Privacy policy

Effective 21 October 2026 · ARBLAST is made by Hatchify Pty Ltd, Australia.

What stays on your phone

To put the game into your surroundings, the app uses the camera and motion sensors through Apple's ARKit. The camera picture, the 3D shape of the room (walls, floors, furniture) and the printed arena markers it recognises are processed on the phone, used straight away (for example to draw the virtual world around you, or to warn you about a wall behind you) and then thrown away. The camera picture is never sent to us or anyone else. In a match, so that every player sees the same virtual crates and barriers in the same places, the phone does tell the game server where it has seen walls, tables and seats — only as plain boxes (what kind of thing, where it is and how big it is), never pictures, depth or a detailed scan — and the server keeps that shared map only while the match is on. The same on-phone rule goes for recognising players in team bibs: the phone looks for people and bib colours in the camera picture and forgets them straight away; anyone it can't match to a player in the game (for example someone watching) is simply ignored. In Friend Practice the phone finds the shape of the friend in front of it (shoulders, elbows, hips, knees and so on) to draw the hero over them; that also stays on the phone and is forgotten straight away.

On Android the same happens through Google's ARCore and ML Kit, which run on the phone. ML Kit, which the Android app also uses to scan QR codes, sends Google anonymous figures about how well these features perform and how often they're used, never camera images; Google says it doesn't use them for advertising.

If you connect a Bluetooth blaster, the app talks to it only on your phone, and nothing about it is sent to us.

The phone also stores your settings (like which hand you hold the phone in), the last callsign you typed, and a random ID for this installation of the app.

What is sent to the game server during a game

• A random installation ID made up by the app (not your phone's serial number or advertising ID), and a short-lived session code that lets you rejoin if your connection drops.
• Your callsign. By default the app makes one up for you (like "Swift Otter"). If you type your own, please don't use your real name. Callsigns are checked against a list of words that aren't allowed.
• Where you are in the arena — your position in metres and the direction you're facing, measured from the printed marker, about 20 times a second. This is not your location on a map.
• What you do in the game — blasts, team, ready status, map pings and preset callouts.
• Your bib (if the game uses team bibs) — its colour and number, like "BLUE 7", and where your phone sees other players in the game standing on the floor (in metres, a few times a second), so markers and blasts line up with the real people.
• Technical details — the app version, iOS version and iPhone model, so the server can check the app is compatible.

The server keeps this in memory only, to run the game, and shares it with the other players in the same game (for example, so they can see you in the arena). It is not written to disk, and it is deleted when you leave or the game closes. Match results are shown to the players at the end of the match and are not kept.

Player accounts (optional, 13 and over, or older in some countries)

You don't need an account to play. If you're old enough for an account in your country (13 in most countries; see below) you can create one in the app, to keep a username for later features like adding friends you've played with in person. When you do, we keep:

• Your username (3–16 letters and numbers). It's checked against a list of words that aren't allowed. Please don't use your real name.
• Your email address, if you sign up with an email code — or, if you use Sign in with Apple or Google, the account ID Apple or Google gives us and the email address they share (with Apple this can be a "Hide My Email" relay address). With Apple we also keep a token we use only to tell Apple when you delete your account.
• Your country, which you choose in the app (it suggests the country your phone is set to; we never work it out from GPS or your internet address). It sets the age from which you can have an account without a parent's consent: 13 in most countries; 14 in Austria, Bulgaria, China, Cyprus, Italy, Lithuania, South Korea and Spain; 15 in the Czech Republic, France, Greece and Slovenia; and 16 in Croatia, Germany, Hungary, Ireland, Liechtenstein, Luxembourg, the Netherlands, Poland, Romania, Slovakia and Vietnam. It also sets how your postcode is written and, later, which events count as near you. You can change it in the app, unless you're too young for the new country's age.
• Your birth month and year. We use them only to check you're old enough for an account in your country and, later, whether you can switch on promotions (16 and over). They're never shown to anyone. If you're too young, we don't create an account and we don't keep anything you typed — not even your email address.
• Optionally, your suburb or postcode (never your address or GPS location), your notification settings, which version of our terms and this policy you agreed to, and when you last used the app.

