Privacy Policy

Who operates the service

Engines of Creation, LLC operates this service. Contact nick@enginesofcreation.xyz for privacy questions, access requests, corrections, or deletion requests. We may need to verify account ownership before acting.

Information used

Auth0 handles sign-in and provides account identifiers and available profile information such as name and email. For advanced pilot access, we store your email, its verification status, your application and submitted use case, and administrator approval or rejection records. We also store team membership, roles, the country and adult confirmation you provide, and policy acceptance records. Earlier invitation tokens and invitee addresses remain stored as keyed hashes. Confirmed subscriptions can activate account access without a manual pilot application.

Advanced cloud workspaces process project source, instructions, revisions, AI output, test reports, review evidence, credit accounting and release records. Private project artifacts are encrypted at rest by the application. Service providers also process technical information such as request metadata, IP addresses, errors, and access logs.

Private backups, community listings and product reliability

Cloud backups are optional. New complete project backups can include the project name, browser source, requirements, conversation and project memory, including notes, skills and review records. You explicitly choose to upload them; the new backup format is encrypted at rest and private to your account in the application. It excludes your credential vault and session API keys. You can download or restore a separate copy, including after a subscription ends while you can still sign in. Older source-only backups remain readable. The latest and five previous versions are available for recovery; this window is not a promise that earlier stored objects have been deleted. Contact us using the address above about deletion of account backups.

Published browser games share their source publicly. Catalog discovery requires an additional opt-in and review. Public creator names and descriptions are supplied by creators. Reports and moderation decisions are retained to investigate abuse and maintain a review trail; reports are visible to platform moderators.

We record aggregate counts of creation, checkout handoff, connected-provider presence, builds, publishing and client errors in our first-party service logs and, when configured, an aggregate reporting database. These event payloads contain no account identifiers, prompts, API keys, project source, URLs or error messages. We do not add analytics cookies or third-party tracking for these counts, and honor the browser Do Not Track setting. Hosting providers may separately process ordinary request metadata as described below.

Optional build-diagnostic sharing has a separate account control in Memory & docs. If you opt in, it sends only provider/model categories, bounded duration and check counts, review/outcome categories and fixed failure codes. It sends no prompts, source, memory text, file paths, terminal contents, keys or raw error messages. Withdrawing stops future collection; it does not automatically delete records already saved. Backup permission does not grant permission for diagnostic sharing or visitor analytics.

Optional site analytics

When optional site analytics is enabled, you can allow or decline it in Analytics preferences. Before you allow it, we do not collect optional visit analytics or load optional analytics providers. Your choice is saved in this browser. We honor Do Not Track and Global Privacy Control. You can change your choice using Analytics preferences; withdrawing stops future collection and clears this browser's analytics session identifier. It does not erase counts already recorded.

If you allow optional analytics, our first-party reporting uses a random browser-tab session identifier, fixed page categories, broad device, browser and operating-system categories, approved campaign categories and allowlisted product actions such as starting, cancelling or finishing a build. We also measure numeric page performance, operation timing, public-page scroll milestones and visible active time, excluding hidden and idle periods. Sessions measure browser tabs, not identified people. We do not send account identifiers, email, prompts, project names or source, API keys, conversations, terminal contents, full page URLs, query strings, fragments or referring URLs in these event payloads. We retain reporting data to understand use of the service; no fixed automatic deletion period is currently configured.

Remembering return visits is a separate, optional choice. If you allow it, this browser keeps another random identifier for up to 90 days. Our first-party service stores a purpose-specific hash to measure returning browsers and mature return-day cohorts. We do not join it to your account, identify a person, or send this persistent identifier to PostHog or Google. Disabling remembering clears the identifier in this browser; counts already recorded remain. Clearing browser storage, using a different browser, or expiry starts a new observation. New measurement scopes or changed vendor projects require a fresh choice; earlier declines remain declined.

Authorized administrators also see aggregate platform-access requests, verified payment receipts, active paid access and trial conversion from existing service records. These business reports are separate from optional visitor tracking and do not link your analytics identifier to billing identity. Recorded plan amounts are not a complete statement of net cash revenue, fees or refunds.

If configured, PostHog receives limited action categories after you allow analytics, with a random session identifier and no identified person profile. Session replay, automatic click capture and input recording are disabled. Google Analytics requires a separate choice in Analytics preferences and is used for approved public-page measurement. It can set analytics cookies and process technical request information, including IP addresses and browser information, under Google's policies. Advertising storage, advertising personalization and Google Signals are disabled. These providers can process data outside your country. Their dashboards and retention settings are separate from our first-party report.

AI operational diagnostics and customer support

If you request EoC publishing access, we store your account-linked project name, target store, submitted release descriptions, disclosures and review links, publishing status and review history. Authorized EoC administrators review these details. Joining the waitlist does not submit your game to a store. Store submission through EoC requires a separate publishing agreement; release materials then follow the selected store’s processing rules. Contact us using the address above for correction or deletion requests.

