Privacy Policy

chaloPlay is a free online game operated from India. This page is also the notice required by Rule 3 of the Digital Personal Data Protection Rules, 2025. It describes exactly what the service does with your data, which is very little.

The short version

• No accounts, no passwords, no email addresses, no phone numbers.
• No camera and no microphone. The game never asks for them and cannot access them.
• No cookies, no advertising, no visitor analytics, no trackers, and no profiling of anyone.
• No database and nothing written to disk. Game data lives in the server's memory, is swept within minutes of a game finishing, and is gone outright when the server restarts.
• We never sell or rent your data, and never pass it to anyone outside the two companies that host the service for us.
• We never ask your age, and hold nothing that would need one — see Age and children below, including what the game's content rating says.

Itemised notice: what we process and why

Under the DPDP Act, you are the Data Principal and the operator of chaloPlay is the Data Fiduciary. Every item of personal data we process is listed here against the specific purpose it is processed for. We process nothing else.

Your display name is visible to everyone in your room. It does not have to be your real name, and we would rather it wasn't. Please don't put an email address, phone number or anything else private in it.

How long "until it is swept" is

Rooms, games and player records live in the server's memory and are never written to disk, so a restart or a deploy clears every bit of them at once. (The connection-event lines in the last row of the table are the exception: they are printed to the server's log, which is why they are listed separately.) Short of that, a sweep runs once a minute and removes:

• a finished room, 15 minutes after the game ended — or up to an hour, if somebody is still connected to it reading the results or waiting for a rematch;
• an unfinished room, 10 minutes after the last player disconnects from it;
• your player record — display name, player ID and chosen character — 10 minutes after the last room holding it has gone.

So in the ordinary case your name and game are gone within about half an hour of the last player leaving, and in the longest case a little over an hour. We would rather tell you the real number than round it down to "when the game ends": the results screen has to survive a reconnect, and that is what these minutes buy.

Stored on your own device, not sent to us

These are written by your browser and stay there. Nothing in this list reaches our server, and clearing this site's data removes all of it. The first group persists until you clear it; the second lasts only as long as the tab is open.

A few more keys live in sessionStorage and are discarded when you close the tab: arcade:native-app (that this tab was opened by the Android app), arcade:open-in-app-dismissed (that you dismissed the "open in app" banner), arcade:bluff:fs-prompt (that you dismissed the full-screen prompt) and arcade:bluff:power-intro:* (that you have seen the powers intro in this game).

None of these are cookies, and none are used for tracking or advertising. They are settings, and they are yours — we cannot read them.

Your browser also keeps a cache of the game itself — the page, the code, the fonts and the 3D models — so that it loads quickly and does not re-download 5MB of characters every visit. It holds no information about you. Clearing this site's data clears it too, along with everything in the tables above.

What we deliberately do not do

• No camera or microphone access. An earlier version of this project had an optional webcam feature. It has been removed completely — the code that requested camera access and the face-detection model that went with it are gone. No video, audio, image or biometric data of any kind is captured, processed, transmitted or stored.
• No tracking, profiling or behavioural monitoring of any user, of any age.
• No advertising of any kind, targeted or otherwise.
• No automated decision-making about you.
• No payment information. The service is free and takes no payments.
• No free-text chat. Players communicate through a fixed set of emotes, so there is no message content to moderate, log or retain.
• No sale, sharing or onward transfer. Beyond the two hosting providers described under Third parties, who process data only to run the service for us, your data goes nowhere.

Third parties

The game loads no code, fonts or assets from third-party CDNs. Typefaces, 3D models and every other asset come from our own domain, so opening a page reveals your IP address to no third party beyond the companies that host the service for us.

There are two of those, because the site and the game server are deployed separately: one hosting provider serves the pages and the files, and another runs the Socket.IO server your game connects to. Both act as our Data Processors, both necessarily see the IP address your connection comes from, and between them they are the only third parties involved in running the service. Nobody else receives anything.

Age and children

We never ask your age, and there is no wall to pass. Not because the game is for everyone — see the content rating below — but because we hold nothing that an age check would protect.

