Privacy Policy

1. Controller

The controller responsible for data processing on this website is:

Alice Suki
trading as Arceus
Engelliederstraße 22
10178 Berlin
Germany
Email: arceus.info@proton.me

2. Hosting through Cloudflare Pages

The public website is provided through Cloudflare Pages by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. When the website is accessed, Cloudflare processes technically necessary connection data such as the IP address, time, requested page, browser, device and referrer information. This processing is required to deliver the website securely, reliably and quickly through Cloudflare's global network. The legal basis is Art. 6(1)(f) GDPR.

Cloudflare may process technical data outside the European Economic Area. Information about recipients, retention and safeguards for international transfers is available in the Cloudflare Privacy Policy, the Cloudflare Data Processing Addendum and the subprocessor list.

Arceus does not operate its own access logging for the website and has not enabled Cloudflare Web Analytics.

3. Local device storage for Snake

When you start Snake, the game stores your chosen player name, skin, music preference and a randomly generated device identifier in your browser's local storage. This restores your settings and links a personal best to the same browser profile.

The data remains on your device until you overwrite it or delete the website data in your browser settings. Arceus does not use this storage for tracking or advertising. Access is necessary for the game, settings and leaderboard features requested by you under § 25(2) no. 2 TDDDG. Where personal data is involved, processing is based on Art. 6(1)(b) GDPR and, for leaderboard integrity, Art. 6(1)(f) GDPR.

4. Cloudflare game server, multiplayer and leaderboards

When the Arceus home page loads, the Snake module automatically retrieves the current public Top 100 from the Arceus game server. Cloudflare processes technically necessary request data such as the IP address, time, requested route, and browser and connection information. This leaderboard-only request does not transmit the local device identifier, name or skin.

When you start Snake, the selected player name, skin and random device identifier are transmitted to the game server over an encrypted WebSocket connection. Controls and game-state data are also processed during a round. Your player name, skin and current points are visible to other connected players in the game world and the LIVE leaderboard.

Before persistent assignment, the server converts the device identifier into a pseudonymous SHA-256 profile identifier. A personal best record may contain the profile identifier, player name, points, eliminations, survival time and timestamps. The public Top 100 displays the player name, points and eliminations. Do not use a name that you do not want to be shown publicly.

The game server is provided as a Cloudflare Worker with a SQLite-backed Durable Object by Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA. Processing of the shared game world and persistent leaderboard storage is restricted to Cloudflare's EU jurisdiction. Worker requests are delivered through Cloudflare's global network; billing, security and technical metadata, including the Durable Object identifier, may also be processed outside the EU. Further information is available in the Cloudflare Privacy Policy, the Cloudflare Data Processing Addendum and the subprocessor list.

Arceus has disabled persistent Worker observability and does not write its own application logs. Cloudflare may still process technical metadata required for operation, security and billing under its terms. The leaderboard retains only the best score per browser profile and is limited to 5,000 profiles; no fixed time-based deletion period is configured.

In the Top 100 window, “Delete my entry” immediately removes the leaderboard profile stored for this browser. The local device identifier is transmitted once over an encrypted connection, converted again into the SHA-256 profile identifier and then deleted with the personal best. Local settings remain in the browser until you remove the website data in your browser settings. Playing again later may create a new entry. If the function is unavailable, you can contact the email address above.

Processing is based on Art. 6(1)(b) GDPR for the game session requested by you and Art. 6(1)(f) GDPR for secure operation, abuse prevention and a fair public leaderboard.

5. Contact by email

If you contact us by email, we process your message, email address and any information you provide to answer your request. The legal basis is Art. 6(1)(b) GDPR where the request concerns a contract or pre-contractual steps, and otherwise Art. 6(1)(f) GDPR. Data is deleted once the request has been completed unless statutory retention or evidence obligations apply.

6. External links

This website links to myDailyQuest, Instagram, TikTok and YouTube. These services are not embedded. A connection to the respective provider is established only when you click a link, and that provider's privacy policy then applies.

7. No first-party analytics or advertising

Arceus currently uses no Google Analytics, marketing pixels, advertising networks or embedded social-media plugins. Private game data is not sold or used for personalised advertising.

8. Your rights

Subject to the applicable legal requirements, you have rights to access, rectification, erasure, restriction of processing, data portability and objection. You may withdraw consent with effect for the future and lodge a complaint with a competent data protection authority. To exercise your rights, email arceus.info@proton.me.

9. Security and updates

The website is delivered through encrypted HTTPS. No online service can guarantee absolute security. This policy will be updated if functions, hosting providers, services or legal requirements change.

Last updated: 17 August 2026