Privacy Policy

Arcade is a free, open-source plugin for Claude Code together with this website (agent-arcade.fefaodessa.workers.dev), which serves the game player, multiplayer rooms, optional accounts, chats and content search. The source code is public at github.com/ArbakovMaxim/agent-arcade, and the project is run by the maintainer of that repository. This policy explains what the website collects, how it is used, how long it is kept, who else is involved and how to delete it.

The plugin keeps its settings, notebook, game progress and scores on your computer. They go to the website only when you use a feature described below.

YouTube API Services

Arcade uses YouTube API Services to find videos. Data from YouTube is also handled by Google, under the Google Privacy Policy. Use of Arcade's YouTube features is also covered by the YouTube Terms of Service; see Arcade's Terms of Use.

• Search by your own topic. When you add your own topic in the plugin's Watch section, Claude, in your Claude Code session, turns it into a short English search query. If Claude doesn't answer, the plugin uses the topic text itself, when it is written in Latin letters. The plugin sends only this query to the website, and the website sends it to the YouTube Data API. It keeps the matching results in a shared cache for 24 hours: the video ID, title, channel name, publication date, view count, duration and the first 300 characters of the description. The cache is cleaned every 6 hours, so results are deleted within about 30 hours. The cache is keyed by the query, not by who asked, and everyone who asks the same query gets the same results.
• Suggested topics. Topics that Arcade suggests from your current work are chosen on your computer by Claude, in your Claude Code session, from a fixed list of directions. The plugin then reads the public video feeds of YouTube channels directly from your computer. Neither your conversation nor these topics are sent to the Arcade website.
• Picking videos. For both kinds of topics, Claude in your Claude Code session picks up to 6 videos to show: from recent videos of curated channels on related topics and, for your own topic, from the search results too. For this it gets the topic and, for each video, its ID, channel name, publication date, title and the start of its description. This request is part of your own Claude Code session, which Anthropic handles under the terms you use Claude Code with. Arcade keeps the picked videos only in memory while the plugin runs and does not use any of this to train models.
• Playing videos. The /watch page plays videos in YouTube's embedded player in privacy-enhanced mode (youtube-nocookie.com) and loads video titles from YouTube's oEmbed service. The list of video IDs is in the part of the address after #, which the browser does not send to the Arcade website. While you watch, your browser connects to YouTube and Google directly, and they may store data in your browser under their own policies.
• Arcade does not use Google sign-in and never accesses your Google or YouTube account.

Accounts (optional)

• Sign-in. You sign in with GitHub. Arcade asks GitHub for no permissions, so it learns only your public GitHub ID, login and avatar address. The GitHub access token is used once to read them and is not kept.
• What the website stores.
  • Your GitHub ID and login, and your GitHub avatar address. The avatar is not shown to other people.
  • The @handle you choose, and the number of the Arcade avatar picture you pick.
  • The settings you sync, up to 16 KB: interface language, keys, notifications, panel size, what to do when the agent finishes or asks for permission, your own Watch topics and Twitch channels, the Flappy best score, collapsed and hidden sections, favorites, and whether to hide that you are online.
  • Your friends and friend requests, the lists of your chats and shared boards, and pending invites.
  • Hashes of your sign-in keys, for at most 10 devices. The keys themselves stay on your computers.
• Online status. While Arcade is open, your friends can see that you are online. The status expires 90 seconds after the plugin last reported it. You can hide it in your settings.
• How long. Until you delete the account. An account that is not used for a year is deleted automatically, with everything listed above. A handle you give up stays reserved for 30 days, so nobody else can take it right away.

Chats

Direct messages and group chats with friends are stored on the website as written. They are not end-to-end encrypted, so don't send passwords or other secrets. A message is up to 2,000 characters, and each chat keeps its latest 1,000 messages; older ones are deleted. You can edit or delete your own messages: an edited message keeps only its new text, and a deleted one keeps no text, only who sent it and when. A direct chat is deleted for both people when either of them removes the other from friends or deletes their account. A group chat is deleted when its last member leaves. Messages you sent to a group stay there for the remaining members.

Shared project boards

Boards you share with friends are stored on the website with their cards, not encrypted. A board is deleted when its owner deletes it or its last member leaves. Your own unshared notebook and boards stay on your computer.

Multiplayer games

Game rooms pass moves between players in real time and keep nothing about the players once the room is empty. Board games (such as chess) keep the moves on the website, so you can come back to the same game; a game with no moves for 30 days is deleted. If you play signed in, the other player sees your @handle.

Bug reports

A report contains the text you write, plus the Arcade version, where Arcade is open (for example, the terminal or Claude Desktop), the interface language and the operating system. If you are signed in, it is signed with your GitHub ID and @handle. Only the maintainer can read reports. A closed report is deleted, and at most 1,000 open reports are kept. The sender's IP address is not stored with a report.

Articles, podcasts, books and Twitch

• Articles and podcasts. Your own topic text is sent to Hacker News search (by Algolia), Medium tag feeds and Apple's iTunes Search. The results are cached for 12 hours, the same way as YouTube results.
• Books. Book lists and files come from Project Gutenberg, Wikisource and LibriVox (on the Internet Archive), some of them through the website. Copies are cached for up to 7 days. Nothing about the reader is stored.
• Twitch. The channel names you follow are sent to the Twitch API to check who is live. Answers are cached for 1 minute (who is live) and 7 days (channel details).

IP addresses and rate limits

To keep free services available to everyone, the website limits requests per network address. Examples are 10 new YouTube searches per day, or 8 connections to one game room. For this, the address is used in memory, or turned into a salted tag that cannot be turned back into the address and changes every day. The tags are deleted after their day. The address itself is not saved.

Server logs

The website runs on Cloudflare Workers. Cloudflare records each request for troubleshooting. A record can include the time, the address requested (which may contain a search topic), the response status, your IP address, browser and country. Sign-in keys in request headers are masked. Records are kept for up to 7 days, and only the maintainer can see them.

Service providers and other sites

Arcade relies on these services. Each one handles data under its own privacy policy.

• Cloudflare: hosting and logs.
• GitHub: sign-in.
• Google and YouTube: video search and the player.
• Twitch and the content sources named above.

Games and some links open other sites, such as a game's home page or TikTok's own site. Those sites are not covered by this policy.

Your browser and your computer

Arcade sets no cookies. The website's pages keep your interface language in your browser's local storage. The game player also keeps your game progress, scores and the game files you open yourself ("My games") in the browser. This never leaves your browser. You can remove it by clearing this site's data in your browser. The YouTube player may store data under Google's policy, as described above.

Deleting your data

• Delete your account. Open your profile in Arcade's menu, then Sync and sign-in, then Delete account. The deletion happens right away. It removes your account data and settings, friends and requests, direct chats and sign-in keys. It also takes you out of your groups and shared boards, and removes your signature from bug reports you sent. Your handle is released.
• Sign out. Signing out forgets the sign-in on that computer.
• Anything else. For other deletion requests, such as an unsigned bug report or a cached search, or for any question about your data, use 🐞 Report a bug in Arcade's menu. Only the maintainer reads these reports. You can also open an issue at github.com/ArbakovMaxim/agent-arcade/issues, but issues are public. Requests are handled within 7 days.

Children

Arcade is not directed at children under 13, and accounts require a GitHub account, which has its own minimum age.

Changes

When this policy changes, the date at the top changes too. Significant changes are also noted in the project's release notes.

Contact

Use 🐞 Report a bug in Arcade's menu (private), or open an issue on GitHub (public).