Under India's DPDP Act 2023 and the DPDP Rules 2025, anyone under 18 is a child, and a Data Fiduciary must obtain verifiable parental consent before processing a child's personal data. That duty attaches to processing personal data, and this service stores none of it: there is no database and nothing is written to disk, so a room and a player record exist in the server's memory for the game and the short sweep set out above, and then do not exist at all. Your name and preferences stay in your own browser, where we cannot read them. There is nothing held about a child to need a parent's consent for, and nothing held about an adult either.

Nor is there much here for an age limit to guard on the data side, which is what this page is about. Nobody is tracked, profiled or behaviourally targeted. There is no advertising, no account and no free-text chat, and nothing can be staked, bought or won — these are social games, never money games. What another player can see of you is the display name you typed, the character you picked, your emotes and your moves, for as long as you sit at the same table.

Content is a separate question from data, and the answer is different. Bluffing? has an optional duel mode in which characters draw a revolver on each other and carry the wounds for the rest of the game. That is why chaloPlay is rated for teenagers and over in most regions, and higher in a few. The rating on the store page you installed from is what tells you whether the game is suitable for you, and below that age a parent or guardian should decide. This notice answers only the data question: whatever your age, we keep nothing about you.

If a parent or guardian has a concern about a child playing, there is no account to close and no profile to look up; the remedies under Your rights are all things you can carry out yourself, in seconds, and everything else ages out of memory on the timings above.

Your rights as a Data Principal

Under the DPDP Act you have the right to:

• Access a summary of the personal data we process about you and what we do with it.
• Correction, completion, updating and erasure of your personal data.
• Grievance redressal — see below.
• Nominate another person to exercise these rights on your behalf in the event of your death or incapacity.
• Withdraw your consent at any time, as easily as you gave it.

Because we hold so little, you can exercise most of these yourself, immediately:

• Erase everything on our server: leave the room, which starts the clock described above. A game in progress cannot be left mid-hand — that would hand the other players a win — so closing the tab forfeits your seat after a two-minute grace instead, and the room then ages out the same way.
• Erase everything on your device: clear your browser's site data for this domain.
• Correct your display name: change it in the name field on the game's start screen. The new name reaches the server the next time you join a table.

For anything else, including a request about server logs, write to rishigupta11.dev@gmail.com. We will respond within 30 days. If we cannot act on a request, we will tell you why in writing.

Withdrawing your consent

There is no consent to withdraw and no acceptance record to clear: nothing asks you to agree to anything before you play. Leaving a room releases your seat and starts the clock described above, after which the room and your player record are gone from memory for good; clearing this site's data in your browser removes the settings listed above at once. Between them that is withdrawal in full, and it needs nobody's permission but yours.

Grievance redressal

If you have a complaint about how we handle your data, about another player's display name or conduct, or about anything else on the service, write to our Grievance Officer. This is also the contact required by Rule 3(2) of the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021.

For something happening at your table right now, the faster remedy is in the game: the host can remove a player from their room. Know its limits — only the host can do it, it does not work once a game has ended, and someone removed can rejoin with the room code, because there is no ban list. If a table has become unpleasant, leave it and start your own, where you are the host, and write to us as well if it should not happen again.

If you believe your rights as a Data Principal have been infringed, you may complain to the Data Protection Board of India established under the DPDP Act 2023. You must raise the matter with us first.

Security

We keep no database, and what the server holds lives in memory for minutes rather than for good, which is the strongest safeguard available: there is no store of personal data to breach, and nothing to hand over if someone asks. Traffic is served over HTTPS. Should a personal data breach nonetheless occur, we will notify affected users and the Data Protection Board as the DPDP Rules require.

Languages

This notice is published in English. Section 5(3) of the DPDP Act entitles you to it in any language listed in the Eighth Schedule to the Constitution of India — write to rishigupta11.dev@gmail.com and we will provide it.

Changes

If this policy changes, the date at the foot of this page changes with it, so you can always tell when it last moved. Nothing about you is stored beyond the few minutes set out above, and nothing will start being stored without this notice saying so first: the table above is the whole of it, and it is written from what the code actually does.

Contact

rishigupta11.dev@gmail.com