About ArcadiaPlay
A small, fast, ad-free home for open HTML5 games — run by people who still play them.
What this is
ArcadiaPlay is a game portal in the old sense: a curated list of things you can play the instant the page loads. 21 games are live today, 82.4M plays have been logged, and every one of them runs in an iframe from a build we either host ourselves or embed from a verified origin.
There are no interstitials, no "download our launcher", no stamina meters and no account wall. An account exists purely to remember favourites and ratings — and it can be deleted in one click.
- Games
- 21
- Categories
- 8
- Plays
- 82.4M
- Since
- 2
Submit a game
We list browser games that are free to play, playable on a phone, and either open-source or openly licensed for redistribution. Two ways in:
- Send a URL to a built, hosted game (an index.html is fine). We check that it frames cleanly — no X-Frame-Options, no frame-ancestors — then embed it with credit.
- Send a zip (or a repo + build command). We host the build ourselves at /games/<slug>/, which is what makes the ~0.4s start possible. This is the preferred route.
What we need from you
- · Title, one-line pitch, a paragraph of description
- · 640×360 thumbnail (16:9) and, ideally, 1280×480 banner
- · Controls summary (it shows above the player)
- · License / credit line and a link you want pointed at
What we will not accept
- · Games that phone home to an ad or analytics SDK
- · Anything requiring a wrapper, login or download
- · Loot boxes, gambling mechanics, paid boosts
- · Builds that only work with third-party cookies enabled
Send it to hello@arcadiaplay.example.com with “submission: <title>” in the subject. Replies usually take a few days; accepted games appear on /new-games the next deploy.
Report a problem
Broken embed, wrong credit, or something in a game that should not be on a family-friendly portal: mail the same address with “report: <game slug>” and we will unpublish first, ask questions second. Games we host are pulled within the hour; for embedded third-party builds we disable the frame and notify the author.
Privacy, in plain words
- No analytics, no ad SDKs, no fingerprinting. There is no third-party script on this page to do it with.
- We store four things: your email + password hash (if you register), and the favourites, ratings and comments you choose to save. Play counts are aggregate integers with no user attached.
- Sessions are a random 32-byte id in an arcadia_session cookie — HttpOnly, SameSite=Lax, 30-day sliding expiry, revoked server-side when you sign out.
- Passwords are PBKDF2-SHA256 with 310,000 rounds and a per-user salt. Nobody at Arcadia can read them.
- Embedded games load from their author's origin, so that origin sees a request for its own files — the same as any iframe on the web. Sandbox + referrerpolicy="no-referrer-when-downgrade" limit what leaks; frames never receive our cookies.
- Deletion: settings → delete account removes the row and cascades to everything attached to it. Export gives you the same data as JSON first.
Terms in five lines
- 1. Playing is free. Games remain the property of their creators; we host copies only to serve them to you.
- 2. No scraping the catalogue feed at a rate that costs us money, and no uploading anything that tries to harm visitors.
- 3. Comments are yours; by posting you let us display them on the game page. Delete them any time.
- 4. Everything is provided “as is”, without warranty. If a game offends you, tell us and we will pull it.
- 5. We may change these terms; material changes get a note on this page for 30 days before they apply.
How it is built
In case you were wondering — or want to fork it
Framework
Astro 5 — static game pages, island hydration only where interaction exists
Styling
Tailwind CSS v4 (@theme in CSS, no config file, no @apply soup)
Interactivity
React 19 islands: auth, favourites, ratings, comments, search, admin form
Data
Cloudflare D1 (SQLite + FTS5) behind one query module; every SQL string lives in src/lib/db.ts
Cache
KV for list queries (5–30 min TTLs), CDN cache headers for everything static
Uploads
R2, content-addressed by SHA-1, sniffed by magic bytes, 4 MB cap
Auth
Lucia-shaped sessions in D1 + Google OAuth with PKCE; no JWTs, no third-party IdP
Game engine
Custom 5×7 bitmap canvas core (src/engine) — the 18 in-house titles are ~6 KB each gzipped
Frames are restricted to these verified origins: hexgl.bkcore.com, pizzaedition.io, filmsbykris.com. Anything else is rejected by the admin form before it can be saved — a portal that will embed arbitrary URLs is a portal serving phishing pages.
