— Notices & Conditions —

On Privacy

How the studio handles personal data on this website and in The Assembly Line newsletter. Each game has its own privacy policy on its own site.

— Effective May 1, 2026 · Last updated July 27, 2026 —

Manu Games LLC, a North Carolina limited liability company, operating from North Carolina, USA. This policy describes how the studio handles personal data on two surfaces: the Website at manugames.com, and The Assembly Line newsletter, hosted on Beehiiv at blog.manugames.com.

The studio operates other surfaces, including Tideward (a game), Cruxsmith (its software and search practice), Peanut Gallery (a Chrome extension), and a handful of for-sale domain landing pages. Each runs on its own site, with its own privacy policy where one applies, because the data flows are genuinely different. See Other Manu Games surfaces below for the routing.

Other Manu Games surfaces

Other surfaces operated by Manu Games LLC are not governed by this policy. Use the policy that lives on the surface you are using:

The Assembly Line newsletter is hosted on Beehiiv at blog.manugames.com; its archive is covered by this policy plus Beehiiv's privacy policy.

For privacy questions, write to privacy@manugames.com. We aim to respond within 30 days, faster where statute requires.

Scope of this policy

The two surfaces have different audiences, different data flows, and different geographic availability. They are addressed separately below.

  • The Website: manugames.com, the studio's publisher hub. Globally accessible. The Website uses Cloudflare Web Analytics, a cookieless, privacy-first service that measures aggregate traffic (such as page views, referrers, and aggregate device and country breakdowns) at the edge without setting cookies or building a per-visitor profile. The studio also keeps its own aggregate count of how long Arcade games are played, described in How we measure the Arcade below. Beyond those two, the Website runs no advertising scripts, no ad networks, and no cross-site tracking or fingerprinting, and it sets no cookies. Because both measurements are cookieless, there is still no "Accept cookies" banner. The Arcade's optional live-play features process a small amount of data described in The Arcade's live tables below.
  • The Newsletter: The Assembly Line, distributed by Beehiiv. Globally accessible, subject to Beehiiv's own terms and privacy policy. Subscribing is the only way personal data enters the Newsletter system; you do that voluntarily, and you can leave with one click.

What we collect, and what we don't

The short version, in plain language:

  • Website: aside from Cloudflare Web Analytics (the cookieless, aggregate measurement described above) and the studio's own aggregate play-length count described in How we measure the Arcade below, no scripts profile you, no first- or third-party cookies are set, and there is no advertising network. The only other third-party request originates when you submit the newsletter form, which posts to Beehiiv.
  • Arcade games (solo play): nothing. Saves, streaks, and settings live in your browser's local storage and never leave your device.
  • Arcade live tables and leaderboards (optional): only if you choose to sign a display name: that name, a one-way hash of a random key your own browser mints, your ratings and scores, match results, and a day-salted abuse-limit hash that goes stale within a day. Details, including instant self-service access and deletion, in The Arcade's live tables.
  • Newsletter: only the email address you submit (and any subsequent address changes). Beehiiv handles delivery; you can unsubscribe with one click from any issue.

The website

The publisher hub at manugames.com hosts this policy, the studio's about page, the Arcade (its catalog of free browser games), the newsletter landing page, the press kit, and the contact page. It uses cookieless Cloudflare Web Analytics for aggregate traffic measurement, and otherwise runs no advertising, no fingerprinting, and no cross-site tracking. The studio's own pages set no cookies.

The newsletter form on the home page and the newsletter page posts to Beehiiv, our newsletter platform. If you submit your email to subscribe, Beehiiv handles it under Beehiiv's privacy policy; we don't store the email address ourselves. See The newsletter below for details.

The Arcade's live tables

The Arcade's games are free browser games that run entirely on your device. Playing them solo sends us nothing: saves, win counts, streaks, and settings are kept in your browser's local storage, under keys beginning manu., and never transmitted. You can clear them at any time from your browser or from the Keeper's Ledger page.

Some games also offer optional live features: public leaderboards, rated multiplayer tables, and correspondence ("slow") tables. These run on Cloudflare Workers and a Cloudflare D1 database operated by the studio. There are no accounts: no email, no password, no sign-up. If you choose to play, you pick a display name once, and your browser mints a random key it keeps locally as your credential.

  • What is stored when you play live: your chosen display name; a one-way, peppered SHA-256 hash of your browser-minted key (we never see or store the key itself); your rating, games played, and wins per game; finished match records (the participants' display names, finishing ranks, rating changes, and a timestamp); solo leaderboard scores you submit; standing correspondence challenges and the turn state of slow tables; and a day-salted hash of your IP address used only for rate and abuse limits, which cannot be linked back to you after the day turns.
  • What is deliberately not collected: no email, no real name, no account, no precise location, no advertising identifiers, no cross-site anything. The display name is the only human-readable identifier, and you choose it.
  • Purposes: running the boards and tables you asked to join (pairing opponents, keeping the ladders honest, resuming interrupted games) and limiting abuse.
  • Access and portability, instantly: the Keeper's Ledger shows the complete record the service holds under your key and lets you download it as JSON, on the spot, no email required.
  • Deletion, instantly: the same page has a self-service Forget me action. It deletes your ratings, scores, and standing challenges, releases your display name, and replaces your name with “A departed keeper” in finished match records and sealed weekly honors; those rows are also your opponents' history, so the record of the game survives while your name leaves it. A separate button clears this device's local pockets.
  • Retention: finished rated-match records prune automatically after 90 days; single-use connection tickets last minutes; day-salted abuse hashes are unlinkable after 24 hours; unclaimed correspondence challenges sweep after 7 days; ratings and leaderboard scores stand until you delete them.
  • Sharing: none. Display names, ratings, and scores appear on the public boards you chose to join (that is the point of a leaderboard), and nothing is sold, shared for advertising, or given to third parties. Cloudflare processes the data as our infrastructure provider.

Server logs

The Website is hosted on Cloudflare Pages. As a structural matter, Cloudflare's edge network processes standard technical request data (IP address, user agent, requested path, response code, timestamp) in the course of serving and securing the site. We do not retrieve these logs and do not maintain any copy of our own; the only traffic measurement we see is the aggregate, cookieless Cloudflare Web Analytics described above, together with the aggregate play-length count described below. Cloudflare's data practices are governed by Cloudflare's privacy policy.

How we measure the Arcade

The studio needs to know which games are worth keeping, which is a question about the games rather than about the people playing them. So when you leave a game page, the page reports two things to the studio's own server: which game it was, and how many seconds the game was actually on screen. Time spent with the tab in the background is not counted.

That report is immediately folded into a counter and the underlying number is discarded. What is stored is only a tally of the form "on this date, this game had this many visits lasting under ten seconds, this many lasting a minute, and so on". There is no identifier of any kind, no cookie, no account, no IP address, and no row that represents a person, so there is nothing that could later be connected back to you, by us or by anyone else. It is not possible to ask this data what any individual did, because it was never recorded.

The measurement is skipped entirely if your browser sends Do Not Track or Global Privacy Control. Nothing else about your visit is transmitted.

The newsletter (The Assembly Line)

The Assembly Line is the studio's newsletter covering factory, automation, and idle games. It is distributed via Beehiiv, an email newsletter platform.

  • What is collected at signup: your email address. The form on the studio's pages collects no other personal information (no first name, no preferences). If you sign up via Beehiiv's hosted page (blog.manugames.com) Beehiiv may offer optional fields; anything beyond email is your choice.
  • Consent mechanism: subscription is opt-in; you must submit the form yourself. Where Beehiiv sends a confirmation email, you must follow the confirmation link to begin receiving issues. Either way, no email is added to the list without your affirmative action.
  • Where your data is processed: Beehiiv processes subscriber data on infrastructure located in the United States. For subscribers outside the United States, Beehiiv's own data-transfer protections (including its Standard Contractual Clauses for transfers from the EEA, UK, and Switzerland) apply.
  • What we use it for: sending you the newsletter, and only the newsletter. We don't repurpose subscriber emails for advertising, don't sell the list, and don't share it with third parties beyond Beehiiv as our processor.
  • Engagement metrics: Beehiiv records standard email-engagement signals (opens, clicks, bounces, unsubscribes) at the platform level. We see aggregate numbers in the Beehiiv dashboard; we don't extract or repurpose individual-level engagement data.
  • How to unsubscribe: every newsletter issue includes a one-click unsubscribe link in the footer. You can also email privacy@manugames.com and we'll handle it for you. Unsubscribing removes your email from active mailing; Beehiiv may retain a suppression record so you don't accidentally re-subscribe to the same address.

