Privacy Policy
Effective and last updated: 25 October 2026
This policy explains how ARCANA MUNDUS handles information in connection with UNHOLY, unholy.website and BLACK RIVER ARCADE, a platform for free browser games, online scores and separately announced events. ARCANA MUNDUS is the developer brand responsible for the service. For privacy questions and requests, contact unholy.game.blackriver@gmail.com.
1. Information we handle
When you sign in through Google or Apple using Supabase Auth, the service receives an account identifier, email address and the basic identity information supplied by your provider, which can include a display name or profile image. Apple may supply a relay email address. Supabase maintains the authentication account and session information needed to keep you signed in. We do not receive your Google or Apple password. You choose a nickname for use in the arcade.
2. Game data and result verification
Online features process your account identifier, nickname, game and event identifiers, scores, waves reached, run statistics, achievements and submission times. Where supplied by a game, run identifiers, timing, game version, gameplay events and integrity checks may be processed to validate results, detect manipulation and review disputes. A submitted result can remain pending or be rejected; submission does not guarantee a ranking or prize. This policy does not claim that every run is automatically verified.
3. Why information is used
Information is used to authenticate players, maintain accounts, provide game features and rankings, administer announced events, review suspicious results, resolve support requests and protect the service. If applicable law requires a legal basis, service delivery is based on the relevant contractual relationship, security and fair-play processing on legitimate interests where permitted, and processing requiring consent on that consent. We use information received through Google sign-in for account access and the connected features described here, rather than access to your Gmail, Drive or contacts. The sign-in flow is used to identify your account, not to request access to those services.
4. Public nicknames, scores and winners
HIGH SCORES publishes nicknames and game results, including rank, score and wave where available. THE LEGENDS OF BLACK RIVER publishes winner nicknames, placements and results for announced events. Email addresses and private account identifiers are not intended for these public tables. Choose a nickname you are comfortable making public. Other visitors can copy public results, and we cannot remove copies controlled by them. Any additional publication required by a prize event must be explained in that event’s separate rules.
5. Browser storage and embedded media
Games use localStorage for local records, preferences and related game state. Authentication libraries can also store session information in your browser. Local play records are distinct from server-submitted competitive results. You can clear site data in your browser, which can remove local records and settings and sign you out; this does not delete your server account. Embedded YouTube media and external links can connect your browser to third parties, whose own policies apply. Service and hosting providers may process technical request information, such as IP addresses, browser information and diagnostic logs, to deliver and protect their services.
6. Service providers and disclosure
Google and Apple provide the identity services you select; Supabase provides authentication and online backend services. Sites and its hosting infrastructure deliver the website. These providers process information needed for those roles under their own terms and applicable arrangements. Their relevant notices are linked below. We may also disclose information where required by law, to handle a valid legal request or as reasonably necessary to investigate abuse and protect rights. Public rankings are disclosed to all visitors as described above. This notice does not authorize unrelated marketing uses or the sale of Google account information.
7. Storage, transfers and security
Information is stored in the systems used to operate the service and its providers. Processing may take place outside your country. The applicable safeguards and your rights depend on the relevant law and provider arrangements; we do not promise storage exclusively in any country. Access controls and result checks are intended to reduce misuse, but no online service is risk-free. This notice does not guarantee a particular encryption method or absolute security.
8. Retention
Account information is retained while needed to operate the account and connected features. Submitted runs, verification records and event results are retained for the period reasonably needed for rankings, event administration, fraud review and related disputes. Support correspondence and limited records may need to be retained for applicable legal obligations. There is no confirmed fixed automatic deletion schedule. Local records remain until cleared or removed by browser or device behavior. On a deletion request we assess what can be deleted or de-identified and explain any information that must be retained, why and for how long.
9. Your choices and deletion requests
Email unholy.game.blackriver@gmail.com with the subject “Privacy request” or “Delete account” and identify the arcade nickname and account email concerned. We may request proportionate information to verify ownership; never send a password or authentication code. You can request access, correction, deletion, restriction or objection, and a portable copy where applicable law provides these rights. You may withdraw consent where consent is the basis; this does not undo earlier lawful processing. You may complain to the competent data protection authority where that right applies. We respond within applicable legal time limits and explain any necessary refusal or extension. Account deletion requests cover the authentication account and connected profile and game records, subject to justified retention. There is no promise of an automatic self-service deletion tool. Revoking access in Google or Apple account settings stops that connection but does not itself delete existing arcade data.
10. Children and eligibility
Games can contain horror and violence. Use of an identity provider is subject to that provider’s age requirements and the law applicable to you. Do not provide information if you cannot lawfully use the service. A prize event may impose additional age and location restrictions in its own rules. If you believe a child has supplied information without the permission required by law, contact us so the matter can be reviewed.
11. Changes and contact
We will publish updates on this page with a revised date. Material changes to the use of account information will be explained before the new use begins, and additional consent will be requested where required. Contact for this policy: unholy.game.blackriver@gmail.com.
12. Server aggregate statistics
The server counts successful HTML page requests and site entry requests using daily totals for each page. These totals do not identify unique people or reconstruct browsing journeys. There is no analytics cookie, browser storage, persistent visitor identifier, fingerprint, advertising tracker or analytics script in website pages. IP addresses, user agents, full referrers and query strings are not copied into this analytics database. Anonymous unique visitors, traffic sources, countries and Steam click tracking are disabled. Functional local-game requests count starts, completed sessions and total duration. A per-game token exists only in game memory; the operational session expires after four hours, expired records are removed by cleanup every ten minutes, and aggregate totals are kept. It is not a visitor ID and is not linked to an account. Existing Supabase Auth registrations and competitive game records remain necessary account and game features; aggregate authorized-player activity is calculated from those records. Random server retry receipts expire within 24 hours and are not linked across requests. Hosting providers may still process ordinary security and delivery logs under their own arrangements. Cloudflare may set __cf_bm for bot protection; BLACK RIVER CONTROL does not read or use this hosting security cookie for analytics.