1. Who we are
DARTS: Real Throw (the “Service”) is a camera-powered darts game operated by Mirthilo Studio (“Mirthilo,” “we,” “us,” or “our”). This policy applies to the web game at darts.mirthilo.com and related web pages that link to this policy.
2. Information we collect
Google sign-in data
If you choose “Continue with Google,” we receive basic account information authorized by you: your Google account identifier, name, email address, and profile image. We use this information only to create or authenticate your DARTS: Real Throw account, display your account identity, and provide account features such as cross-device scores and statistics.
Account and profile information
When you create or update an account, we may process your login name, password hash, display name, session information, and leaderboard preference. New login-name accounts do not require an email address. If you use Google sign-in, we also process the Google account information described above. We never store your plaintext password.
Camera and gameplay information
The game requests camera access to detect your hand movements. Camera frames are processed on your device for hand tracking and are not uploaded to or stored on our servers. The game does not record audio. If you use signed-in match or leaderboard features, we may receive derived gameplay measurements such as scores, dart positions, timing, release speed, and tracking-confidence values. These measurements do not include camera images, video, audio, or raw hand-tracking frames.
Device, security, and local information
We may process IP address, hashed IP-derived security signals, browser type, device information, user agent, session identifiers, timestamps, and diagnostic or security events. The game also uses local storage and browser caches for settings, calibration, local progress, and offline functionality.
Purchases
If you make a purchase, Stripe processes the payment. We receive transaction identifiers, product, price, payment status, and entitlement information needed to fulfill and support the purchase. We do not receive or store your full card number.
3. Cookies and local browser storage
The web game uses an account-session cookie and local browser storage to provide requested functionality. For example, local storage remembers game settings, calibration, local scores and statistics, and related gameplay preferences on your device. We do not use our own advertising, analytics, or cross-site tracking cookies in the web game.
The web game does not currently show a cookie-consent banner for its functional browser storage. You can clear cookies and local storage in your browser settings; doing so may sign you out and reset locally saved settings, calibration, and scores.
If you choose an optional web flow, the provider may use its own cookies or similar technologies under its own policy. This can include Google during Google sign-in, Cloudflare during human-verification checks, and Stripe during checkout. Those flows begin only when you choose to use the relevant feature.
4. How we use information
- Provide, authenticate, maintain, and improve the Service.
- Sync account scores, statistics, purchases, and preferences across devices.
- Operate leaderboards and verify submitted match results.
- Process purchases, deliver entitlements, and handle refunds or support.
- Prevent spam, fraud, abuse, cheating, and security incidents.
- Comply with legal obligations and enforce our Terms of Service.
5. Google user data commitment
Our use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.
We do not sell Google user data, use it for advertising, or share it with third parties except as needed to provide or secure the Service, comply with law, or complete a transaction you request. We do not allow humans to read Google user data unless you ask us to for support, it is necessary for security or legal compliance, or the data has been aggregated and de-identified.
6. When information is shared
We may share limited information with service providers that process it for us under their own terms and appropriate safeguards:
- Google for optional Google authentication.
- Cloudflare for hosting, databases, content delivery, security, and human-verification services.
- Stripe for web payment processing.
We may also disclose information if required by law, to protect users or the Service, or as part of a merger, financing, acquisition, or sale of assets. We do not sell personal information.
7. Public leaderboards
If leaderboard publication is enabled for your profile, your display name and qualifying game results may be visible publicly. Your email address and Google account identifier are not shown on public leaderboards. You can change your leaderboard preference in the game.
8. Retention and deletion
We retain information only for as long as reasonably necessary to provide the Service, maintain security and transaction records, resolve disputes, and meet legal obligations. Retention periods vary by data type. Some records may remain in backups or be retained where required for fraud prevention, accounting, refunds, or law.
You can revoke DARTS: Real Throw’s Google access from your Google Account connections. Revoking access stops future Google authentication access but does not itself delete your DARTS: Real Throw account. To request account or personal-data deletion, email [email protected]. Please include your login name or Google account email so we can locate the account.
9. Your choices and rights
You may play without Google sign-in where guest play is available, deny camera access, disable leaderboard publication, clear local browser data, or stop using the Service. Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or receive a copy of personal information. Contact us to exercise an applicable right.
10. Security and international processing
We use reasonable technical and organizational safeguards, including encrypted HTTPS connections, secure session cookies, access controls, rate limits, and encryption of stored OAuth tokens. No system can guarantee absolute security. Our providers may process information in countries other than yours, subject to applicable safeguards.
11. Children
The Service is not directed to children under 13, or the higher minimum age required to consent to data processing in their country. We do not knowingly collect personal information from children below that age. If you believe a child has provided personal information, contact us so we can investigate and delete it where appropriate.
12. Changes and contact
We may update this policy as the Service changes. We will post the revised policy here and update the effective date. Material changes may also be announced in the Service.
Questions or privacy requests: [email protected]