCADEBOX.AI — create and manage your account, sign you in, show your cabinet (your saved games), and keep your plan status and Credit balance accurate.
- Build your games — send your prompts and any attached images to our AI providers to generate your game design or game code and 3D models, then check, store, and serve the result (including automatically re-running a raw-code game's error through the AI to repair it).
- Process payments — take payments for plans via Stripe and keep your subscription active.
- Provide The Arcade and game pages — show games you've chosen to share publicly, with your username, plus play counts, likes, scoreboards, and comments.
- Support you — answer your questions and fix problems.
- Keep things secure and reliable — detect abuse, prevent fraud, debug errors, enforce the fair-use and anti-abuse limits described in our Terms, and protect ARCADEBOX.AI and its users.
- Improve the service — understand which features are used and where builds fail, so we can make ARCADEBOX.AI more reliable.
Our legal bases (UK/EU users)
Where UK-GDPR / EU-GDPR applies, we rely on these legal bases:
- Performing our contract with you — to run your account, build your games, and process the subscriptions/payments you ask for.
- Legitimate interests — to secure the service, prevent abuse and fraud, and improve ARCADEBOX.AI (balanced against your rights).
- Legal obligation — to keep records we're required to keep (e.g. tax/payment records).
- Consent — for any optional cookies/analytics or marketing where consent is required; you can withdraw consent at any time.
4. Do we train AI on your data?
ARCADEBOX.AI does not build or train its own AI models. We use third-party AI providers (see section 5) to generate your games and 3D models. We do not use your private prompts, uploaded images, or games to train an ARCADEBOX.AI model, because we don't have one.
To run and improve the service, we may review and analyze prompts, builds, and errors — including in aggregated or de-identified form — to fix bugs and make generation more reliable. When you choose to share a game to The Arcade, that game (and your username) becomes public by your choice.
5. Who we share your data with (our subprocessors)
We don't sell your personal data. We do share it with a small set of trusted service providers ("subprocessors") who help us run ARCADEBOX.AI. Each gets only what it needs.
- Managed database & authentication — accounts/sign-in, database, and file storage (EU region,
eu-west-1). Receives your account, profile, games (designs, game code, and version history), community activity, uploaded images, and generated assets. - Google, Discord & GitHub (sign-in / authentication) — if you choose to sign in with one of these, that provider confirms your identity and shares basic profile (email, name, avatar) with us so we can create your account. You only involve a provider if you pick it, and it processes that sign-in under its own privacy policy.
- Stripe — payments for plans. Receives your payment details and billing info (Stripe handles card data directly).
- AI generation providers — third-party AI services that turn your ideas into game designs, game code, and 3D models. They receive the prompts you type and any reference images you attach (and, when a raw-code game auto-repairs itself, the game's code and error message). A current list of subprocessors is available on request.
- Cloudflare (Workers, KV, Durable Objects, Pages) — serves the website, runs the generation backend, caches game blueprints and game code, powers real-time multiplayer rooms, and hosts the app. Receives requests and technical data needed to serve you; game blueprints and code; multiplayer session data.
Important — about AI providers: to build what you ask for, your prompts and any images you upload are transmitted to our third-party AI providers. That content is processed under those providers' own terms and privacy policies. Don't include anything in a prompt or image that you wouldn't want sent to a third-party AI service.
We may also share data:
- To comply with the law — if required by a valid legal request, or to protect our rights, users, or the public.
- In a business transfer — if ARCADEBOX.AI is involved in a merger, acquisition, or sale of assets, your data may transfer to the new owner (we'll tell you if so).
We do not sell your personal data, and we don't share it with advertisers for their own marketing.
6. Your games, prompts, and content
A few words on what your "game" is, because ARCADEBOX.AI builds two kinds of games depending on the engine you pick:
- Blueprint games. For these, the AI produces a structured design (your GameSpec) that our own, hand-built runtime engines read and play. No separate program is written per game — your game is the design, and the runtime that interprets it stays ours.
- Raw-code games. For these, the AI writes real, per-game game code at your direction. We store that code (with its full version history), automatically check it before saving, run it only inside a locked-down ("sandboxed") player in your browser, and — if it breaks — send the code and error back through the AI to repair it.
- What you make and keep. Either way, your game is yours: your prompts, the resulting GameSpec or game code, any assets you upload or generate, and the playable game. You can keep it, share it, or delete it. What stays ours is the ARCADEBOX.AI platform, runtime engines, and sandboxed player — you don't receive or own their source code. (The full who-owns-what is in our Terms, Section 8.)
Note: downloading your game is live as a Studio-plan feature — a raw-code game downloads as a self-contained project containing your game's source code, and a blueprint game downloads its GameSpec design file. A download contains your game's content (its code or design, plus what it needs to run) — never the ARCADEBOX.AI platform's source. Standalone Windows builds (.exe) are also live on the Studio plan. Downloads happen in your browser and don't change what data we hold about you.
Connecting a GitHub repository (live, Studio plan). Studio-plan makers can connect their own GitHub repository and push their game's code to it. If you choose to connect one, we act only on your explicit authorization to push your game's files to the one repository you select, and we store the connection token securely, scoped and encrypted — we never read or touch your other repositories, and you can disconnect at any time from the Studio (revoking the token). We don't collect anything else from your GitHub account beyond what's needed to authenticate and push.
- No game marketplace yet. There is currently no on-platform marketplace to sell games through ARCADEBOX.AI. (Commercial use is governed by your plan and our Terms.) If we ever add on-platform selling or revenue sharing, we'll update this policy and our Terms first.
