Privacy Policy

AI Game Dev (ai-game.dev) is a platform that bridges AI-powered coding assistants with game engines through the Model Context Protocol (MCP). This Privacy Policy explains what data we collect, why we collect it, who we share it with, and how we protect it.

1. Who We Are (Data Controller)

The data controller for the Service is Ivan Murzak (trading as Modalith), a sole proprietorship, located at 13205 97th Ave NE, Kirkland, WA 98034. For questions about this policy or to exercise your rights, contact us at privacy@ai-game.dev.

EU/EEA & UK GDPR Representatives (Article 27). If you are in the EU/EEA or the UK and have questions or concerns about your personal data, you may contact our appointed GDPR representative:

• EU Representative — Euverify Ltd (Ireland), Unit 3D North Point House, North Point Business Park, New Mallow Road, Cork, T23 AT2P, Ireland — Email: gdpr@euverify.com
• UK Representative — Euverify Ltd (UK), 3rd Floor, 86-90 Paul Street, London, EC2A 4NE, United Kingdom — Email: gdpr@euverify.com

This representative covers everyone whose personal data we process in the EU/EEA or the UK — including users of our free hosted service — and does not depend on whether paid plans are available in your country.

Submit a data-subject request. You can verify our representative and submit a data-subject request — access, rectification, erasure, restriction, portability, or objection — through our Euverify portal: gdpr.euverify.com/verify/f3d62d85-9dc6-472f-a512-9163bed30352. You can also contact us at privacy@ai-game.dev.

2. Information We Collect

2.1 Account Information

When you create an account, we collect your email address and a hashed version of your password. We never store passwords in plain text. You may optionally provide a display name and timezone. During registration you may also provide profile details (e.g. years of experience, roles, engines, and platforms) to help us tailor the product.

2.2 Waitlist Subscriptions

If you sign up for a game engine waitlist (e.g., Unreal Engine or Godot notifications), we collect your email address and the engine you subscribed to. This data is used solely to notify you when support for that engine becomes available. We process this on the basis of your consent, which you may withdraw at any time — by using the unsubscribe link in any such email or by contacting privacy@ai-game.dev. Withdrawing consent does not affect the lawfulness of any processing carried out before the withdrawal.

2.3 API Tokens

When you generate an API token to authenticate MCP connections, we store a SHA-256 hash of the token along with a user-assigned label, creation timestamp, and last-used timestamp. The raw token value is shown exactly once at creation and is never stored or retrievable afterward.

2.4 Billing and Subscription Information

From the effective date of this Policy, when you purchase a paid subscription or a prepaid-balance top-up, the purchase is sold and the payment taken by Paddle (the Paddle group company that acts as merchant of record for your country — Paddle.com Inc., 3811 Ditmars Blvd #1071, Astoria, New York, NY 11105-1803, USA, for buyers in the United States; Paddle.com (Canada) Ltd, 22 Adelaide Street West, Suite 3400, Toronto, Ontario, M5H 4E3, Canada, for buyers in Canada; and Paddle.com Market Limited, registered in England and Wales, company no. 08172165, 30 Old Bailey, London EC4M 7AU, United Kingdom, for buyers everywhere else. The company that sold to you is named on your Paddle receipt and invoice) acting as merchant of record (see our Terms of Service, Section 1.1). Paddle collects and processes the data needed to sell you the product and take payment — typically your name, email address, billing address and country, IP address, any business tax identifier you enter, and your payment-card or other payment details. Paddle's handling of that data is described in Paddle's privacy notice.

To operate your entitlement we store, on our side, a Paddle customer identifier, the Paddle transaction and subscription identifiers, your plan, billing period, subscription status, and renewal/cancellation timestamps. Where you were shown the pre-payment consent checkboxes required in the EU/UK, we also store an append-only consent record (the transaction identifier, which disclosure version you were shown, and the time) as evidence of that consent.

Card details are entered in the payment provider's hosted checkout and never touch our servers — we do not see, receive, or store full card numbers. We receive back only the limited information needed to operate the subscription (such as the last four digits of the card, card brand, payment status, and tax/invoice metadata).

Free trial. To run a trial we process your email address, trial start and end times, subscription status, and Paddle customer and subscription identifiers. Paddle holds your card details; we do not receive the card number or security code. To enforce one trial per person we keep only a keyed hash derived from the cardholder name, last four digits, expiry and card brand that Paddle returns, plus hashed email, sign-in identity, device and network signals (Art. 6(1)(f), preventing abuse and fraud). The card hash is a one-way code and cannot be used on its own to make a payment or charge your card. We send you a confirmation at sign-up and a reminder about 2 days before the first charge; these are service messages, not marketing (Art. 6(1)(b)). A person reviews any trial refusal on request. We record your checkout consents against your subscription, as for any purchase.

