Last updated 25 August 2026

Privacy Policy

This explains what Outcry collects, why, who else sees it, and what you can ask us to do with it. We have tried to describe what the system actually stores rather than every category we might conceivably use.

1. What we collect

You give us

• Email address - to identify your account, verify it, and contact you about it.
• Password - stored only as a PBKDF2-SHA256 hash with a per-user salt. We never store or see your actual password.
• Username and display name - optional, shown on leaderboards.

Created as you use it

• Progress - credits, questions answered, and how many were correct.
• Scores - per-game results, including score, accuracy and time taken, used for leaderboards.
• Session records - a random token in an httpOnly cookie, so you stay signed in.
• A normalised form of your email - with dots and +tags removed, used solely to stop one person opening many accounts for extra free credits. It is not used to contact you.

We do not collect

• Card numbers or payment details. Stripe handles payment; we only receive whether a payment succeeded.
• Advertising or cross-site tracking identifiers. There are no third-party ad or analytics trackers.
• Any special-category data (health, biometrics, political or religious views, and so on).

2. Why we use it

• To run your account, keep you signed in, and show your progress - performance of our contract with you.
• To take payment and grant paid access - performance of our contract.
• To display leaderboards - our legitimate interest in a working competitive feature.
• To prevent duplicate accounts and score manipulation - our legitimate interest in fair access.
• To send verification and account emails - performance of our contract. We do not send marketing email.

3. What is public

If you appear on a leaderboard, your username or display name and your scores are visible to anyone. Your email address never is. Choose a display name accordingly - if you would rather not be identifiable, use a handle rather than your real name.

4. Who else processes it

• Cloudflare - hosting and database. All account and score data is stored here.
• Stripe - payment processing. They receive your payment details directly and give us only a result.
• Resend - sends verification and account email. They receive your email address.

Job listings and articles are fetched by us from public sources. That is an outbound request from our servers, so no information about you is sent to those sources and they do not learn that you viewed a listing until you click through.

We do not sell your personal data, and we do not share it for advertising.

5. How long we keep it

• Account data: until you delete your account.
• Sessions: until they expire or you log out.
• Scores: until you delete your account, after which they are removed from leaderboards.
• Payment records: as long as tax and accounting law requires, typically several years.

6. Your rights

Depending on where you live - including under the UK/EU GDPR and California’s CCPA/CPRA - you can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or export it. You can also complain to your local data protection authority. We do not charge for these requests and we will not treat you differently for making one.

To make a request, email support@outcryarcade.com from your account address.

7. Cookies

We set one essential cookie: your session token, which is httpOnly, Secure and SameSite=Lax. It exists only to keep you signed in. There are no advertising, analytics or tracking cookies, which is why the site does not show a cookie banner. Some settings, such as your chosen theme and lab filter, are kept in your browser’s local storage and never sent to us.

8. Security

Passwords are hashed with PBKDF2-SHA256 (100,000 iterations) and a per-user salt. Sessions are random server-side tokens, not data we encode into a cookie. Traffic is served over HTTPS. No system is perfectly secure, and we cannot guarantee absolute security.

9. International transfers

Our providers operate globally, so your data may be processed outside your country, including in the United States, under the safeguards those providers offer.

10. Children

Outcry is not intended for children under 16. We do not knowingly collect their data; if we learn we have, we will delete it.

11. Changes and contact

We will post any update here and change the date above. Material changes will be notified by email.

Outcry is operated as a sole proprietorship and is the data controller for the information described here. If you need the operator identified by name for a formal data-protection request, ask at the address below and we will provide it.

Contact: support@outcryarcade.com.