Privacy
4rc4d3 and llvls privacy policy
Oct 16, 2026 · Version 1.1, in force from 16 October 2026 until we publish a newer version. It replaces version 1.0 and all earlier drafts.
This policy explains what personal information Live Shuttle ehf. collects through 4rc4d3 and llvls, why we use it, who sees it, how long we keep it, and what you can do about it.
1. Who we are
Live Shuttle ehf. (kennitala 470612-0610), Biskupsgata 5, 113 Reykjavík, Iceland, VAT number 111248, runs these services and decides how your personal data is used. For the GDPR, it is the controller. Our data protection officer is Erling Gudjohnsen.
For privacy requests, write to privacy@4rc4d3.com or privacy@llvls.com. For creator questions, write to hello@4rc4d3.com. For player questions, write to support@llvls.com.
2. What this policy covers
- 4rc4d3.com: the marketing site, the blog, the docs, and the Studio where creators build and publish games, including creator accounts.
- llvls.com: the arcade, where players browse, play, sign in, save, comment, rate, follow and buy.
- Games when they run on the game domain 11vls.com inside the llvls game frame.
- Emails we send about your account, purchases, payouts and games.
- The status page at status.4rc4d3.com.
One policy covers all of these because the same company runs them. It does not cover third-party sites we link to. Games are made by creators, and section 15 explains what creators can see.
3. Who can use our services
Players. You can play games without an account. To create an account you must be 13 or over. If you tell us at sign-up that you are under 13, we refuse the sign-up without telling you the age limit, and we remember the refusal in your browser for 30 days (section 10). Children under 13 can still play games without signing in.
Players aged 13 to 17 can create an account, save games, post scores, and comment (links and contact details from under-18 accounts are held for review). They cannot buy anything, and they cannot see games rated Mature. Players aged 18 or over can buy, and can opt in to Mature games in their settings.
Creators. You must be 16 or over to create a Studio account. Creators aged 16 and 17 can build and publish games, but cannot earn money from them or publish Mature games until they are 18 and verified.
Date of birth. We ask for your date of birth when you sign up and use it to decide which features apply. If you give more than one date, we use the youngest until your account is verified. We store your date of birth, not your age group, and we work out your age group when we need it. Players cannot change their own date of birth. Our support team can change it with proof.
4. The information we collect
| Category | What it includes | Where it comes from |
|---|---|---|
| Account details | Email address, username or generated name, display name, password (kept only as a one-way hash, never in readable form), date of birth | You, when you sign up or change settings |
| Google sign-in | Email address, name and Google account ID, using the fewest permissions we need. We do not receive your date of birth from Google; we ask you for it. | Google, if you choose Sign in with Google |
| Creator profile and store pages | Creator name, bio, pinned games, store page text and images, games and releases | You. These are public. |
| Security (creators) | Two-factor secret (stored encrypted), backup codes (stored in one-way form), remembered devices, active sessions, recent security activity, and the devices you sign in from (kept 90 days) | You, and the sign-in itself |
| Gameplay and social | Saves (on our servers when signed in), scores, ratings, comments, follows, saved games and collections, blocked players, Mature setting, notification choices | You, and your play |
| Play and usage | Game views, starts, plays (10 seconds or more of real input), session length, heartbeats, custom events a creator has declared, share references from links you open, and crash reports | Your browser, while you play. Crash reports have your display name and seat handles removed. |
| Purchases and money | Orders, what you bought, prices, tax evidence (card country, billing country and IP location), the consent you gave for immediate access to digital content, refunds and disputes, our payment provider’s customer ID, your monthly spending limit | You, and our payment provider |
| Creator payouts and verification | Legal name, date of birth, address, how you earn, a bank account in your name, tax details where needed, statements and payout history | You, to verify your account |
| Support and safety | Messages, reports, appeals, attachments, moderation decisions | You, and other people when they report you |
| Technical data | IP address, browser and device type, user agent, request times, error logs, cookie data | Your browser, automatically |
| AI assistant | Prompts, project files, assistant replies, usage counts, and your own Anthropic key if you bring one (stored encrypted) | You, and our AI provider when you use the assistant |
| Advertising | Ad requests, impressions, and your consent choice | Our ad provider and your browser |
We never see or store your full card number. Card details go directly to our payment provider.