To investigate failed AI requests, we retain account-linked request IDs, provider and model names, timestamps, duration, outcome categories, token counts and available cost estimates for up to 30 days. These diagnostic records contain no prompts, project source, API keys or provider responses and are never used to bill you or train models. Authorized administrators can review these records alongside support cases, account access and billing history. Support notes and action records are retained to resolve requests and maintain an accountable history; do not send us credentials in support messages.

Browser creator and local API credentials

EoC does not use your projects, prompts, conversations or generated code to train AI models, and does not sell this content as training data. AI requests still send relevant context to your chosen provider; its processing, retention and training policies and your account settings apply. This commitment does not promise that every external provider has the same policy.

Browser drafts, conversations and project memory stay on your computer by default. A complete private backup includes the permitted conversation and memory fields only when you choose to back them up. Unfinished build checkpoints remain local. Active memory notes can be included in your next requested AI build and review. Optional saved connections are scoped to your account and encrypted in this browser with your vault password. The password and decrypted credentials stay in memory while unlocked. They do not sync to other computers, and EoC cannot recover your vault password.

Quick connection keeps an API key only in this tab’s memory until you disconnect, refresh or close the tab. It does not save the key to the local vault. Recoverable build checkpoints exclude connection credentials.

When you build with your own API key, EoC transiently relays that key and the required conversation/source to your selected provider. EoC does not persist these customer API keys or OAuth credentials on its servers. Provider processing and retention policies still apply. OAuth may use short-lived authorization state on EoC; resulting customer credentials return to the local vault. Platform application-registration secrets are separate.

Providers and publication

Publishing a browser game makes its source, compiled game and optional preview screenshot publicly accessible for play and remix. EoC stores those public artifacts and an account ownership record. Unpublish removes the hosted artifacts; a limited publication record remains for ownership and rate limits. Copies other people already downloaded or remixed cannot be recalled.

Vercel hosts the frontend, Auth0 provides authentication, and Cloudflare provides the control plane, storage, workflows, and isolated builds. When you approve an AI quote, relevant source and instructions go to its named model providers, which may include OpenAI and Anthropic. Provider processing and retention follow the applicable provider policies and account settings; we do not promise zero retention.

After you separately approve a release, GitHub receives source and Vercel receives the compiled app for your selected destinations. Those copies follow the access and retention settings of your destination accounts. Published apps may be accessible to others. Providers may process data outside your country.

Payments, subscriptions and GitHub identity

For the optional Regular trial, we store the account identity, a hash derived from your verified email, start and expiry times, country and policy acceptance versions. Stripe securely collects and saves the required card. We store your email and Stripe customer, card-setup and payment-method references to confirm eligibility; card numbers and security codes do not pass through EoC. The trial starts after successful card confirmation, with no charge or automatic renewal. Signing in does not start a trial or make a purchase.

For subscription connections, provider-managed credentials stay on your computer in the official provider client. EoC stores pairing and job records, not your provider password or subscription tokens. Project source travels to your paired computer and chosen provider; generated results return to EoC for review and saving. You can pause the companion or disconnect it in Studio.

Payment providers handle checkout and payment details. We store transaction references, subscription status, and credit records to deliver purchased services. When you connect GitHub for source access, we verify and store your GitHub user ID, username, linked workspace, and repository invitation/access status. GitHub receives the requests needed to grant or remove your access. The identity connection does not request access to your personal repositories, and we do not store its OAuth access token.

You can disconnect GitHub in Source access or revoke the OAuth application in GitHub settings. Billing must be cancelled separately through Manage subscription. We keep access and billing records as needed to operate the service and resolve requests; contact us to request account data removal.

Subscription and integration records

Stripe processes card checkout; NOWPayments processes supported blockchain payments. EoC stores the selected plan, price, billing period, provider identifiers, verified payment receipts and access expiry. It does not receive full card numbers. Blockchain transactions and wallet addresses may be publicly visible on their networks. Studio Team owners can assign a seat using an existing verified account email.

Optional managed data connections keep platform credentials on the server. Connection records use a derived account identifier to enforce capacity; browser streams use short-lived tickets. The chosen data service receives market-data requests. External-store release kits are generated from the project name and store identifiers you provide. Upload scripts run on your computer and send your build and credentials directly to the selected store when you run them. EoC does not collect store signing keys through the release-kit form.

The Create page keeps an unfinished idea in this browser session storage until the editor loads it. It is not sent to an AI provider until you submit a build request. Support email is used to respond to your request; do not include secrets.

Storage and your choices

The browser uses session cookies for sign-in and local storage for device-only projects and preferences. Device projects remain in that browser until you remove them, clear browser storage, or explicitly save a copy to a team. Download backups before clearing browser data.

Cloud projects and operational records are retained to provide the service and handle support, security, and billing requests. We do not promise a fixed automatic deletion interval for project artifacts, revisions, or build evidence. Deletion of active records may not immediately remove provider logs or backups. Contact support about a specific record or deletion request.

You can decline a build’s provider consent, avoid publishing, revoke GitHub/Vercel tokens at their providers, stop using the service, and request removal of hosted project data. We do not sell project content or use it for advertising. Do not submit sensitive personal information. The service is intended for adults.