Last updated:
This notice explains how RetroHours handles personal information when you use its website, browser player, accounts, cloud storage and private playtesting services. It covers the service operated by us; third-party sign-in and payment services have their own privacy notices. Use of RetroHours is also governed by our terms of service.
Who is responsible
RetroHours is the service brand operated by ArcheTech Solutions 202503059311, a sole proprietorship registered in Malaysia. In this notice, “we”, “us” and “our” refer to ArcheTech Solutions, the operator responsible for personal information handled by RetroHours.
For privacy questions, data requests or complaints, email admin@retrohours.online.
Information we handle
- Local games and saves. Personal game files, saves and backups are held in your browser on your device. Free and guest imports stay local. During paid access, game files are backed up automatically, and existing guest games are copied into the paid account while preserving their guest originals.
- Account and sign-in details. If you sign in with Google, Discord or Twitch, we receive account identifiers and profile details such as your name, email address and profile image. We store linked-provider information, authentication tokens and session records. Session information can include an IP address and browser information. We do not receive your sign-in provider’s password.
- Cloud games and saves. During paid access, game packages, ordinary saves and supported preferences synchronize automatically. This includes games already on this browser’s account and guest shelves when paid access begins; guest originals and existing account saves are preserved. Game archives, titles and fingerprints are stored privately for the account. We store save files and associated file sizes, checksums, version information, opaque device identifiers, established build and save-format provenance, and account identifiers. Save export sessions pin selected files and metadata for at most one hour, capped by the retrieval deadline. Memory save states and local recordings are excluded from ordinary cloud sync.
- Game approval and polls. Checking approval sends the exact game-content fingerprint and account binding, without uploading game files. Admin-approved titles and fingerprints are public. Supporter votes are stored against an account and poll choice so each account has one changeable vote. Public rankings contain option labels and aggregate counts, not voter identities. Votes remain after subscription expiry and are removed on account deletion. Spectator reactions run locally; no external AI service receives gameplay for them.
- Subscriptions. When billing is enabled, Stripe processes checkout and payment details. We provide your account email to Stripe and retain customer, subscription and transaction references, payment status and access dates. RetroHours does not collect or store your full payment-card number.
- Playtest reports. Reports you submit include your account identifier, written descriptions and notes, game and player version information, comments, and any screenshots or recordings you select. Authorised administrators can review these submissions. Recording a session alone does not submit it.
- Technical information. Connections to the website expose information such as your IP address and request details to the server and its hosting providers. The application uses connection information to limit abusive traffic. If you send a problem report from Help, your description is stored for administrators to review and reply. You may choose to include recent status codes and timings. Game files, saves and pictures are not included in those technical details.
How we use information
We use information to authenticate you, maintain access permissions, deliver cloud transfers and saves, manage subscriptions, investigate reports, provide support and protect the service against abuse. Information required for an account or paid feature must be provided to use that feature; guest local play does not require an account.
We process personal information with your consent where required, where necessary to provide a service you request or perform a contract with you, or where otherwise permitted or required by applicable law. Security and support information is used to operate and protect the service, subject to applicable legal requirements and your rights. Where consent is required for a particular use, it must be obtained separately and can be withdrawn. This notice is not a blanket request for consent.
The RetroHours application does not include advertising trackers or behavioural advertising. We do not sell personal information.
Cookies and browser storage
Sign-in uses cookies to authenticate sessions and protect the sign-in process. Browser storage holds your local collection, saves, backups, settings and selected language. Blocking cookies can prevent sign-in; blocking or clearing site storage can prevent play or permanently remove local files. Keep downloaded backups of files you want to retain.
Your site analytics choice is stored in this browser. If you allow analytics, its identifier is also kept in local storage, as described under Site analytics. Analytics does not set cookies.
Sign-in providers and Stripe may use cookies on their own services. Their use of information is governed by their respective notices. RetroHours does not require advertising-cookie consent to enable its local player.
Site analytics
When site analytics is enabled, RetroHours uses PostHog to understand how its pages are used and to improve them. Analytics requests pass through our server to PostHog’s servers in the United States. PostHog receives your IP address with each request and may use it to estimate an approximate location.
- Without your permission. Until you choose, and after you decline, we count page visits, clicks and scrolling under a random identifier that is kept in memory only and is not stored on your device. Reloading or closing the page discards it. No replays are recorded.
- With your permission. The identifier is kept in local storage so that visits from this browser can be connected, and we record replays of how you move through the site’s pages. Replays capture page layout, pointer movement, clicks and scrolling. They hide all page text, everything you type, labels and titles, local images and the game screen.
- What analytics never receives. Analytics does not run on administration or private playtest pages, and the player is never replayed. It does not receive your account identity, game files, saves or game names. Addresses are reduced to the page path and campaign parameters before they are sent; game selections, invitation tokens and storage links are removed.