From 5 November 2026 we also build the same keyed card hash from the card used for subscription purchases made in the previous 24 months, and we compare it when a new trial starts. We use this hash only to enforce one trial per person, and we keep it for 24 months after the card was last used for a trial or subscription. You can object to this processing (Art. 21) at privacy@ai-game.dev. One-month trials that started before 5 November 2026 continue unchanged and are never charged; their card hashes are used for the same check.

Legacy subscriptions. Subscriptions bought before the effective date of this Policy were sold with us as merchant of record and payment processed by Stripe. They are not migrated: for as long as such a subscription remains active we continue to store its Stripe customer and subscription identifiers and Stripe continues to process the billing data described above for it.

2.5 Request Metadata

When MCP clients or the engine plugin connect through our server, we log operational metadata to maintain service quality:

• Client IP address
• Timestamp and request duration
• HTTP status code and request path
• Tool name and tool call count
• Request and response size (in bytes)
• Endpoint type (MCP or API) and client type (AI agent or plugin)

In addition, when you sign in we record the IP address and browser/device user-agent associated with that login session, so that you and we can identify and manage active sessions for security purposes.

2.6 MCP Events

We record MCP protocol-level events (tool calls, prompt retrievals, resource access, connection events) including the event type, timing, status, session identifiers, the tool, prompt, or resource referenced, and any error details. These events help us monitor system health and debug issues.

2.7 What We Do NOT Collect

We do not collect, store, or have access to:

• The content of conversations between you and your AI assistant
• Your source code, project files, or game assets
• Scene data, game design documents, or creative content
• Any data from your local project beyond the MCP tool calls you initiate, except that a crash or error report (Section 2.10) can name a file or folder or an MCP server you set up, quote a short piece of text involved in the error, or (for the command-line tool) list the packages declared in your project's package.json, without otherwise including any file's contents
• Your full payment-card number, which is handled entirely by the payment provider (Paddle, or Stripe for legacy subscriptions)

The MCP server acts as a stateless relay — it routes tool calls between your AI client and the editor without inspecting or persisting the payload contents. This describes the MCP relay. Image, video, audio and 3D generation is different: files you submit for generation, your request text, and the results are processed and stored as described in Section 2.13.

2.8 Proxied AI Usage (Paid Plans and the Free-Trial Allowance)

Apart from the free trial described at the end of this section, on the free tier the Service is an MCP relay only: you connect your own AI agent, and your AI prompts and completions go directly to the AI provider you chose — they do not pass through us, and we do not send them to any AI provider on your behalf.

On paid plans, our metered AI tools route your AI requests through third-party AI providers to generate completions. We offer large language models (LLMs) from OpenAI, Anthropic and Google (Gemini), and open-weight models developed by DeepSeek and by Z.ai (GLM), and you choose which model serves your request (web search is described below and does not follow that choice). For this purpose, the relevant request content — your prompt, including any code or other project context your AI agent adds to it, and the output generated for it — is processed by the provider that serves the request:

• Anthropic (Anthropic, PBC; United States) — processes paid AI requests routed to Anthropic's models. Anthropic's (Claude) models are served only by Anthropic, and we send these requests to Anthropic directly. Anthropic's commercial terms state that it may not train models on customer content submitted through its API.
• OpenAI (OpenAI OpCo, LLC; United States — and OpenAI Ireland Limited for data subjects in the EEA and Switzerland, see Section 5) — processes paid AI requests routed to OpenAI's models. We send the content of your request only: your prompt, and the model and generation settings for it. We do not send your account identifier, your email address or any other account data alongside it. (Image generation requests to OpenAI are the one exception: they also carry our internal identifier for your account, as described in Section 2.13.) OpenAI retains that content for up to 30 days for abuse and misuse monitoring and then deletes it, unless a longer period is required by law or is reasonably necessary to protect its service or a third party from harm. We have not agreed zero-data-retention terms with OpenAI, so that standard retention applies to your requests. OpenAI's (GPT) models are served only by OpenAI, and we send these requests to OpenAI directly. According to OpenAI's API terms, API data is not used for training by default.
• Google (Google LLC; United States) — processes paid AI requests routed to Google's Gemini models, through Google's Vertex AI service. Gemini models are served only by Google, and we send these requests to Google directly. We send the content of your request only: your prompt, including any code or other project context your AI agent adds to it, and the model and generation settings for it. We do not send your account identifier, your email address or any other account data alongside it, and we do not forward the two identifiers described in Section 2.9. We use Google's global endpoint, so Google may process the request in any region where it operates; we cannot choose or know the region. Google's Cloud terms state that it will not use customer data to train or fine-tune its models without the customer's permission or instruction, and we have given no such permission. Google's service caches the input of Gemini requests so that repeated context can be reused; Google's documentation states that cached data is deleted no later than 24 hours after it is written, and often sooner. Google may also log prompts to check for abuse; according to its documentation such logs are kept for up to 90 days, and authorized Google staff may review prompts its systems flag. We have not agreed zero-data-retention terms with Google.
• DeepInfra (Deep Infra Inc.; United States) — hosts open-weight models and can serve paid AI requests to the DeepSeek-family models, for accounts in every country where they are offered. DeepInfra is not DeepSeek: these requests are processed by DeepInfra in the United States and are not sent to DeepSeek or to any service operated by DeepSeek. DeepInfra's terms state that it does not use customer data to train any model and, apart from limited exceptions set out in those terms, does not retain the data submitted to or generated by its service.
• Sail Research (Sail Research Co.; United States) — can serve paid AI requests to the DeepSeek-family models and, once they are available again, the GLM models. Sail may process requests in several regions, so requests from accounts in the EU/EEA, the United Kingdom or Switzerland are never sent to Sail. Sail states that it processes prompts and outputs only in memory, without storing them, and its data processing addendum states that it does not use customer data to train, fine-tune or improve AI models.
• NEAR AI (Jasnah, Inc., doing business as NEAR AI; United States) — can serve paid AI requests to the GLM models only, once they are available again. NEAR AI's terms state that it does not use customer data to train any generative AI models.