5. What we use it for, and why
| Purpose | Legal basis (GDPR Article 6) | Notes |
|---|---|---|
| Running your account, signing you in, keeping it secure | Contract; legitimate interests | Creators get two-factor and new sign-in alerts |
| Checking age and limiting features by age | Legal obligation; contract | See section 3 |
| Selling, delivering and refunding purchases | Contract | Includes tax calculation and receipts |
| Tax, bookkeeping and creator payouts | Legal obligation; contract | Financial records kept at least 7 years |
| Preventing fraud, stolen cards and chargebacks | Legitimate interests; legal obligation | Uses hashed device, IP and payment fingerprints (section 12) |
| Keeping the platform safe, moderation, responding to reports, child safety | Legal obligation (EU Digital Services Act and similar rules); legitimate interests | Child-safety reports may go to the authorities (section 14) |
| Showing creators statistics about their games | Legitimate interests | Aggregated only, with no individual player data |
| Measuring how games perform and fixing crashes | Legitimate interests | First-party, with no third-party tracking inside games |
| Showing ads in the EEA, UK and Switzerland | Consent, for non-essential cookies | Contextual ads only (section 9) |
| Emails you have chosen: follow notifications, creator news | Consent, which you can withdraw | Account and security emails are always sent |
| Helping you find games and creators | Legitimate interests | Browse and search order uses plays, ratings and recency |
| AI assistant | Contract | Your prompts go to Anthropic (section 7) |
| Attributing sign-ups and shared links | Legitimate interests | First-party references, with no tracking cookie |
| Blocking spam and bots on forms | Legitimate interests | Cloudflare Turnstile checks sign-up, sign-in and similar forms (section 7) |
6. What is public
Your display name, your scores on leaderboards, your comments and ratings, and your creator profile and games are public. Your email address, date of birth and security information are never public.
7. Who we share information with
Service providers. We use these providers to run the service. They act on our instructions and only receive what they need.
| Provider | What they do | Where | Notes |
|---|---|---|---|
| Amazon Web Services | Hosting, databases, storage, content delivery, email sending, backups | Stockholm (eu-north-1). Some global services, such as content delivery and firewall, run in the United States (us-east-1). | Under a data processing agreement |
| Straumur (Iceland) | Card payment processing | Iceland | Card details go to Straumur, not to us |
| Anthropic | AI assistant for creators | United States | Receives the prompts and project files you send to the assistant. If you use your own key, Anthropic’s terms for your account apply. |
| Sign-in with Google; ads through Google H5 Games Ads once approved | United States and elsewhere | Ads run only with consent in the EEA, UK and Switzerland | |
| Consent platform | Records cookie and ad consent choices | Within the EEA, or as the provider states | Used once ads or analytics cookies are switched on |
| Bank and accountant | Creator payouts, bookkeeping and tax | Iceland | Only the details each needs |
| Cloudflare | Turnstile, which checks that sign-up, sign-in, resend and reset forms (and similar forms) are used by a person and not a bot | Global network | Receives a check token and your IP address when you use those forms. Not used during game play, for ads or at checkout. |
Others.
- Creators see only aggregated statistics and the scores and display names on their own games.
- Other players see your public information (section 6).
- We do not sell personal data.
- We share information with authorities when the law requires it, such as a court order, a tax request, or a child-safety report (section 14).
- We share information with our professional advisers under a duty of confidence.
- If the business is transferred to another owner, your information may transfer with it, under the same protections.
8. International transfers
We keep data in the EEA as far as the services allow. Where a provider in the United States processes data, we rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission’s Standard Contractual Clauses with added safeguards where needed. You can ask us for a copy of the safeguards we rely on.
9. Ads, cookies and similar technology
9.1 Cookies we use without asking
These are strictly necessary for the service to work, so they cannot be turned off: sign-in sessions for players and creators (their names begin with __Host-), protection of forms against misuse, the age-related cookies in section 10, and the creator ‘don’t ask again on this device’ cookie, which you set yourself.