Anonymous counting relies on our legitimate interest in operating and improving the service. The stored identifier and replays rely on your consent. Change your choice at any time with Analytics choices at the bottom of every page; withdrawing permission removes the stored identifier and stops replays. PostHog keeps replays for up to 30 days on our current plan and other analytics events for that plan’s retention period.
Retention and deletion
- On your device. Local files remain until removed through the application, cleared in browser settings or removed by the browser. Removing a local game retains its saves and backups. Account deletion does not erase files already stored on a device or copies you downloaded.
- Game approval. We store admin-approved package fingerprints, titles, release audiences and approval history, without publishing game files. Personal launch checks send the package fingerprint and account-workspace binding to our server. This browser caches verified approval, Paid or Free release audience and paid-access deadlines for offline play. Paid early-access launches require that deadline to remain active. Clearing browser data removes those cached records.
- Account sessions. Sign-in sessions expire after seven days and can be renewed while you use the service. Expired sessions are removed by maintenance.
- Subscription storage. After paid access ends, cloud content is available for downloads and exports only for 30 days. Direct installation, restore and synchronization are unavailable. Personal cloud files and synced preferences then become eligible for deletion. Cleanup can be delayed by recovery or payment checks; renewal before deletion can preserve content. Download what you need before the retrieval window ends.
- Save history. Cloud storage normally keeps 4 recent ordinary-save versions, with unresolved conflicts retained until resolved, within the same 100 MB allowance for Cloud and Supporter. These allowances include archives, embedded metadata, pending uploads and files awaiting physical deletion. Existing data is retained when capacity is full; further uploads must fit the allowance.
- Report attachments. Submitted attachments expire 90 days after the report was created and are removed by maintenance. Report text, comments and administrative history remain after attachment expiry.
- Account deletion. Deletion requested in Account settings revokes sign-in sessions and schedules cancellation of future billing and deletion of personal cloud files. Completion may wait for payment cancellation or failed storage operations to be retried. Login credentials and identifying profile fields are removed or replaced once cleanup completes. Reports, administrative history and billing references can remain; identifiers and information you included in report text may still identify you.
There is no automatic expiry for report text, audit history or retained billing records in the current application. Privacy requests concerning those records require review by the operator. Encrypted database backups are kept for seven days, one per day, and then replaced; a deleted record can therefore remain in a backup for up to seven days. The service does not keep web access logs. Server logs are capped at a small size and overwritten as new entries arrive. Our providers keep their own operational records under their own terms. Deleting an application record does not mean every provider-held copy disappears immediately.
Security and your files
Production connections use HTTPS, cloud storage is private, and account and report operations check access permissions. These controls reduce risk but cannot guarantee complete security or uninterrupted access. If a data breach affecting personal information occurs, we will assess it promptly and notify the relevant regulator and affected users where the law requires. Cloud files are not end-to-end encrypted: the service operator and infrastructure providers may be able to access stored content for authorised operations. Do not include passwords, payment details or other unnecessary sensitive information in uploads or reports.
Only import or upload files you are entitled to use. Game packages and saves can contain personal information; check what you submit and avoid including another person’s information without a lawful basis. This notice does not grant rights to third-party games or describe the privacy practices of their publishers. Keep independent backups of important saves.
Your choices and rights
You can use the local guest player without signing in, manage linked sign-in providers in Account settings, remove local games, export local packages and download available save backups, and request account deletion. Removing a local game preserves its cloud copy and local and retained cloud saves. Removing a cloud game preserves local files and stops automatic upload of that game across devices until you enable backup again. Cancelling a subscription does not delete your account immediately.
You have the right to request access to the personal information we hold about you and to ask us to correct it if it is inaccurate, incomplete, misleading or out of date. You can also ask us to transmit your personal information to you or to another organisation where it is technically feasible, withdraw consent, ask us to limit processing, and complain to a data-protection regulator. Depending on the law that applies to you, you may have further rights, such as deletion or objection. Email the address above to exercise these rights, including for report text or records that cannot be removed through the interface. We respond to access and correction requests within 21 days. We may need to verify your identity and may retain information where a lawful exception applies. Exporting a game package or save backup is not a complete export of all account records.
In Malaysia, you can raise privacy concerns with the Personal Data Protection Commissioner. Contact us first if you would like us to investigate or resolve a concern; this does not limit any right to complain to a regulator.
Children
Guest play does not require an account. Accounts and subscriptions are not intended for children under 13. If you are under 18, a parent or guardian must agree before you create an account or subscribe, and they can contact us to review or delete your information. If we learn that we hold account information about a child without that agreement, we will delete it.
Changes to this notice
We update this notice when the service or its data practices change and revise the date above. Material changes should be brought to your attention before a new use of personal information begins, with any additional notice or consent required by applicable law.