Your data, your flight.
Site-owner setup note: this is a starter privacy notice, not legal advice. Before launching publicly, the site owner should add a real contact method, review the policy and account-deletion process, configure appropriate privacy controls, and ask a parent/guardian to review the service if the owner is under 18.
Playing as a guest
Guest play is temporary. During the current page session, the game keeps the current score, coins, relics, upgrades and awards in working memory only. Guest progression is not written to localStorage or sessionStorage and is not sent to Supabase. It disappears when the page is refreshed or closed. The game does not request your real name, birth date, phone number or exact location.
Optional accounts and global scores
If the site owner configures Supabase, players can register with an email, password and pilot name. Supabase Auth processes account credentials; this game does not read or store the password itself. For signed-in players, persistent best and lifetime scores, XP/level, Arcade-earned coin balances, flight history, achievements, relic inventory, upgrade levels, purchased cosmetics and equipped bird/aura/trail/wing styles are stored in the configured Supabase database. The public leaderboard can show a pilot name, best score and level. The app does not intentionally display email addresses on the leaderboard. Personal flight history, inventory, upgrades and award records are restricted to their owner by database permissions.
Do not choose a pilot name that reveals your real name, school, address, phone number or other identifying details. Public usernames and scores can be visible to other visitors. The site owner should explain how to request account deletion and ensure the Supabase account/profile/award records are removed together.
Third-party services
The optional account feature loads the Supabase JavaScript library from jsDelivr and contacts the configured Supabase project. Those services may receive normal network request data such as an IP address as part of providing their service; consult their current privacy policies. Google Fonts may also be requested by the stylesheet where the browser can access it. Authentication session persistence is disabled in this project, so the session token is kept in page memory rather than saved into browser storage. As a result, a player needs to sign in again after a refresh or reopening the page; their cloud progression remains stored in Supabase.
Advertising and analytics
This starter project contains no advertising or analytics integration. If ads or analytics are added later, update this notice and configure any consent required for the visitors and services involved before those tools run.
Children and young visitors
Before inviting children or young teens to create accounts, the site owner should review the applicable privacy and age requirements, use appropriate settings, avoid unnecessary data collection, and get suitable parent/guardian help. Do not ask players to submit sensitive or identifying information.
Contact and deletion
The project does not ship with a contact email because the site owner must choose and maintain one. Before public launch, add a monitored contact address here and provide a workable way for players to ask questions, correct their data, or delete their account. Deleting a user's authentication account in Supabase should also cascade-delete their profile, player stats, achievement records, inventory, upgrades and flight history using the supplied schema.