7. International data transfers
ARCADEBOX.AI is built on services in different countries:
- Your account, database, and files are stored in the EU (
eu-west-1). - Some providers — including our AI generation providers and Cloudflare — are based in or operate from the United States and other countries, so your data (including prompts and images you submit) may be processed outside your home country, including outside the UK/EEA.
Where we transfer personal data internationally, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum (and, where applicable, the providers' certifications under frameworks like the EU–US Data Privacy Framework).
8. How long we keep your data
- We keep your account data and the games in your cabinet for as long as your account is active.
- Certain payment/transaction and billing records are kept as long as needed for accounting, fraud-prevention, and legal/tax obligations, even after individual games are deleted.
- Logs and technical data are kept for a limited period for security and debugging.
- When you delete your account (see section 9), we delete or de-identify your personal data, except where we're legally required to keep certain records.
9. Deleting your account and your data
You can delete your ARCADEBOX.AI account at any time. Deleting your account cascades — it removes your profile, your games (designs, game code, and version history), your community activity (plays, likes, scores, comments, follows), and your uploaded/generated assets.
A few things to know:
- Deletion is permanent. Once your games are gone, we can't get them back.
- Public traces. If you shared games to The Arcade, deleting your account removes them from the gallery, though cached or copied versions may persist briefly.
- Records we must keep. We may retain limited payment/transaction records as required by law (section 8).
Self-serve: you can delete your account yourself at any time from your account page (/account) — no need to email us. (You can also download a copy of your data there; see section 10.) If you'd rather, you can still email privacy@arcadebox.ai and we'll do it for you.
10. Your rights
Depending on where you live, you have rights over your personal data.
If UK/EU data protection law applies to you, you can:
- Access the personal data we hold about you.
- Correct data that's wrong or incomplete.
- Delete your data ("right to be forgotten").
- Port your data — get a copy in a portable format, or have it sent to another service where feasible.
- Object to or restrict certain processing (including processing based on our legitimate interests).
- Withdraw consent at any time where we relied on consent.
- Complain to your data protection authority — in the UK, the Information Commissioner's Office (ICO); in the EU, your local supervisory authority. (We'd appreciate the chance to sort it out first.)
If you're in California (CCPA/CPRA) or another US state with privacy laws, you have rights to know what we collect, to access and delete your data, to correct it, and to opt out of any "sale" or "sharing" of personal data. We do not sell your personal data. We won't discriminate against you for exercising your rights.
Self-serve (access, portability & erasure): you don't have to wait for us — sign in and go to your account page (/account) to download a copy of your data (your profile, games and versions, and activity) as a JSON file, and to delete your account and everything in it. For any other right, or if you'd prefer we handle it, email privacy@arcadebox.ai. We'll verify your identity (usually via your account email) and respond within the time the law requires. These rights are free to use, within reason.
11. Cookies and local storage
ARCADEBOX.AI stores small bits of data in your browser (mostly in local storage rather than traditional cookies) to:
- Keep you signed in (your secure session token lives in your browser's local storage).
- Remember settings and state — like your theme choice and where you were in the Studio.
- Remember your consent choice (see below).
Your choice. A consent banner lets you choose between "essential only" and "accept all". Essential storage (sign-in, settings, consent) always applies because the service can't work without it; any optional tools (such as analytics) run only if you accept them, and you can change your mind by clearing the choice in your browser. We don't use cookies to build advertising profiles or to share data with ad networks.
12. How we protect your data
Reliability and safety are core to ARCADEBOX.AI. Among other measures, we:
- Enforce Row-Level Security (RLS) in our database and route writes through controlled server-side functions, so you can only change your own data — even a hacked browser can't touch someone else's games or account.
- Keep money and plan operations server-side only, behind secret keys the browser never sees, so they can't be tampered with from the client.
- Run raw-code games inside a sandboxed player — AI-written game code is checked before it's stored and runs in a locked-down frame with no access to your account, your data, or the wider service.
- Never store passwords in plaintext. If you sign in with a password, our authentication provider keeps only a secure salted hash of it — we can't see the password itself — and you can reset it at any time via a link we email you.
- Store secrets and API keys securely and limit who can access production systems.
- Rely on reputable infrastructure providers with their own strong security programs.
No system is 100% secure, but we work hard to protect your data and to fix issues quickly.
13. Children & online safety
ARCADEBOX.AI isn't intended for young children. You must be at least 16 years old to use ARCADEBOX.AI, or older if your country requires it. If you're under the age of majority where you live, you should have a parent or guardian's permission. We don't knowingly collect personal data from children under this age; if we learn we have, we'll delete it.
Online safety (UK Online Safety Act). ARCADEBOX.AI hosts user-generated content (games, comments, profiles, messages), so we take online safety seriously:
- Reporting. Every game page has a report control, and anything can be reported to us directly at support@arcadebox.ai. Reports are reviewed by a human and we remove content that breaks our rules.
- Moderation. Prompts and generated content pass through automated safety checks before publication, and our acceptable-use rules prohibit illegal content, harassment, and content that is harmful to children. Accounts that break these rules can be restricted or removed.
- Risk review. We review the safety risks of our features on an ongoing basis as the service grows, and we update our protections (and this policy) as we add features like comments, messaging, and multiplayer.
14. Changes to this policy
We may update this policy as ARCADEBOX.AI grows or the law changes. If we make material changes, we'll let you know — for example, by posting the new version here with a new "Last updated" date and, where appropriate, by notifying you in-app or by email. Continuing to use ARCADEBOX.AI after a change means you accept the updated policy.
15. Contact us
Questions, requests, or concerns about your privacy?
Ailora Limited
Registered in England and Wales, company no. 16660447
Registered office: 71-75 Shelton Street, Covent Garden, London, United Kingdom, WC2H 9JQ
Email: privacy@arcadebox.ai
BIT will pass it on. 🕹️