Privacy

Effective 15 October 2026. If this policy changes, the new version will be posted on this page with a new date.

RIFFCADE is a collection of open-source browser games at riffcade.com, plus a chat app that brings the arcade into ChatGPT and Claude. It is run by Albert D Matalon, LLC. This page explains what we store, who else is involved, and how to have your data deleted.

What we store

• Play counts: when a game starts, we store the game, the time, and whether it was played on the website or in a chat app. No ID or other identity is attached.
• Star ratings: when you rate a game, we store the game, the stars (1 to 5), the time, and a random ID. On the website the ID is created in your browser the first time you rate. It lets a second rating replace your first instead of counting twice. The ID is not linked to your name, email, account or device.
• Usage counts: on riffcade.com (not in the chat apps) we count steps such as a visit starting, a game starting, today's challenge being played or shared, a "New games every morning" button being tapped (and which wording of the daily prompt you were shown), the privacy choice made, and how regularly the player plays (weak, okay or strong, worked out on your device from the history below). Each count stores the step, the day and a random session ID that your browser creates for the open tab and deletes when the tab closes. No IP address, device details or lasting ID is stored with it.
• On your device only: your random ID, your last game, your chosen category, your install-prompt choices, the position of the pause button, your daily-challenge streak, a short play history (for each of the last 35 days: how many games and minutes you played and whether you came from your AI's daily task, plus where your first visit came from), the daily-prompt wording you were shown, your privacy choice and the day the "New games every morning" card was last shown are kept in your browser's local storage. A service worker caches the arcade's files so they load faster. None of this is sent to us, except the random ID when you rate a game.
• Abuse protection: to limit spam ratings and counts, our server keeps your IP address in memory for one minute and never writes it to the database.

What the chat app receives

ChatGPT and Claude process your conversations under their own privacy policies (OpenAI, Anthropic). RIFFCADE never sees your conversation. It only receives the inputs of the tool the assistant calls:

• show_arcade: an optional category and an optional search text. They are used to pick games and are not stored.
• new_games: no inputs.
• play_game: a game name or slug. It adds one play count as described above. Nothing else is stored.
• rate_game: the game slug, the stars (1 to 5) and an optional client field. The arcade card in the chat fills client with a random ID that it creates and keeps in the card's local storage. We store it as mcp: followed by that ID, together with the game, the stars and the time, so a repeat rating replaces the first one. If client is missing, we generate a new random ID for that one rating. The ID is not linked to your chat account, your name or your conversation.

Tool requests come from OpenAI's or Anthropic's servers, not from your device.

How long we keep it

Play counts, usage counts and ratings (with their random IDs) are kept for as long as RIFFCADE runs, because they make up the public play and star counts. They are deleted when the service shuts down. The IP addresses used for abuse protection are kept for one minute. Our hosting providers' request logs are kept under their own retention policies.

Deleting your ratings

Email privacy@riffcade.com and we will delete them within 30 days. For ratings made on the website, include your browser ID. For ratings made in a chat app, tell us the game, the stars and roughly when, and we will find and remove them. Clearing your browser's site data removes everything stored on your device.

Who else is involved

• GitHub Pages hosts riffcade.com. Railway hosts the server for play counts, ratings and the chat app (mcp.riffcade.com). Cloudflare provides DNS and forwards email sent to privacy@riffcade.com. As with any website, these providers receive your IP address and browser details when you connect, and may log them under their own policies.
• Google Fonts (fonts.googleapis.com) serves the typeface on our pages and in the chat card. cdnjs (Cloudflare) serves the three.js library on the home page. Both receive your IP address when your browser loads these files. Our pages set no cookies unless you accept analytics and ad measurement (below).
• Your choice: the first time you visit riffcade.com we ask whether to allow analytics (Google Analytics) and ad measurement (Meta). Both stay off unless you tap Accept: until then their scripts are not loaded at all and nothing is sent to Google or Meta. Change your mind any time with Privacy choices at the bottom of the arcade and the home page; withdrawing stops them and deletes their cookies from our site. Games in our Kids category never load either, whatever you chose. The chat apps, riffcade.com/today and this page load neither.
• Analytics (only if you accept): Google Analytics 4, provided by Google Ireland Ltd, counts visits, pages and button taps, and for each game: which game, how long you played, your score, how the game ended and where you came from (for example your AI's daily task, and which line of its list you tapped). It also receives the play-history summary from your device (days played in the last week, whether you use the daily task, which AI, where you first came from, whether RIFFCADE is installed), so we can see which habits keep people playing. Google receives your IP address (which it uses for approximate location and does not store), browser and device details, and sets analytics cookies (_ga). Advertising features are off: we don't share this data with Google's ad products. Google Privacy Policy.
• Meta pixel (only if you accept): the Meta pixel tells Meta (Meta Platforms Ireland Ltd in the EU) that you visited, that you started a second game, and that you tapped a "New games every morning" button. Meta receives your IP address and browser details and may set a cookie (_fbp). We use it only to measure our own ads on Facebook and Instagram. Meta Privacy Policy.
• Legal basis (EU/UK): analytics and the Meta pixel run on your consent (GDPR Art. 6(1)(a) and the ePrivacy rules on cookies). Play counts, ratings and usage counts rely on our legitimate interest in running a free arcade (Art. 6(1)(f)); you can object by emailing us.
• Ads: no ad network is loaded today. The website shows a labelled placeholder between some games, and the chat apps show no ads. If we ever add an ad network, we will update this page first and say whether it uses cookies.
• The games: every game is served from riffcade.com, and the player blocks links and redirects to other sites. Two open-source games, SkiFree.js and NS-Shaft, include their authors' original Google Analytics code, which may set Google cookies.

What we don't do

• No accounts, no names, no email addresses, no location, no chat content.
• We don't sell your data. Google and Meta receive the data described above only if you accept.

Children

RIFFCADE is not directed at children under 13, and we do not knowingly collect personal data from them. Games in our Kids category never load analytics or the Meta pixel. If you believe a child has sent us personal data, email privacy@riffcade.com and we will delete it.

Security

All traffic uses HTTPS. The database holds only game names, stars, times and random IDs, and only the operator can access it on the hosting provider. No system is perfectly secure, but we keep as little as possible so there is little to lose.

The games

Each game is someone else's open-source work, shown with its original licence and credit (tap ⓘ in a game). Games run in your browser.

Contact

Albert D Matalon, LLC. Email privacy@riffcade.com, or open an issue on GitHub.

Back to the arcade