Arcademy

1. Who We Are

Arcademy is an educational gaming platform currently under development. It is operated by an individual developer on a pre-commercial, non-trading basis. Arcademy is not yet a registered company.

The platform is open to the public for testing and evaluation purposes only. No commercial services are being sold or provided at this time. No formal contracts or data processing agreements are in place with schools or any other organisations.

For any privacy-related queries, contact: hello@arcademy.io

This policy will be updated when the platform transitions to a trading entity. A full commercial Privacy Policy and Data Processing Agreement will be published at that time.

2. What Data We Collect and Why

Player Data (voluntary, pseudonymous)

Dashboard Access (testers only)

Technical Data (collected automatically)

3. Children's Data — Our Approach

Arcademy is designed specifically for use in schools with children under the age of 18. We take the following steps to protect children's data:

• No personal identifiers — students are identified only by a pseudonymous alias chosen by their teacher. Real names are never entered into the system.
• No direct contact with children — we do not communicate with students directly. All account management is handled through teachers.
• No behavioural profiling or advertising — student data is used solely to support their learning and is never used for commercial purposes.
• Minimal data collection — we collect only what is necessary to provide the educational service.
• Hashed credentials — student PINs are stored using bcrypt hashing. The plain PIN is never retained after the teacher creates the account.
• Data isolation — each student can only access their own data. No student can view another student's records.
• School control — the school (as data controller) can request deletion of all student data at any time.

Our platform is designed in accordance with the ICO's Children's Code (Age Appropriate Design Code).

4. How We Share Data

We do not sell, rent, or share personal data with third parties for marketing purposes. Data is only shared with the following sub-processors who help us deliver the service:

We may also disclose data where required by law, a court order, or regulatory authority.

5. How Long We Keep Data

When a school's licence ends, all associated data (students, classes, sessions, badges) is deleted within 30 days unless the school requests earlier deletion.

6. Security

We take security seriously and have implemented the following technical measures:

• All data in transit is encrypted using TLS (HTTPS)
• All data at rest is encrypted by our hosting providers
• Student PINs are hashed using bcrypt — the plain PIN is never stored
• Row-level security ensures each student can only access their own data
• Session tokens expire after 8 hours and are scoped to individual players
• Login rate limiting prevents brute-force attacks (max 10 attempts per minute)
• Teacher accounts use Supabase's industry-standard authentication

In the event of a personal data breach, we will notify affected schools and the ICO within 72 hours where required by UK GDPR Article 33.

7. Your Rights

Schools and Teachers

Under UK GDPR, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — ask us to correct inaccurate data
• Erasure — ask us to delete your data ("right to be forgotten")
• Restriction — ask us to limit how we use your data
• Portability — receive your data in a machine-readable format
• Objection — object to processing based on legitimate interests

Students

Because students are identified by pseudonymous aliases only, we are unable to link a request to a specific child without assistance from the school. Data subject rights for students should be directed to the school, who can then request deletion or export from us on the student's behalf.

How to Exercise Your Rights

Email us at [YOUR EMAIL]. We will respond within 30 days.

You also have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.

8. Cookies

We use only essential technical cookies necessary to operate the platform. We do not use advertising cookies, tracking cookies, or analytics cookies that identify individual users.

No consent banner is required for strictly necessary cookies under UK GDPR / PECR.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify schools of material changes by email and will update the "Last updated" date at the top of this document. Continued use of the platform after changes constitutes acceptance of the updated policy.

10. Contact Us