Privacy

What Rep Arcade and the classic Outfast Arcade store.

Rep Arcade: your camera stays on your device

Rep Arcade requests video only. Frames are processed locally for movement control; they are not recorded, stored, uploaded, or shared. We do not request a microphone, identify faces, or send frames to an AI service. Turning the camera off or leaving the game stops camera access.

A secure first-party HttpOnly cookie remembers a random guest identifier for one year. It is not an account or a fingerprint. Short-lived round records contain active time and movement-control timestamps and expire after 20 minutes. Post score publishes your chosen nickname, time, reps and achieved date; we retain at most one personal best per guest. You can play without posting. A local browser value also remembers your personal best.

Classic arcade at /classic

Company data you submit

Your website URL, company name, one-line pitch, and favicon are public. They appear on the classic arcade, in the maze, and on its leaderboard while your company is live, and in the public history afterwards.

What we store

Playing asks for three things and stores exactly those:

• the website URL you submit, and its normalised domain;
• your company name;
• your one-line description.

Alongside them we keep your gameplay results, aggregate click counts on your card, and browser/session identifiers used to run the game and to limit abuse.

No email, no marketing consent

Public play does not ask for an email address and there is no marketing consent step. We do not send you email, because we do not collect an address. Submissions made before this change may still hold an address supplied at the time; those records were left untouched and are not used for marketing.

Game session state

While you play, your position and your score are held briefly in a short-lived cache so other visitors can watch the live match. This data expires within seconds of your round ending and is not part of your permanent record. Completed results — whether you won or lost, your score, and how long the round took — are stored durably.

Visitor presence and arcade visits

The “watching live” number counts browsers that sent a heartbeat in the last 45 seconds. When that data is unavailable we hide the number rather than estimate it.

Arcade visits counts browser-days: one visit per browser per calendar day. It is deliberately not labelled as unique people, because one person using two browsers counts twice and two people sharing a browser count once.

Browser identity

We set a first-party cookie holding a random identifier so you do not have to re-enter your website on every visit. That identifier is hashed with a server-side secret before it is stored. A separate secure cookie remembers your company; it is signed and marked HttpOnly, so page scripts cannot read it.

IP addresses

We do not retain raw IP addresses. For abuse throttling only, an IP is truncated to its network prefix and then hashed with a server-side key. The result is short-lived, kept only in the rate-limit cache, and is never written to the database.

Click aggregation

Clicks on a defender are counted in hourly totals per company and placement. We do not record who clicked, and we do not build a profile of any visitor.

Retention and deletion

Submissions, including from founders who never win, are retained so the history of the homepage stays accurate. To have your company or email removed, contact us through TrendsFast and we will action it.