In short: we collect the minimum the game needs to run. There are no server-side accounts, no ads, no payments, and no analytics or tracking cookies. Most data stays in your own browser.
1. Who is responsible
Arrow Tag (arrowtag.zilo-game.dev) is operated by an individual developer in Thailand, Thanakarn Lorlertsakul, who is the data controller under Thailand's Personal Data Protection Act B.E. 2562 (PDPA). Contact: thanakarn.lorlertsakul@gmail.com.
2. Data when you sign in
Guest: you choose a nickname. It is stored only in your browser.
Google: we request only the openid profile scopes and receive your Google user ID, name and profile picture URL. We do not request or receive your email address.
Discord: we request only the identify scope and receive your Discord user ID, display name/username and avatar. We do not request access to your email, servers, friends or messages.
How sign-in works: our server exchanges the code from Google/Discord for an access token, uses that token once to fetch your profile, and then sends the profile (provider, ID, name, avatar) back to your browser in the page address, where the browser stores it locally. The server does not save the access token or your profile in any database, and the token is not used again after this step.
3. Data during play
When you join an online room, your browser sends your display name (up to 12 characters) to the game room; your Google/Discord account ID is not sent. During a match the server processes real-time game data such as the room code, team, character position and pose, arrow codes, scores, ready status and the tag (kill) feed, and relays it to the other players in the same room. Players in the room can see your name and in-game actions.
This data is used only to run the game. Room state (such as mode, map, scores and round) may be kept temporarily in Cloudflare Durable Objects while the room is active. Quick-play rooms erase their state when the last player leaves; for private rooms, some room state may remain in temporary storage until it is overwritten when that room is used again. The public room list (room code, mode, map, player count) drops inactive rooms within minutes. We do not build profiles, long-term statistics or play histories linked to you.
4. Data stored in your browser
The game uses your browser's localStorage and sessionStorage. This data stays on your device; we do not receive a copy:
at_name — your display name
at_user — your signed-in profile (provider, ID, name, avatar) or guest status
at_cfg — settings such as controls, touch layout, volume and language
at_mode, at_pickmap — the last mode and map you picked
at_maps — maps you made in the map editor
at_go, at_rejoin (sessionStorage) — short-lived data used to rejoin a room after a page reload; cleared when the tab closes
5. Cookies
We do not use advertising or tracking cookies. During Google/Discord sign-in we set a security cookie, at_oauth, containing only a random value used to confirm the sign-in really came from you; it expires within 10 minutes. Cloudflare may set strictly necessary cookies for network security.
6. Server logs and third parties
Cloudflare hosts the game and may automatically log request data such as IP address, time, requested URL and browser information for operation, security and debugging (observability). We use this only to run and protect the service.
Babylon.js CDN (cdn.babylonjs.com) — the game loads its 3D engine from this server, which sees your IP address as part of normal file delivery.
Google / Discord — if you choose to sign in, these providers process data under their own privacy policies. If the game is offered as a Discord Activity, Discord's policies also apply.
We do not use third-party analytics (such as Google Analytics) and show no ads.
7. Purposes and legal bases
We process data to (a) provide the game you ask to use (contract), (b) identify you when you choose to sign in (contract/consent), and (c) keep the service secure and prevent cheating or abuse (legitimate interests). We do not sell personal data.
8. Sharing and international transfers
We do not share your data with anyone except the providers listed in section 6, other players in your room (your name and in-game actions), or where required by law. Cloudflare runs a global network, so data may be processed outside Thailand; these providers apply their own data-protection safeguards.
9. Retention
Gameplay data is transient as described in section 3. Browser data stays until you clear it or sign out. Cloudflare request logs are kept for the period Cloudflare sets for that service. Emails you send us are kept only as long as needed to respond.
10. Children
The game is for general audiences. Children under 13 should play only as a Guest and should not sign in with Google or Discord or use their real name in game. We do not knowingly collect personal data from children; if a parent believes we have, please contact us.
11. Your rights and how to delete data
Under the PDPA and similar laws (such as the GDPR) you may ask to access, correct, delete, object to or restrict processing of your data, withdraw consent, and complain to a supervisory authority (in Thailand, the Personal Data Protection Committee). Because we hold almost nothing on our servers, the most effective steps are:
Use "Sign out" in the game and/or clear the site data for arrowtag.zilo-game.dev in your browser.
Remove Arrow Tag's access from your account: Google at myaccount.google.com/connections, Discord under User Settings → Authorized Apps.
Email us for any other request; we will reply within 30 days.
12. Changes to this policy
If we change how data is handled (for example, adding accounts or map uploads), we will update this policy and its "Last updated" date before the change takes effect.