Your sign-in stays on your phone as a token that lasts 30 days; on our server we keep only a scrambled (hashed) copy. Sign-in codes we email you work once, for 10 minutes. Promotions (like tournaments) are off unless you switch them on, and only players aged 16 and over can.

You can delete your player account at any time in the app (Profile → Delete account). It's deleted straight away with everything linked to it, and if you used Sign in with Apple we tell Apple to revoke ARBLAST's access. Copies in our backups are gone within 14 days. Without the app, see Delete your account.

Email

We send email only when it's needed for your account: sign-in codes, codes to confirm an address, invitations and password reset links for organisers and staff, and notices when these terms or this policy change. We never send marketing email. Our emails are sent by Zoho ZeptoMail (Zoho Corporation's transactional email service, from its Australian data centre), which processes the address, the message and delivery details for us. If an email to your address bounces or is reported as spam, we stop sending to it (we keep only a scrambled copy of the address for that).

Server logs

The game server records technical events — for example "game created", "player joined", "match ended" — using random IDs, never callsigns or internet (IP) addresses. Our web server's request logs store IP addresses with the last part removed; its error log can include a full address when a request fails. All of these logs are deleted after 14 days. Sign-ins to the venue operator console, including failed attempts, are logged with the full address, to protect the service.

Website analytics

On the arblast.io pages for organisers (the home page and the pages for organisers, schools and clubs) we use Google Analytics, loaded through Google Tag Manager, to see how people find and use the website, and only after you choose Allow analytics in the cookie notice. If you don't, Google Tag Manager and Google Analytics aren't loaded at all. Google Analytics doesn't store IP addresses, Google signals and ad personalisation are turned off, no advertising cookies are used, and event data is kept for 2 months. You can change your mind at any time with Cookie settings at the bottom of those pages. Analytics never runs on match join pages, on this page or the other help pages, or in the consoles, and the ARBLAST apps don't use Google Analytics.

Install and link stats in the app (AppsFlyer)

The iPhone and Android apps use AppsFlyer, in a privacy mode we've set up for an app children use, to count installs, to see which shared match links and campaigns lead to them, and to open the app at the right screen when someone taps an ARBLAST link (including straight after installing the app from that link). AppsFlyer receives a random ID it creates for the installation, the app version, the device model, operating system, language and country setting, the IP address (which we've set AppsFlyer to mask), the ARBLAST link that was opened (a match link contains its short game code), and five anonymous events: a player account was created, a match was joined (with the match type), a match finished (with the match type and win, lose or draw), the first Solo Range was completed, and a match link was shared. On Android it also receives the Google Play install referrer and the result of Google's app-integrity check.

It never receives an advertising ID (the iPhone app never asks to track you, and the Android app can't read the advertising ID), a name, username, callsign, email address or location, and we've told AppsFlyer not to share anything with advertising networks or other partners. AppsFlyer processes this for us, possibly outside Australia, under its data processing terms. It's on by default; switch off Install & link stats in the app's Settings and the app stops sending it.

Live streams and recordings

An organiser can stream one of their matches live to their own channels, such as YouTube, Twitch, Facebook, Instagram, X or TikTok, and can record it. ARBLAST's own team can do the same for any match. A stream is drawn from the game's data, the same way as the venue's big-screen spectator wall: the virtual arena, each player's view of it, players' callsigns, teams, scores and game events, with the ARBLAST name. It never includes camera video or images, sound, location or the game's join code. Because callsigns appear on streams, we suggest players use a nickname rather than their full name.

The stream is put together by LiveKit, a video service that works for us: it opens our broadcast page in its own cloud browser and sends the video to the channels the organiser chose. Once it reaches those channels, it's published under the organiser's account and that platform's own terms and privacy policy. Recordings are kept in our Cloudflare storage for 30 days, so the organiser can download them, and are then deleted. Streaming keys that organisers save are encrypted and only used to start their streams.