Retention

  • Edge request logs at Cloudflare are retained under Cloudflare's own policies; we do not retrieve or retain them ourselves.
  • Arcade live-play data follows the schedule in The Arcade's live tables: match records 90 days, abuse hashes a day, tickets minutes, ratings and scores until you delete them yourself on the Keeper's Ledger.
  • Newsletter subscriber data is retained by Beehiiv for as long as you remain subscribed and for a reasonable period thereafter for suppression-list and audit purposes. You can request deletion at any time by emailing privacy@manugames.com.

Your rights

The specific rights you have depend on where you live. To exercise any of them, write to privacy@manugames.com. We will respond within the timeframe applicable law requires (commonly 45 days, sometimes extendable).

  • Right to know / access: confirmation of whether we process personal information about you and a copy of what we hold. For the Newsletter we'll confirm what's on file (your email and any engagement-metric aggregates Beehiiv records). For Arcade live play, the Keeper's Ledger answers instantly with the complete record and a JSON download.
  • Right to correct: to correct inaccurate personal information we hold.
  • Right to delete: for Newsletter data, unsubscribe in any issue or write to us. For Arcade live play, the Forget me action on the Keeper's Ledger deletes instantly, no email needed. For anything else, email us.
  • Right to opt out of "sale" or "sharing" for cross-context behavioral advertising. We do not sell or share. There is nothing to opt out of.
  • Right to portability: receive your personal information in a structured, machine-readable format.
  • Right to limit use of sensitive personal information. We do not process sensitive personal information.
  • Right to non-discrimination: we will not deny service, charge different prices, or provide different quality because you exercised a privacy right.
  • Right to appeal: if we deny a rights request you submit, you may appeal by replying to our response email within 60 days; we will respond to the appeal within 60 days and explain our reasoning.

For users outside the United States interacting with the Website or Newsletter, see International users below for additional rights and how to exercise them.

Children

The Assembly Line is a general-audience publication and is not directed to children within the meaning of the U.S. Children's Online Privacy Protection Act (COPPA, 16 CFR Part 312) or the New York Child Data Protection Act. We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and become aware that a child under 13 has subscribed to the Newsletter, contact privacy@manugames.com. We will delete personal information consistent with COPPA, document the deletion, and confirm in writing.

International transfers

Beehiiv (Newsletter). Beehiiv processes subscriber data in the United States. For subscribers outside the United States, Beehiiv's own transfer protections (including Standard Contractual Clauses where applicable) apply. We do not separately re-transfer.

Beehiiv's privacy policy is at beehiiv.com/privacy.

Security

We rely on infrastructure-level security from our service providers. The Website is a static site with no authentication system; the only server-side logic we operate is the Arcade's live-table service described above, which runs on Cloudflare Workers with single-use tickets, per-IP rate limits, and hashed identifiers, and holds no emails, passwords, or payment data at all. Beehiiv operates its own security controls. Our attack surface is a static site served through Cloudflare Pages, a small games service that stores nothing sensitive, and a newsletter platform we don't control.

Breach notification

If a personal-information breach occurs that is likely to affect you, we will notify you and, where required, the applicable state attorney general or enforcement authority within the timeframes the applicable law requires: generally "without unreasonable delay" under most U.S. state breach-notification statutes, with specific deadlines in some states.

Where a breach occurs on Beehiiv's infrastructure, Beehiiv is required to notify Manu Games without undue delay; the same notification clocks then run for us as data controller.

