Notice version 2026-09-13-v1
What Garcadium stores
For players aged 13 and over, we store account email, an age band rather than a birth date, a chosen player name, a securely hashed password, verification status, and gameplay records. Gameplay records include gems, owned and equipped cosmetics, medals, and best-run statistics. Cookies keep you signed in and connect your game session. Security logs may contain IP addresses and request details.
Children under 13
A parent must create and verify their own adult account, read this notice, return a signed consent form, and receive approval before a child profile is activated. We do not ask children for their real name, birth date, email, photo, or location. Each child receives a generated player name, a login ID, and a password managed by their parent. Other players can see the generated name, equipped items, and live match performance. The service stores the child profile’s gameplay records and necessary session identifiers.
Signed consent documents are encrypted and accessible only to the parent and authorized administrators. Approval requires a human review; an email verification or checkbox alone does not activate a child profile. We do not offer chat, targeted advertising, or sale of child data. Do not put personal information into a player name or room invitation.
Hosting and service providers
The WordPress portal and confirmed account saves use Bluehost. Dough Down runs on Render. These providers process requests, session information, and technical logs to deliver and protect the service. Game requests use a secure server connection to save account progress. Account passwords and consent documents are never sent to the game server. We use email delivery to verify adult/player addresses and reset access.
Your controls
Parents can review and download a child’s saved data, reset access, or revoke consent and delete the child profile in Family settings. You may contact the operator to review, correct, or delete your account information. Revocation prevents further child account access and saving. Active sessions may take up to one minute to recognize a revocation.
Retention
Gameplay data remains while the account is active so returning players can recover progress. Pending consent requests and documents expire after 30 days. Approved consent evidence remains while the child profile is active to document parental authorization. A child profile with no sign-in or connected-game activity for 12 months is deleted, together with its saved data and consent document. Deleting a parent account also deletes its child profiles. Revocation immediately removes the consent document and child gameplay data; the minimal revocation record expires after 30 days. Expired connection and request tokens are removed daily. Hosting backups may retain deleted records until the provider’s backup cycle expires; they are not used to restore revoked access.
Operator and questions
Garcadium
[email protected]
13 Amberwood Crt, St. Thomas, Ontario, N5P 4M4, Canada
+1 416-737-9443