Privacy Policy
Last updated: 8 September 2026
We respect your privacy. This policy explains what data Lizard Arcade collects, why we collect it, and how we keep it safe. We never sell your personal data to third parties.
1. WHO WE ARE
Lizard Arcade is a free browser-based gaming platform operated at thelizardarcade.co.uk (the "Site"). For the purposes of UK data protection law, the data controller is the operator of thelizardarcade.co.uk.
If you have any questions about your personal data, please contact us at the email address listed in Section 12.
2. DATA WE COLLECT
Account Data (if you register)
- Username — chosen by you, displayed publicly on leaderboards and profiles
- Email address — used for account management and password resets only
- Password — stored as a one-way bcrypt hash; we cannot see your password
- Profile customisations — avatar colour, icons, frames, titles you have earned or purchased
- Account metadata — date joined, last active, play streak, arcade coins balance, XP and level
Gameplay Data
- Game scores — scores submitted to leaderboards, including game name, score and timestamp
- Tournament entries and results — which tournaments you entered and your final placement
- Daily activity — spin wheel usage, daily question responses, weekly quest progress
- Coins and XP — transaction history of coins earned and spent
Technical Data
- Session cookies — used to keep you logged in during a browser session
- Device fingerprint (anonymous) — a non-identifiable hash used solely for basic anti-cheat detection, not linked to any personal data
- Server logs — standard web server access logs (IP address, page visited, timestamp) retained for up to 30 days for security purposes
Data You Choose to Share
- Shoutbox messages — public messages you post in the global shoutbox
- Direct messages — private messages sent to other users via the friends system
- Profile bio — any biographical text you add to your profile
Data We Do NOT Collect
- We do not collect your real name, address or phone number
- We do not collect payment card details (handled entirely by Stripe if applicable)
- We do not track your activity across other websites
3. HOW WE USE YOUR DATA
- To provide the service — running your account, saving scores, displaying leaderboards, processing tournament entries
- To personalise your experience — remembering your avatar, level, coins and preferences
- To maintain fair play — detecting and preventing cheating or abuse using anonymous device hashes
- To communicate with you — password reset emails and, if you opt in, service updates
- To improve the Site — aggregated, anonymous analytics about which games are popular and how the site is used
- To display advertising — if you consent to advertising cookies, your visit data may be used to serve relevant ads via Google AdSense
We do not use your data for automated decision-making or profiling that produces legal or similarly significant effects.
4. LEGAL BASIS FOR PROCESSING
Under UK GDPR, we rely on the following legal bases:
- Contract — processing necessary to provide you with the account and services you signed up for
- Legitimate interests — server logs and anti-cheat measures to keep the platform secure and fair
- Consent — advertising cookies and optional marketing communications. You may withdraw consent at any time
- Legal obligation — retaining records we are required to keep by law
5. COOKIES
We use cookies to make the Site work and, with your consent, to serve advertising.
- Essential cookies — session cookies that keep you logged in. These are strictly necessary and cannot be disabled without breaking the site.
- Analytics cookies — anonymous aggregate statistics about site usage (if enabled)
- Advertising cookies — set by Google AdSense if you consent. These allow personalised ads to be served based on your interests.
You can manage your cookie preferences at any time using the cookie banner on your first visit, or by clearing your browser cookies. Withdrawing consent for advertising cookies will stop personalised ads but may still show contextual ads.
6. THIRD-PARTY SERVICES
We use the following third-party services that may process your data:
- Google AdSense — serves advertising. Google may use cookies to personalise ads. See Google's Privacy Policy.
- Discord — we post automated announcements to our public Discord server using webhooks. No personal data beyond your public username is shared with Discord.
- Stripe — processes payments for any coin purchases. We never see or store your payment card details. See Stripe's Privacy Policy.
- Google Fonts — loads fonts from Google's CDN. Google may log your IP address. See Google's Privacy policy.
- Hosting (Plesk / server provider) — your data is stored on servers in the UK/EU.
We do not sell, rent or share your personal data with any third party for their own marketing purposes.
7. DATA RETENTION
- Account data — retained for as long as your account is active. If you request deletion, we will remove your personal data within 30 days.
- Game scores on leaderboards — scores may be retained in anonymised or pseudonymised form after account deletion to preserve leaderboard integrity.
- Server logs — deleted after 30 days.
- Payment records — retained for 7 years as required by UK tax law (HMRC).
8. YOUR RIGHTS
Under UK GDPR you have the following rights:
- Right of access — request a copy of the personal data we hold about you
- Right to rectification — ask us to correct inaccurate data
- Right to erasure — ask us to delete your account and personal data
- Right to restrict processing — ask us to limit how we use your data
- Right to data portability — receive your data in a machine-readable format
- Right to object — object to processing based on legitimate interests
- Right to withdraw consent — withdraw advertising cookie consent at any time
To exercise any of these rights, contact us using the details in Section 12. We will respond within 30 days. You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.
9. CHILDREN'S PRIVACY
Lizard Arcade is intended for users aged 13 and over. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has registered an account, please contact us and we will delete it promptly.
Users aged 13–17 should have parental or guardian permission before registering. Parents or guardians may contact us to request deletion of a minor's account.
10. SECURITY
We take reasonable technical and organisational measures to protect your data, including:
- HTTPS encryption on all pages
- Passwords stored using bcrypt hashing — never in plain text
- Database access restricted to server-side code only
- Admin areas protected by separate authentication
No system is 100% secure. In the event of a data breach that affects your rights and freedoms, we will notify you and the ICO as required by law.
11. CHANGES TO THIS POLICY
We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page. Significant changes will be announced via the site's announcement system. Continued use of the Site after changes constitutes acceptance of the updated policy.
For any privacy-related queries, data requests or complaints: