Privacy Policy

Last updated: 11 October 2026

The short version: Arch Rogue has no accounts, sign-up, ads, analytics, or tracking. Single-player sends nothing anywhere. Online co-op connects to a relay server, which necessarily sees your connection address, the display name you type, and the game state it forwards for the session, and keeps none of it afterwards.

The game on your device

Native builds store saved runs, options, and progression as files on your own device. The browser build stores the same save documents in IndexedDB site data for this browser and origin. They stay on your device and are not sent to Arch Rogue or another service. The game sends no telemetry, crash reports, or usage statistics.

Browser writes are asynchronous and final lifecycle checkpoints are best-effort, so immediately closing a tab can lose the latest moments of progress. Clearing site data, using temporary private-browsing storage, or moving to a different browser or site origin can delete or make those browser saves unavailable.

Online co-op and the multiplayer relay

Two-player co-op is optional. Nothing connects until you open the co-op menu, press Host or Join, and accept the connection screen, which shows the server address you are about to use. The default relay is ar.rita-kasari.fi, operated by the developer in Finland, who is the data controller for it.

While you are connected the relay receives and forwards:

• your IP address, as with any internet connection, used only to carry the session and to limit how many connections and rooms one address may hold;
• the display name you type and the archetype, difficulty, and story settings you pick, shown to the other player;
• the room code and the game state of the run (positions, actions, inventory, floor layout), which the relay forwards between the two players without inspecting it, but which the relay operator could technically read.

The legal basis is the developer's legitimate interest in running the service you asked to join and in keeping it available and safe from abuse. Names, codes, and game state live only in the relay's memory for the duration of the session and are never written to disk. The relay's own log records connection counts, close reasons, and room codes, but not names, addresses, or game content. The web server in front of it does not keep an access log for the game connection; addresses can still appear in its error log and the system journal when a connection fails, and those are deleted after at most 30 days. Nothing is sold, shared with third parties, or used for advertising or profiling.

Your co-op session is not recorded to your profile or Chronicle, and the other player never sees your IP address, only the relay does. If you enter a different relay address, or follow a link that pre-fills one, that server has its own operator and its own privacy terms; the connection screen shows the address and whether the link is encrypted before you accept.

Steam builds

When a Steam build is distributed through Steam, it uses the Steamworks API on your device to unlock achievements and, if enabled for the app, to sync the same save files described above through Steam Cloud. Valve processes that data under Steam's privacy policy; Arch Rogue receives none of it. Builds downloaded from this site or from GitHub do not talk to Steam.

This website, browser game, and downloads

This site sets no first-party cookies. Opening the browser game uses IndexedDB site data only for local saves and options as described above. The site and browser build are hosted on GitHub Pages, and downloads are hosted in GitHub Releases, so GitHub may process standard web-server request data such as IP addresses as described in GitHub's privacy statement.

The site's stylesheet loads its display fonts from Google Fonts. That request may disclose standard connection data, including your IP address, to Google. Following the Steam store link similarly takes you to a third-party site; it is not game telemetry.

Your rights & contact

Arch Rogue holds no account and no persistent personal data about you: once a co-op session ends there is nothing left to look up, correct, or delete, and the short-lived server logs cannot be tied to a person by the developer. You still have the GDPR rights of access, rectification, erasure, restriction, and objection, and the right to complain to a supervisory authority (in Finland, the Office of the Data Protection Ombudsman). For any question or request, contact the developer through the project's issue tracker.

Changes

If the game begins collecting more data or adds another online service, this policy will be updated first and the date above will change.