Organisers, venues and operators

Adults who run games for a school, club or venue sign up for an organiser account on the ARBLAST console with their name, email address, organisation and a password. We email a code to confirm the address, and keep these details, the account's approval status (and any note our staff add when approving or declining it) and which version of our terms they agreed to until the account is deleted. Organisers can turn on two-step sign-in (a code by email when signing in with a password on a new browser); if they choose to "trust this browser" we keep a scrambled token for that browser for 30 days. Organisers can plan matches ahead: we keep each match's title, date, arena, rules, join code and its last result (the winning team, team scores and number of players — never player names or callsigns) until the organiser deletes it. Please use event names, not children's names, as match titles. Bib artwork is made in the organiser's browser and isn't stored.

Organisers and ARBLAST staff can sign in with Google instead of a password. If you do, we receive your name, email address and Google account ID from Google, and keep the ID and email with your account until you disconnect Google or the account is deleted. We don't receive or keep anything else from your Google account. (Players with an account can sign in with Google too: see above.)

Organisers and venue staff can also sign in with Apple. If you do, we receive your Apple user ID, your email address (or an Apple "Hide My Email" relay address) and, the first time only, your name, and we keep them with your account until you disconnect Apple or the account is deleted. When you delete your account or disconnect Apple, we also tell Apple to revoke ARBLAST's access. You can delete your account at any time in the console or the app.

If you came to the organiser sign-up from one of our ads or links, we keep which campaign it was (for example "instagram / paid / spring-schools") and the website you came from (just its name, like instagram.com) with your application, so we know which ads work. If our website gave your browser an anonymous Google Analytics ID, the server also tells Google Analytics, using only that ID, that a sign-up happened (once your email is confirmed) and when it was approved — never your name, email address or account. We forget the Google Analytics ID once your application is decided.

Organisers and venue staff can watch and pause their games for safety, and ARBLAST staff can see every game, to keep the service safe. They see the same callsigns, positions and scores the players see. Venue staff can also set up an arena (its shape, bases and marker positions — no personal information).

Children and schools

ARBLAST is designed for supervised play, including in schools. We have designed it to avoid collecting children's personal information: playing needs no account, there's no contact between players outside preset team callouts, no photos or video, and nothing is kept after a game. Player accounts are only for people aged 13 and over, or older where their country sets a higher age; we ask for a country and a birth month and year, and if someone is younger than that we don't create an account or keep anything they entered. We never email anyone too young for an account (they have none). Schools and venues running ARBLAST arrange consent with families and can assign callsigns instead of names.

Sharing

We don't sell or rent information, and we don't share it with advertisers or data brokers. The game server runs on Amazon Web Services in Sydney, Australia; AWS stores and processes data for us under its own security and privacy commitments. The accounts and other records described above are kept in a database run for us by Supabase, also in Sydney (on AWS): only our game server can reach it, and it is backed up daily, with backups kept for 7 days. Email is sent through Zoho ZeptoMail (Australia), organiser sign-up conversions (only an anonymous browser ID and the campaign, as described above) go to Google Analytics, the apps' install and link stats go to AppsFlyer, and live streams and recordings are produced by LiveKit and stored with Cloudflare (all as described above). Apple and Google learn that you signed in to ARBLAST when you use their sign-in, under their own privacy policies. We may disclose information if the law requires it.

Your choices

Without an account, there's nothing to delete: the installation ID is removed when you delete the app, and game data is already gone when a game closes. Players with an account can change their username, country, suburb, postcode and settings, and delete the account, in the app at any time. Anyone can switch off Install & link stats in the app's Settings. Organisers and staff can delete their account (and saved matches) themselves on the console or in the app, or ask us to. If you have a question or a privacy request, or you think something isn't right, email privacy@arblast.io. If you are in Australia and you're not happy with our answer, you can contact the Office of the Australian Information Commissioner (oaic.gov.au).

Changes

If we change how ARBLAST handles information, we'll update this page and its date before the change takes effect, explain important changes in the app, and email everyone with an account. You'll be asked to agree to the new version the next time you sign in.