Privacy Policy · AI Game Platform

This policy explains what personal data AI Game Platform collects, why, who we share it with and what you can do about it. The operator and data controller is [FILL IN: legal entity name] (BIN [FILL IN: BIN], [FILL IN: registered address]). Questions and requests: [FILL IN: personal data requests email].

Scope

This policy covers the website, the app, the play domains where games run, the API and agent (MCP) access. It applies to guests, account holders and authors. Games are made by other users, but they run in our sandbox and do not receive your account data; this policy also covers the data the Platform processes while you play them.

Data we collect

Account and profile

Email address (for sign-in codes and important messages about your account).
Date of birth, used to apply age-based features. It is private: only you and our moderation team can see it.
Nickname, display name, avatar, bio and link, if you add them.
Language, notification and privacy settings, the list of users you have blocked.
The versions of our documents you accepted and when; for users under 14, the record that a parent or guardian gave consent.
If you sign in with Google, Apple, VK ID or Yandex ID: the account identifier and the email address the provider shares with us. We do not receive your password for that service.

Guests

When you play without an account we create a guest record with an automatic nickname and a session, so you keep the same identity on return visits. A guest has no email or date of birth.

What you create and share

Games, code, images, sounds, titles and descriptions; prompts, attachments and dictated audio you send to AI tools.
Comments, likes, follows, reports, party chat messages and remixes.
Game saves and match results.

Voice chat

Voice in parties and matches passes through our own media server (LiveKit) so that other participants can hear you. We do not record or store voice. Microphone access is optional and controlled by your browser.

Usage and technical data

IP address, browser type, device type and screen class, language, and approximate country derived from the IP address (used, for example, to choose which sign-in methods to show).
Play sessions: which game was started, when, for how long, on what kind of device, and in which language. Authors see these only as aggregates (we do not show groups smaller than five people).
Security and abuse signals: rate-limit counters, failed sign-in attempts, moderation history.
Cookies and local storage, described in the Cookie Policy. We do not use advertising or third-party tracking cookies.

Why we use data and on what basis

To provide the Platform (accounts, games, matches, social features, authoring tools): performance of our contract with you, and your consent where the law requires it.
To apply age-based protections: legal obligation and the protection of children.
To keep the Platform safe (moderation, automatic content filtering, fraud and abuse prevention, enforcing our terms): legal obligation and our legitimate interest in a safe service.
To rank and recommend games as described in the Recommendation Rules: performance of the contract and legitimate interest.
To give authors statistics about their games, in aggregate form: legitimate interest.
To communicate with you about your account and changes to our documents: performance of the contract.
To comply with the law and respond to lawful requests from authorities.

For users in Russia, the legal basis for processing is your separate Personal Data Consent together with the other bases allowed by Federal Law No. 152-FZ. For users in Kazakhstan, processing is based on your consent and the grounds provided by the Law of the Republic of Kazakhstan "On Personal Data and Their Protection".

We do not sell personal data and we do not use it for targeted advertising.

Who we share data with

We share personal data only with service providers that help us run the Platform, under contracts that limit their use of it, and with other users only as the features you use require.

Hosting: our main servers are hosted by DigitalOcean in [FILL IN: country of the main data centre], where the database, files and the voice server run. Data of users in Russia is first recorded on a server in the Russian Federation (see below).
Email: Resend delivers sign-in codes and service emails (servers in the USA).
AI: OpenAI processes prompts, attachments, dictated audio and generated content for AI generation, and checks texts with its moderation model (servers in the USA).
Network: Cloudflare serves the domains where games run.
Sign-in providers: Google, Apple, VK and Yandex, only if you choose to sign in with them.
Other users see what you make public: your nickname, avatar, public profile, published games, comments and, in a party or match, your chat messages and voice.
Authorities, when the law requires it, and successors in a merger or sale of the Platform, under the same protections.

International transfers

Some providers process data outside the country where you live, including in the USA. Where the law of Kazakhstan or Russia requires it, we transfer data only to countries that provide adequate protection or on the basis of your consent and appropriate safeguards.

Users in Russia

Personal data of users located in Russia (determined by IP address at registration, or by the country of the account) is first collected, recorded, systematised, accumulated, stored, updated and retrieved in a database on a server located in the Russian Federation, as required by Article 18(5) of Federal Law No. 152-FZ. Only after that is it copied (cross-border transfer) to the operator's main servers. The transfer goes to the Republic of Kazakhstan, where the operator is located (a party to Council of Europe Convention 108, a country providing adequate protection of personal data), to the country of the main data centre ([FILL IN: country of the main data centre]) and to the processors listed above. The operator notifies Roskomnadzor of personal data processing and of cross-border transfer; registry of operators number: [FILL IN: Roskomnadzor operator registry number].

How long we keep data

Party and match chat messages: 30 days.
Notifications: 90 days.
Detailed play-by-hour data: 7 days; aggregated game statistics: while the game exists.
Guest records: deleted after 30 days without a visit.
One-time sign-in codes and rate-limit records: up to 48 hours after they expire.
Account: until you delete it. After deletion the account is hidden at once, your sessions are ended, and email and nickname are erased within 30 days. Content that others have remixed may remain in their remixes. Backups are overwritten on their normal schedule.
Moderation records may be kept longer when needed to prevent repeat abuse or to meet legal obligations.

Your rights

Depending on where you live, you can ask us to tell you what data we hold, give you a copy, correct it, delete it, restrict or object to processing, and withdraw consent. You can change most data and delete your account yourself in settings. For anything else, write to [FILL IN: personal data requests email]. We answer within the time the law requires (for example, 10 working days under Russian law). You can also complain to the data protection authority in your country.

Withdrawing consent does not affect processing that already happened. If you withdraw consent needed to run your account, we may have to close it.

Children

Accounts are open to all ages, with protections that depend on age. A parent or guardian must give consent for a child under 14. Children under 13 cannot use voice chat, comments or chat messages, and their public profile shows only nickname, avatar and games. See Child Safety and Parents. If you believe a child's data was collected without the required consent, contact [FILL IN: personal data requests email].

Security

We use encryption in transit, session cookies that scripts cannot read, isolation of user-made games on separate domains, access limits for staff, and audit logs for moderation. No system is perfectly secure; if a breach affects you, we will notify you and the authorities as the law requires.

Changes

We may update this policy. The version id and date at the top show which text is current; material changes are announced in advance.