Which provider serves your request. The GLM models are currently unavailable. Where a model can be served by more than one of the providers listed above for it, we may choose the provider automatically, for each request, based on availability, speed, price and quality, and may keep a conversation already under way with the same provider so that its cached context can be reused. If the chosen provider fails, we may send the request to another provider listed above for the same model (failover). We never switch your request to a different model. Not every listed provider is in use at all times, and we will update this Policy before we send requests to a provider that is not listed here. There is currently no setting to choose or exclude a provider.

Who can use Gemini. Google's Gemini models are available only on the Studio plan and above, and only to accounts whose holder has confirmed that they are at least 18 years old. They are not available during the free trial. Requests from accounts in the EU/EEA, the United Kingdom or Switzerland are never sent to Gemini, and neither are requests from accounts whose country we cannot determine. This is enforced server-side.

We do not send chat requests to DeepSeek's own service, or to any other provider based in China: a request to a DeepSeek-family model is served by one of the providers listed above for it, whatever your country. Requests from accounts in the EU/EEA, the United Kingdom or Switzerland are served only by a provider that processes them outside China, and never by Sail Research. Chat requests from accounts in the EU/EEA, the United Kingdom or Switzerland are never sent directly to DeepSeek, and are never processed in China. Which models are available to you can depend on your account country; this is enforced server-side.

Web search. When your AI agent uses its web-search tool, we run the search through a separate web-search service, regardless of the model you selected. What is sent is the search query — which your AI agent writes, usually based on your conversation, so it may contain information you typed or that was in your conversation — together with a short fixed instruction. Where the search is run depends on your account country (your billing country or, if we do not have one yet, the country indicated by your IP address):

• Accounts outside the EU/EEA, the United Kingdom and Switzerland — DeepSeek runs the search and summarises the results, on DeepSeek's own service in China. Together with the query and the fixed instruction, we send a session identifier and the persistent identifier of the AI agent component on your computer (both described in Section 2.9). We do not send your name, email address, account ID or IP address.
• Accounts in the EU/EEA, the United Kingdom and Switzerland — we send only the text of the search query (no user identifier, and not your IP address) to Brave Software, Inc. (United States), which returns the search results. The query and short extracts of those results are then summarised by a DeepSeek-family model hosted by Deep Infra Inc. (United States). These searches are never sent to DeepSeek or to any service operated by DeepSeek, and are never processed in China. If either service fails, the search fails; it is not sent anywhere else instead.
• Web search is not available where your account country cannot be determined or is restricted by sanctions law.

Please do not include confidential information in requests you expect to trigger a web search.

These AI providers and the web-search services apply only to proxied AI usage on paid plans and during the free trial. The free trial is the first seven days of an Indie subscription (Terms of Service Section 7.12). During it you have a limited, one-time AI usage allowance for a limited set of lower-cost models, currently DeepSeek-family and GLM models, plus a lower-cost Anthropic model that your AI agent may use for sub-tasks. We proxy those requests to the providers listed above in the same way as paid requests, and web searches follow the web-search routes described above. A one-month trial started before 5 November 2026 keeps its one-time allowance and is proxied the same way until it ends. The Gemini models, and image, video, audio and 3D generation, are not available during the trial, so nothing from a trial is sent to Google or to any image, video, audio or 3D provider (Section 2.13). We do not send other free-tier traffic to any AI provider.