9.2 Cookies and storage we use with consent
Advertising cookies, and any analytics cookies we add in future, are set only after you accept them, where the law requires consent (the EEA, UK and Switzerland, and elsewhere where the law requires it). We don’t use advertising cookies on the Studio or on llvls account pages.
9.3 Storage in your browser
If you play without signing in, your saves are stored in your browser on your device, not on our servers. Clearing your browser’s site data removes them.
9.4 Ads
We show ads in a limited way. No ad appears in the first two minutes of play or during active play; ads appear only between parts of a game, when the game signals a break. Ads target the game and the page, not you. Mature games show ads only from providers that accept mature content. Games aimed at children show no ads. Around-frame display ads are our own.
9.5 Measuring our marketing site
We measure visits to the marketing pages on 4rc4d3.com on our own servers. We count page visits without cookies, and we send nothing about them to a third party. We run no third-party analytics and no advertising pixels on llvls.com, in the Studio, or on the sign-up and verification pages.
If we later add third-party analytics or an advertising pixel to the marketing pages, we will update this policy first, load the tool only after you accept it where the law requires consent, and keep it off llvls.com, the Studio and the sign-up pages. We will not build advertising audiences from players or from visitors to llvls.com.
9.6 Your choices
You can change your cookie and consent choices at any time using the cookie settings link in the footer of our sites, once we show a consent choice. Turning off optional cookies does not affect your account.
10. Cookies and browser storage
| Name | Purpose | Lasts | Type |
|---|---|---|---|
| __Host- player session | Keeps a player signed in | 30 days if you chose ‘Keep me logged in’, otherwise 12 hours | Strictly necessary |
| __Host- creator session | Keeps a creator signed in to the Studio | 12 hours | Strictly necessary |
| Creator remembered device | Skips the authenticator code on a device you trust | 30 days | Strictly necessary (you set it) |
| Under-13 refusal | Remembers a refused under-13 sign-up so we don’t ask again | 30 days | Strictly necessary |
| 18+ confirmation | Remembers that a signed-out visitor confirmed they are 18 or over, for direct links to Mature games | 30 days | Strictly necessary |
| Anti-forgery | Protects forms | Session | Strictly necessary |
| Consent record | Remembers your cookie choices, once we show a consent choice | 90 days | Strictly necessary |
| Advertising | Set by the ad provider in section 7, only with consent | Set by the provider | Consent |
| __Host- age marker | Remembers the youngest age group used for a sign-up in this browser (never your date of birth), so a new sign-up in the same browser follows the right rules | 30 days | Strictly necessary |
Game saves for players who are not signed in are stored locally on the device (section 9.3).
11. How long we keep information
We keep personal information only as long as we need it for the purposes in section 5, or as long as the law requires. “Up to” means we delete it sooner when we can.
| Information | How long we keep it |
|---|---|
| Unverified player sign-up | Up to 30 days, then deleted |
| Player verification and password reset links (used or expired) | Up to 7 days |
| Ended player sessions | Up to 30 days |
| Unverified creator sign-up | Up to 30 days |
| Creator email codes (used, replaced or expired) | Up to 7 days |
| Ended creator sessions and remembered devices | Up to 30 days |
| Used or replaced backup codes | Up to 30 days |
| Recent security activity on creator accounts | 90 days |
| Devices you signed in from (for new-device alerts) | 90 days after your last sign-in |
| Account data (profile, saves, comments, follows, settings) | While the account exists; removed when you delete it |
| Scores and leaderboard entries | Removed when the account is deleted |
| Account deletion | Hidden at once; erased after 30 days |
| Orders, invoices, payouts, statements and ledger records | At least 7 years (Icelandic bookkeeping law) |
| Terms acceptance history | 4 years after the account is deleted |
| Chargeback evidence (IP address, device and sessions at purchase) | 13 months after the purchase, longer only while a dispute is open, then deleted |
| Support messages and appeals | 4 years |
| Age-related cookies (under-13 refusal, 18+ confirmation, age marker) | 30 days |
| Creator project files | While the project exists; erased 30 days after the project is deleted |
| Automatic draft copies of Studio work, made between your manual saves (not your saved versions) | 7 days |
| Released game builds | While llvls runs. The last live release of an unpublished game with sales is kept for its buyers. |
| Web and edge logs (these include IP addresses) | 2 years |
| Application and security logs | 2 years |
| Raw analytics events and crash reports | 2 years; aggregated figures are kept longer |
| Payment-attempt records used to prevent duplicates | 30 days |
| Marketing choices | Until you change them |
12. Automated checks and decisions
We use automated checks to block fraud and stolen cards (speed of activity, hashed device, IP and payment fingerprints), hold suspicious comments, scan uploaded games and assets for policy problems, and find copied content. The AI check sends the code of changed files to our AI provider as text, and treats it as data, not instructions.
