Kids get the magic. Grown-ups keep control.
PRIVACY POLICY · EFFECTIVE AUGUST 2, 2026What the request form collects
We collect the adult requester’s email address, event type, event month, package interest, adult confirmation, optional marketing choice, and a technical timestamp. When a grown-up arrives through a campaign link, we also retain only bounded campaign labels such as source, medium, campaign, content, term, cell, or experiment. We do not put click IDs, free-text messages, or child details in that campaign receipt. We use the request information to manage studio capacity, respond, and reconcile which adult campaign produced the request. Marketing ideas are sent only when the adult separately opts in.
Payments and orders
Checkout is processed by Stripe on Stripe’s hosted page. We receive an order confirmation with the purchaser’s email, the package purchased, and the amount paid — never card numbers. Stripe’s handling of payment data is described in Stripe’s own privacy policy.
What does not belong in our marketing system
Do not send a child’s surname, exact birth date, school, address, contact details, social handle, photo, voice, or private game link through the public site or by marketing email. If an adult chooses an in-game family cameo after ordering, we arrange a separate private transfer. Big Day Arcade will not place child names, photos, raw creative answers, or game-play behavior in Klaviyo, Meta, or another advertising system.
Game intake
Paid-order intake is completed only by an adult through a separate secure workflow. We ask for a nickname or first name, coarse age band, chosen hero traits, interests, accessibility needs, an adult-written message, and topics to avoid. Photo upload is never required. If the ordering adult asks for a child or family photo to guide an approved in-game cameo, it is transferred privately, limited to the commissioned game, never used in advertising, and deleted on request. We confirm the project-specific deletion date before accepting the file.
Player pages
Private game pages are designed without advertising, chat, in-game purchases, Meta Pixel, Google Analytics, session replay, or unnecessary cookies. Game links use opaque identifiers rather than a child’s name and are marked not to appear in search engines.
Adult shopping-site measurement
The public shopping pages offer grown-ups a measurement choice. Until “Allow measurement” is selected, analytics storage, advertising storage, ad user data, and ad personalization remain denied. “Essential only” keeps them denied. If measurement is allowed, we use privacy-limited Google Analytics plus Meta Pixel and Meta Conversions API to understand shopping-page and purchase-funnel performance. Pseudonymous browser identifiers such as the Google Analytics client ID and Meta _fbp/_fbc values may be carried through Stripe checkout metadata so a completed adult purchase can be attributed. Google Signals, ad personalization, child information, and every tracker on private play pages remain off. The choice is stored only on that browser and can be reset by clearing site storage.
Sharing and service providers
We use infrastructure providers to host the site, store adult requests and orders, deliver requested adult email, and process payments (Stripe). Providers receive only the information needed for their job and are not authorized to sell family information. We may disclose information when legally required or necessary to prevent harm or fraud.
Retention and deletion
Adult request records are retained while we may still owe a reply or until consent is withdrawn; the associated campaign receipt is append-only so retries cannot rewrite attribution history. If the adult request is deleted, its email is no longer resolvable from that receipt. Test receipts are marked and excluded from commercial evidence. Order records are retained as required for accounting and tax. Optional family media follows the project-specific deletion date confirmed before transfer and can be deleted sooner whenever the ordering adult asks. Marketing unsubscribes are honored while a minimal suppression record may be retained to avoid contacting the address again. A grown-up may request access, correction, deletion, or withdrawal of marketing consent.
Security and limits
We use access controls and private infrastructure intended to protect information. No online service can promise absolute security. The commercial child-data workflow, consent language, and retention controls remain launch gates requiring specialist legal review before broad advertising.
Contact
For privacy, access, correction, or deletion requests, email hello@bigdayarcade.com. You may also reply to your order receipt or use the request form on the home page. We answer from the studio directly.