Privacy

The short version

Anonymous play creates no account, sends no request and writes no row anywhere. That is not a courtesy setting: it is a requirement of the product, and the build fails if an anonymous game ever reaches server code.

There is no analytics library in the web page or in the Quest application. Not one.

What is kept, and only while you have an account

• Your email address — it is how you sign in, and it is held by our authentication provider rather than by this product.
• A handle, a display name, an avatar seed and a country — what other players see beside a score.
• Scores, and the input trace behind each one. A leaderboard score is re-simulated on the server to check it, and the trace is what gets re-simulated.
• Machines you build, and their versions. They are yours, and they are data rather than code.
• Paired headsets: the model, the account that paired it and when it was last used, so you can revoke one you no longer have.
• Subscription state: which tier, from where, and until when.

Your avatar is a seed, not a picture

Every asset in this product is generated in code — zero image files, zero audio files, zero 3-D models — so there is nothing to upload, no upload to moderate, and no image of you anywhere.

What is never collected

• No analytics SDK, in the browser or in the headset application.
• No advertising, no behavioural profiling, and no data sold or shared with a broker.
• No third-party trackers. The front door makes no request to anywhere but this site, and a test fails the build if it ever does.
• No card details. Payment is handled by Stripe; card numbers never reach this product.
• No recordings. Voice in the arcade is peer-to-peer and live — not recorded, not stored, not transcribed.
• No hardware identifier. The installation id is minted rather than read off the device, so it means this copy on this headset and correlates with nothing else you own.

Diagnostics, exhaustively

The whole diagnostic surface is a closed vocabulary of eighteen event kinds and eleven dimensions: renderer, device class, headset, operating system, browser, display rate, input method, machine id, machine version, route and reason.

None of them is a person. Each exists because the product can act on it — a defect that only happens on one renderer, one device class, one refresh rate. Anything outside those lists is dropped on your device before it is sent, and the server drops it again on the way in.

On a Quest

The headset application asks Meta for exactly three things: whether this account owns the application, an id scoped to us with your alias so the pairing screen can show which device is being linked, and a one-time proof that the id is really yours.

The id is scoped to us. It is not your Meta account name and cannot be used to find you anywhere else. It is stored on the headset-link row and nowhere else.

Your controls

Two things account deletion deliberately does not do, and you are told rather than left to find out. It does not delete your sign-in identity, which is shared with other applications on the same account. And a subscription outlives the profile, because it lives with the payment provider — so cancel it there as well.

• Delete everything on this device — in Settings. Scores, replays and the unfinished game kept locally.
• Delete your account and everything attached to it. You have to type your handle back, because it is the one irreversible thing here.
• Revoke a paired headset, from the account page.
• Two separate mutes — "do not hear me" and "do not play them to me" — both remembered.

Children

This product is rated 13+. It is not directed at children under 13 and does not knowingly keep data from them. Anonymous play needs no account and collects nothing at all, which is the mode a child can use without any of the above applying.

Who publishes this, and how to reach us

HCC Pinball Arcade is published by Holmes Computer Consultants — https://www.holmesconsultants.com. Questions about anything on this page go there, or through the support page.