Back to Rednex Arcade

Privacy Policy

Effective date:

1. Contact

Rednex Arcade is operated by John Christoffer Fredriksen as a private individual, who is the data controller responsible for the personal data described here. The service is run from Norway, not operated through Fredriksen Uteområde AS.

For privacy questions or requests, notices of illegal content, or concerns about an incorrect timeout or other measure, email kontakt@fute.no. Describe the content or measure, where and when it appeared, why you believe it is illegal or incorrect, and your profile identity if relevant. Share only information needed to explain the issue. Do not send passwords, recovery codes, session cookies or Twitch tokens. We may need proportionate information to verify that a request concerns your profile. This is a way to contact the operator, not an automated appeal process or a promise of a particular response time or outcome.

2. Data used by the game

If you contact us by email, your email provider and ours process the message and contact details.

3. Why data is used

We use profile, character, session, game and social data to provide the features you request: returning to your profile, saving characters, playing together, messaging, records and account deletion. Where this processing is necessary to provide the agreed service, the legal basis is performance of that agreement (GDPR Article 6(1)(b)). This does not cover unrelated or merely convenient uses.

Security checks, abuse prevention, handling player reports and rate limiting serve our legitimate interest in protecting players and keeping the service working (Article 6(1)(f)), only where that interest is not overridden by your rights. This requires particular care for younger players. Responding to ordinary support requests serves our legitimate interest in helping players; handling statutory privacy requests is necessary to meet our legal obligations (Article 6(1)(c)).

Authorizing Twitch access is not blanket consent to unrelated uses. Providing sign-in and game data is necessary for the associated features; Twitch sign-in is optional.

The application does not implement advertising, behavioral analytics or sale of personal data. Game validation and rate limits may reject results or requests, and repeated chat spam can automatically cause a temporary chat timeout as explained below. Player reports do not trigger automatic penalties.

You must be at least 13 years old to use Rednex Arcade. The service is not specifically directed at children. If you are under 18, you need a parent or guardian's permission where the law requires it. Being 13 does not by itself satisfy every privacy, contractual or platform requirement. If processing requires consent, local rules may require a parent's authorization; Twitch and other services may have additional age and permission rules. These terms do not replace those requirements.

4. What others can see and service providers

Your displayed name, character/portrait and game results may be visible to other players, including on leaderboards and in replay/shadow-clone features. Social features expose profile identity and relevant presence information. Lobby chat is shared with the room; private messages are relayed to the participating players' connected clients. Do not send sensitive information. Recipients can copy messages, drawings or screenshots; deleting an account cannot erase their independent copies.

These providers may process information outside the European Economic Area (EEA). Cloudflare's Data Processing Addendum, section 6, describes EU Standard Contractual Clauses (SCCs) and additional safeguards for restricted transfers, and transfers under the EU-U.S. Data Privacy Framework (DPF) where applicable. Render's Data Processing Addendum, section 6.2, provides for the DPF where applicable and EU SCCs if the DPF does not apply or ceases to be available; section 6.6 describes supplementary measures for SCC-based transfers.

These are the providers' published transfer mechanisms. Healthchecks.io's Privacy Policy describes appropriate measures for transfers outside the EEA but does not identify a specific SCC or DPF mechanism. For information about the arrangements applicable to our use, hosting locations, or how to obtain a copy of applicable safeguards, use the details under Contact. This policy does not claim that all data stays in Europe.

5. Cookies and browser storage

The application sets functional authentication/security cookies, not advertising cookies. These are Secure and HttpOnly in production:

Local storage keeps your guest drawing, account-specific pending/conflicting character drafts, audio settings, the Show Custom Faces display preference, local best times/replays and shadow-clone preferences. These items have no application-set time expiry and can remain until replaced, removed by the relevant feature, or cleared in your browser. Logging out does not automatically clear this local storage. Session storage holds a lobby return destination and a non-personal pending-deletion notice; its lifetime follows the browser's tab/session behavior, including session restoration.

We do not add a consent banner for these essential session/security functions and storage used for features or preferences you request. You can block cookies or clear site data in your browser, but sign-in, guest recovery and saved drawings/settings may stop working or be lost. Clearing browser data is not a request to delete server data.

This notice does not authorize non-essential tracking.

6. Retention and deletion

Support emails and associated contact details are kept for as long as necessary to handle your inquiry. They are then deleted when there is no other lawful need to retain them.

Profiles, saved characters, records and social links remain until removed through the relevant feature or completed profile deletion. Inactive profiles are not automatically deleted. Sessions become invalid when they expire, at most 180 days after issue. Expired and revoked sessions and their unneeded authentication metadata are automatically removed in batches of up to 100 at server startup and every minute. Sessions are retained while needed for pending account deletion, OAuth transactions, retained token-operation records, or grants whose credentials/revocation or in-flight jobs have not been resolved. Backlogs, downtime or cleanup errors can delay removal. This is deletion of database records, not a guarantee of immediate physical erasure from database files or backups. Expiry does not delete the profile. Short-lived OAuth transactions are cleaned up, except where unresolved operations must be preserved to finish safe revocation. Live room and message state is not a permanent chat archive; private-message history is held in connected clients' memory, not a message-history database. Separately, a bounded server-memory buffer holds up to 10,000 delivered lobby messages and Whispers, with sender profile IDs and recipient profile IDs, for up to 15 minutes so reports can use server-verified evidence. Older entries can be evicted sooner; a restart clears the buffer. Expired or evicted messages and messages from before a restart cannot be content-reported.