Automated checks can hold a purchase, a comment, a release or earnings. A person reviews earnings holds and suspensions before they become permanent. You can appeal a moderation decision (see the terms that apply to you).
13. Security
We use HTTPS everywhere and encrypt data at rest. We store passwords only as one-way hashes. Creators must use two-factor authentication. Access to personal data inside our team is limited by role and recorded. Database access is limited by role. We keep personal details, such as email addresses and passwords, out of our application logs and database logs. Our fonts are hosted by us, so pages do not load fonts from Google.
If a breach is likely to put your rights at risk, we tell the Icelandic Data Protection Authority (Persónuvernd) within 72 hours and tell you without undue delay where needed.
14. Children and young people
- We do not create accounts for children under 13, and we do not knowingly collect personal information from them through accounts. If we learn we have it, we delete it.
- Children under 13 can play signed out. Their play counts toward game statistics and crash reports. No ads are shown in games aimed at children, and we run no third-party tracking on llvls.com. We do not use any child’s information to show targeted ads or to build profiles.
- Parents and teachers can write to privacy@4rc4d3.com or privacy@llvls.com to ask what we hold about a child’s account, or to ask us to delete it. We may ask for information that lets us confirm you are the child’s parent or guardian.
- We act at once on reports about the safety of children. We may suspend accounts and report to the authorities, including NCMEC’s CyberTipline and national hotlines for child sexual abuse material, and the police for threats to life. Material preserved for a report is kept in a restricted store only for a year, then deleted.
- Players under 18 cannot buy, and cannot see Mature games.
15. Creators and their games
Creators receive aggregated statistics (views, plays, retention, earnings, crash reports by type and the custom events they declare). We hide small groups under 50 players. Creators also see the display names and scores on their leaderboards, and comments on their games.
Creators do not receive player email addresses, dates of birth, IP addresses or identities.
Games can talk to llvls only through our game toolkit (SDK). They have no direct network access, no storage and no cookies. Creators must not ask players for personal information inside their games, and must follow the creator terms on data. Do not paste other people’s personal information into AI assistant prompts.
16. Your rights
You have the right to:
- get a copy of your information (in Settings, use Download my data);
- correct information, such as your display name, email address or password, which you can change in Settings;
- delete your account (in Settings, use Delete my account; see section 11 for what we must keep);
- restrict or object to some processing, including processing based on our legitimate interests, and direct marketing, which you can always refuse;
- withdraw consent at any time, without affecting what we did before;
- ask for a person to review a decision made only by automated checks that significantly affects you (section 12);
- complain to the Icelandic Data Protection Authority (Persónuvernd, personuvernd.is).
For any request you cannot make in Settings, write to the privacy contact in section 1. We reply within one month. We may ask you to confirm your identity first.
17. Changes to this policy
We will tell you about material changes at least 30 days before they take effect, by email and in the service, sooner where the law requires it. The date at the top shows the current version. We keep earlier versions, and you can ask us for a copy.
18. Contact
Live Shuttle ehf., Biskupsgata 5, 113 Reykjavík, Iceland. Privacy: privacy@4rc4d3.com or privacy@llvls.com. Creator questions: hello@4rc4d3.com. Players: support@llvls.com.