Privacy at the arcade.
This notice explains the information used to run CXL Minigames, protect fair play, and save your progress.
Last updated: November 3, 2026
Who this notice covers
This notice applies to CXL Minigames. CXL Games provides support through its official Discord community. Other websites, Discord, and hCaptcha have their own privacy notices. Following an external link takes you to that service.
Accounts and public profiles
When you create an account, you provide an email address, password, and public player name. A password hash is stored for authentication. Sign-in session and security records can include your network address, browser user-agent, session expiry, and request counters. This account is separate from accounts on other CXL websites. The arcade stores your account identifier, chosen player name, XP, level, point balance, and cosmetic ownership and selections. We use the account identifier to connect you with your saved progress.
Your player name, game scores, level, and selected profile cosmetics may appear on the leaderboard. Your email address is not shown there. Choose a nickname if you do not want your real name displayed publicly.
Gameplay and fair-play checks
We store round details, accepted gameplay inputs and timing updates, results, daily play counts, and point and cosmetic activity. These records let us check a result, prevent duplicate rewards, investigate a failed round, and protect the arcade against automated abuse.
Security processing includes a random device identifier, verification state, request counts, and reasons when a check fails. When trusted hosting information supplies a network address, our arcade counters use a keyed hash that changes each day. We do not store the raw network address in those arcade protection tables. Our hosting provider may process network and request information to deliver and secure the website.
Cookies and browser storage
| Storage | Purpose | Duration |
|---|---|---|
| Sign-in session cookies | Keep you signed in and connect authenticated requests with your account. | Until the session expires or you sign out. |
| arcade_guest cookie | Separates guest play sessions and daily counts. | Up to one year, unless cleared sooner. |
| arcade_device cookie | Connects site checks and active rounds with this browser. | Up to one year, unless cleared sooner. |
| Local browser preferences | Saves favorite games and sound preferences on this device. | Until you clear the website’s browser storage. |
The guest and device cookies are necessary for the play and security features and are not accessible to page scripts. Account sign-in and hCaptcha may use additional cookies or storage. Clearing cookies can end your session or require new verification; it does not delete a signed-in account’s stored points or history.
hCaptcha
Rewarded play uses hCaptcha, provided by Intuition Machines, to check for automated activity. When you open its verification, hCaptcha can process information such as your network address, browser and device details, and challenge interactions. Where a trusted network address is available, we may send it to hCaptcha as part of server verification.
See the hCaptcha Privacy Policy and Terms of Service. A separate site check tests whether the browser can load required page resources. That check does not display advertisements or award points for an ad view.
Advertising and analytics
This version does not load Google advertising code or independent advertising or analytics tags. Game rewards are based on validated game performance, not on viewing or clicking ads.
If Google advertising is introduced, this notice will identify the active advertising providers and the available privacy controls. Google and other advertising vendors may then use cookies to show ads based on prior visits to this website or other websites. Google’s advertising cookies can support personalized advertising across sites. You can manage Google’s ad personalization through My Ad Center and read how Google uses information from partner sites.
Advertising remains disabled while the publisher account and required consent setup are pending. Appropriate consent choices, including a Google-certified consent platform where required, must be configured before relevant advertising is enabled. These future advertising disclosures do not mean that advertising cookies are being set by the arcade now.
Storage and retention
The website is hosted with Cloudflare, and its account and game database is hosted with DigitalOcean. These services process the information needed to deliver and operate the arcade.
Account progress, game records, accepted inputs, and point receipts remain stored so we can provide your account and reconcile activity. There is currently no fixed automatic deletion date for those persistent records.
Verification grants and resource checks have short validity periods. Cleanup gradually removes expired resource checks, older rate counters, consumed token hashes, and security events as the service handles traffic. Expiry prevents an old verification from authorizing new rounds even if its record has not yet been removed. Necessary account and security information is processed by our hosting and security providers and may be processed outside your country.
Your choices and requests
You can change your public player name in your profile, sign out, clear this browser’s preferences, or stop using the service. To ask about access, correction, or deletion of account information, contact CXL Games through the official support Discord and ask for a private support route. We may need to verify that a request belongs to the account holder.
Do not post passwords, authentication tokens, verification responses, or private account information in public channels. The arcade is a general-audience service; if you have a concern about information provided by a child, contact support. Material changes to this notice will be published here with an updated date.