Coffee First Arcade Privacy Policy
Updated October 7, 2026. This notice covers Coffee First Arcade, operated by Coffee First / First Food Group Corp.
Information used by the Arcade
Email-and-password signup uses your email address and a securely hashed password to authenticate your Arcade account. We send verification and password-reset links through Resend. We do not store readable passwords or send passwords to the main Coffee First app. Existing Google-created accounts retain their Arcade identity and can set a password by verifying access to the same email through password reset. On Android, you may also sign in with Google. Google supplies your verified email and basic profile to identify and link your Arcade account. On iPhone, use email and password. We do not access your Gmail messages, contacts, calendar or Drive files.
Your Arcade profile includes your first and last names, optional middle name, optional mobile number, five-character player tag and optional uploaded photo. We also store tournament attempts, gameplay inputs used to verify scores, token balances and transaction history. App version and last-seen information help us support the app. Authentication uses session cookies or secure device storage, and IP information may be processed for security and rate limiting.
How information is used and displayed
We use these records to run games, validate scores, operate tournaments, credit and spend tokens, provide support and prevent duplicate purchase rewards. Other signed-in players can see your player tag, chosen photo and tournament scores. Account names, emails and mobile numbers are available to authorized Coffee First administrators, not displayed on the leaderboard. Sharing a score card is your choice.
After you verify your email and complete your Arcade profile, we send your email address, name, optional mobile number and Arcade account identifier to the main Coffee First application to create or connect your Coffee First customer record. When a connected Coffee First POS or loyalty server credits a purchase, it supplies a customer identifier and purchase reference. The Arcade records the credited player, branch, amount and reference to prevent duplicate rewards. The Arcade does not collect payment-card details through this integration.
Location and nearby gyms
With your permission, the app uses your precise foreground location to show you and nearby gyms on the map. For tournaments that require proximity, a recent location, accuracy and timestamp are sent to our server to check the gym's 100-metre zone. This check does not save your location in the tournament attempt record. We do not request background location tracking. OpenFreeMap supplies map tiles; tile requests reveal the map area being viewed and network connection information to the map provider.
Service providers
Vercel hosts the Arcade website and API; Neon stores account and game records. Resend delivers verification and password-reset emails. These providers process information needed to deliver their services. Google authenticates players who choose Google sign-in on Android.
Gameplay analytics
We use Mixpanel to measure how many players practice or join tournaments and to improve the Arcade. When you play, we send an internal account identifier, game mode, start and completion or exit events, score, level, active play duration, tournament and gym identifiers, and app/platform version. Administrative testing and reviewer demo activity are labeled separately. Analytics are processed in Mixpanel's US data region. Mixpanel receives network connection information to deliver this service; we disable IP-based location enrichment and do not send names, email addresses, phone numbers, profile photos, GPS coordinates, passwords or gameplay tap recordings. We do not enable advertising tracking or session recordings.
A limited queue on your device retries analytics delivery when connectivity returns, for up to four days. Your practice best remains local, but practice activity and run scores are included in analytics. Account deletion requests also cover associated analytics records; contact us using the details below. Mixpanel processes this information as our analytics service provider.
Retention and your choices
Request deletion of your Coffee First Arcade account and associated data.
Account, gameplay and transaction records remain stored until removed by Coffee First; signing out or uninstalling the app does not delete them. You can update your profile or select Player corner → Delete account in the app. This removes your Arcade profile, photo, login and gameplay history, cancels unpaid prizes, and queues external analytics removal for our team. Anonymous transaction records may be retained. Your separate Coffee First loyalty account is not automatically deleted. To request access, correction or deletion of your account information, email edzofcit@gmail.com. The team will verify the request and explain any records that need to be retained for an ongoing tournament, transaction or dispute.
You can revoke Google access in your Google Account settings. This stops that authorization but does not itself delete your Arcade account. External services and social apps have their own privacy policies.
To prevent repeated welcome-token claims after account deletion, we retain a protected, keyed fingerprint of your email for the cooldown configured at deletion, from 1 to 365 days. The current cooldown for future deletions is available in our account policy. Your profile and existing tokens are removed immediately. You may sign up again, but the same email receives no welcome tokens during its cooldown. Changes to the setting do not alter existing expiry dates. Fingerprints stop applying at expiry and are automatically removed by a cleanup job every five minutes.