Each player report expires 30 days after submission. Startup and minute-based cleanup delete expired reports and evidence with no remaining active reports; downtime or cleanup errors can delay physical deletion. Multiple reports about the same content share one evidence copy, which remains until the last linked report expires or is deleted. Report-limit submission records are removed after 24 hours by the same cleanup. Deleting the reported profile removes its report evidence and linked reports; deleting a reporter removes their reports and limit records. Evidence still linked to another reporter is not removed by that reporter's deletion. Unreferenced evidence is removed by cleanup. Only reported content is copied to the report database; there is no general permanent chat log. Earlier copies can remain in backups under the separate backup rules below.

Chat spam escalation resets after 60 minutes without a new rate-limit violation. Temporary chat timeouts last 5 or 30 minutes. Sending during an active timeout does not extend it. Cleanup clears expired timeout deadlines and deletes expired escalation records on startup and every minute while the server is running; errors or downtime can delay cleanup. Completed profile deletion also removes these records. Earlier copies may remain in backups until those backups are removed.

Accepted account deletion keeps the job and unresolved encrypted credentials only while needed to finish revocation and safe deletion. Settled token-operation records are cleaned up after necessary processing.

The backup code uses retention targets of 14 days for nightly backups and 30 days for migration backups. Old backups are pruned after a successful backup and verification. Failed backup or cleanup runs can delay removal; these are not guaranteed deletion deadlines. Encrypted backups can contain earlier personal data until removed.

When enabled, Settings → Profile offers Delete Guest Profile or Delete Account. If unavailable, use the details under Contact. Logging out is not deletion. An accepted deletion request blocks the account and revokes local sessions; acceptance or sign-out does not confirm completed erasure. Provider revocation and verified backup/restore safeguards must finish before the backend completes deletion. Uncertain or failed steps remain pending, retaining the minimum job/credential data needed to retry.

Completed deletion removes the profile's server-side character, identities, credentials, social relations and owned record/replay data. Restore safeguards prevent older backups from reintroducing a deleted profile; they use a global boundary, not a permanent per-user deletion log. This is separate from the later expiry of backup files. Other players' data and independent copies are not erased.

Accepted deletion clears the current profile's scoped browser drafts on that device. Guest deletion also clears the shared guest drawing; deleting a Twitch account preserves a separate guest's drawing. Unrelated preferences, local records and data on other devices can remain. Clear those devices' site data separately if needed. The tab's pending notice is not an authoritative completion tracker.

7. Safety controls and reports

Lobby chat allows 5 messages per 10 seconds. Whispers allow 10 per 10-second window and 60 per minute. A first excess message is rejected with a warning. A repeated violation within 60 minutes causes a 5-minute chat timeout; a further violation after that timeout causes 30 minutes, with no further automatic escalation. The timeout covers both lobby chat and Whispers, not ordinary gameplay. It uses the verified profile across parallel connections, reconnects and restarts, not a display name. After 60 minutes without a new violation, escalation resets.

Block User stores a profile-to-profile block, removes friendship links and prevents lobby-chat delivery, Whispers and invitations between those profiles. It is not a global ban and does not prevent the players sharing gameplay. There is no separate Ignore control. Turning off Show Custom Faces in Settings, or using H in multiplayer when not typing or using a dialog, locally replaces other players' custom faces with the default yellow smiley. It does not change your own face, saved drawings or what other players see. The preference is saved only in your browser.

Report Player is available on player entries/cards and received lobby messages and Whispers. Offensive Face is reported from a player card using the server's current face, not a previous drawing or your local replacement. Reports are limited to one active report per reporter and player/content across reasons, and 5 new reports per 10 minutes and 20 per 24 hours per verified profile.

Three distinct profiles reporting the same face set a flag for manual review only. Report counts are not proof of wrongdoing and never cause automatic punishment. There is no AI assessment, automatic face removal or report-driven ban, and no new automatic text-content filter. This phase has no administration/review interface or guarantee that reports are actively monitored. For illegal content or an incorrect measure, use Contact; do not rely on an in-game report for an urgent response.

8. Your rights and updates

Where applicable, you may request access, correction, erasure, restriction or portability of your personal data and object to processing based on legitimate interests. Where processing relies on consent, you may withdraw it without affecting earlier lawful processing. These rights have legal conditions; use the details under Contact to exercise them.

You may complain to Datatilsynet, the Norwegian data-protection authority, or to the competent authority where you live or work in the EEA. Requests are normally answered within one month under the GDPR, subject to permitted extensions.

We will update this page and its effective date when practices change. Material changes should be brought to players' attention before they take effect.