US state-specific notices

If you are a resident of California, Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Iowa, Indiana, Tennessee, Montana, Delaware, New Hampshire, New Jersey, Nebraska, Maryland, Minnesota, or Rhode Island, or another state with a substantially similar comprehensive privacy law, the following apply to your interaction with the Newsletter:

  • Categories of personal information processed: your email address (Newsletter), plus any aggregate engagement metrics Beehiiv records; and, if you opt into Arcade live play, a chosen display name, hashed identifiers, and game results as described in The Arcade's live tables.
  • Purposes: sending the Newsletter you've subscribed to.
  • Categories of third parties with whom personal information is shared: Beehiiv as service provider for the Newsletter; Cloudflare, Inc. hosts the Website (Cloudflare Pages) and processes standard technical request data at the edge.
  • We do not sell personal information. We have not sold personal information in the prior 12 months and do not intend to.
  • We do not "share" personal information for cross-context behavioral advertising. We do not engage in advertising at all.
  • We do not engage in profiling for legal or similarly significant decisions.
  • Sensitive personal information: we do not process sensitive personal information as defined by these statutes.
  • Universal opt-out signals (GPC): because we do not engage in selling, sharing, or targeted advertising, there is no such processing for a Global Privacy Control or equivalent signal to opt out of. We honor any signal we are required by law to honor.
  • Right to appeal: if we deny a rights request you submit, you may appeal by replying to our response email within 60 days; we will respond within 60 days and explain our reasoning.

Maryland (MODPA). We limit collection of personal data to what is reasonably necessary and proportionate to the specific service you have requested. We do not sell personal data of any consumer we know to be under 18, and we do not process minor data for targeted advertising.

California (CCPA / CPRA). California residents have specific rights described above (right to know, delete, correct, opt out of sale/sharing, limit use of sensitive PI, non-discrimination, appeal). Retention windows are described in Retention. Our designated method for submitting rights requests is the email address in Contact.

International users

The Website and Newsletter are globally accessible. If you are reading from outside the United States, this section addresses how international privacy frameworks apply.

Lawful basis for the Newsletter (GDPR / UK GDPR). The lawful basis for processing your email address for newsletter delivery is your consent (Article 6(1)(a)). You may withdraw consent at any time by unsubscribing in any newsletter footer or emailing privacy@manugames.com; withdrawal does not affect lawfulness of processing before withdrawal.

Lawful basis for the Website. The Website does not process personal data of visitors beyond the Cloudflare edge logs and the cookieless, aggregate analytics described above, neither of which we can tie to a person. There is therefore no controller-side processing of EEA / UK personal data on the Website to assign a lawful basis to.

EU/EEA and UK rights. If you are in the EEA or UK, you have rights under the GDPR and UK GDPR including access, rectification, erasure, restriction, portability, objection, and withdrawal of consent. You may also lodge a complaint with your local supervisory authority. Exercise rights by emailing privacy@manugames.com.

Other regions. If you are in Canada (PIPEDA), Quebec (Law 25), Brazil (LGPD), Australia (Privacy Act 1988), Japan (APPI), South Korea (PIPA), or any other jurisdiction with a comprehensive privacy law, you may have analogous rights under your local law. We recognize these rights to the extent they apply to the Website and Newsletter and respond to requests in good faith.

International transfers. Beehiiv processes Newsletter data in the United States; see International transfers for the transfer protections that apply.

Third-party links

The Website and Newsletter link to third-party services we don't control: Apple's TestFlight and App Store (for our games), Discord, X, Beehiiv (the newsletter platform itself), the founder's personal portfolio link, and the dedicated game sites we publish. Once you click through, you're governed by their privacy practices, not ours.

Updates to this policy

We may update this policy when our data practices change, when statute requires, when we expand to new regions, or when we improve the wording. The Effective Date and Last Updated stamps at the top will move forward.

Contact

Three channels, each scoped to a specific kind of question:

Manu Games LLC
89 Waynesville Plaza #1028
Waynesville, NC 28786
United States