2.9 Desktop App Installation Identifier

When you use the AI Game Dev desktop app, it generates a random 128-bit identifier the first time it runs and stores it locally on your device, in the app's local configuration file. We never receive this identifier in that raw form. Instead, each time the app connects, it sends a one-way cryptographic derivation of it — computed together with your account identifier, so the value we receive is different for every account — in a request header. Because of how it is derived, we cannot use it to recognize the same installation across two different accounts, and it does not let us build a profile of your device.

We use this identifier for one purpose: to recognize that a new connection comes from an installation we have seen before, so we can close out sessions left behind when the app crashes or is force-closed, instead of leaving them to expire on their own after several hours. We do not use it for analytics, advertising, attribution, A/B testing, or to track you across other websites or services, and we do not share it with any third party.

This identifier is designed to persist across app restarts and sign-outs, because that is what lets it do its job over time; it is unrelated to the cookies described in Section 10, and nothing like it is set by the ai-game.dev website. You can reset it at any time by deleting the app's local configuration file; resetting it does not affect your account, your projects, or any other locally stored preference.

The AI agent component's own identifier. Separately from the identifier above, the AI agent component the desktop app runs (Anthropic's Claude Agent SDK) keeps its own persistent identifier for your computer: a 64-character code it creates once and stores in its local configuration in your user folder (the same configuration Anthropic's Claude Code uses, if you also use Claude Code on that computer). It is not derived from your account, so it stays the same whichever account you sign in with on that computer. The component attaches it, together with an identifier of the current agent session, to the AI requests it sends through us. We forward these two identifiers unchanged with requests served by Anthropic or DeepInfra, and they are also forwarded to DeepSeek with web-search requests from accounts outside the EU/EEA, the United Kingdom and Switzerland (Section 2.8). We do not forward them with requests served by OpenAI or Google, with image, video, audio or 3D generation requests (Section 2.13), or with web searches from accounts in the EU/EEA, the United Kingdom and Switzerland.

2.10 Crash and Error Reports (Desktop App and CLI)

Production builds of the AI Game Dev desktop app and command-line tool send us a report automatically when they crash or hit an unexpected error, so that we can find and fix the problem. Crash and error reports are sent automatically by default, and you can turn them off at any time: in the desktop app with the "Send crash & error reports" setting (Settings → Privacy), which also applies to the command-line tool, or for any single run of either by setting the environment variable AI_GAME_DEV_NO_CRASH_REPORTS=1. (Desktop app versions before 0.10.0, and command-line tool releases before 17 September 2026, have no such setting, and those desktop versions could also attach the memory snapshot described in earlier versions of this Policy; updating removes both.) This is separate from the optional "Share anonymous usage data" setting in the desktop app: that setting governs anonymous product-usage analytics, which is off by default and only sent if you turn it on.

A report contains the error and its message, the stack trace (the places in the app's program code, and in the software libraries it uses, that led to the error, with a few surrounding lines of that code), the app version, the operating system and platform it was running on, basic technical details of your device (such as its processor, memory, graphics card and driver, screen resolution, language and time zone), and, if you are signed in, your account's internal identifier (never your email address), so that we can connect the report to your account. When a request to an AI agent fails, the report can also include the technical output the agent process printed just before it failed, the session ID and, when one is available, the request ID for that request (which lets us match the report to our own server records of that request), the AI model, the HTTP status code of the failure, the names of the MCP servers set up for the session and whether each one connected, and a short list of the steps the request reached (for example, that it started and connected to its MCP servers). When you run the command-line tool from a folder that contains a package.json file, its reports also list the package names and versions declared in that file. Before a report is sent, the app automatically removes the passwords, tokens and other secret-looking values, email addresses and home-folder name it detects, and it does not send your computer's name. Other than that package list, reports are not designed to include your prompts, your conversations with the AI assistant or the contents of your files, and they never include a snapshot of the app's memory or an automatic record of what you do in the app (such as its console output, network requests or clicks). An error message or the agent's output can, however, name a file or folder on your computer, such as your project's folder, or quote a short piece of the text involved in the error (see Section 2.7). Reports are not used for product-usage analytics or advertising.

The desktop app also tells our error-tracking service each time it closes: when it was started, how long it ran and whether it ended normally or after errors, together with your account's internal identifier if you are signed in. Turning crash and error reports off stops this too.

Reports go to our self-hosted error-tracking service (GlitchTip, a Sentry-compatible tool) on our own infrastructure and are not shared with third parties. We keep them for 90 days, after which they are deleted automatically. We process them on the basis of our legitimate interest in finding and fixing defects and running a reliable, secure service (Section 3). Turning reports off is the simplest way to object to this processing; you can also object, or ask us to delete reports already sent, at privacy@ai-game.dev.

2.11 AI Request Records

For each AI request we proxy (Section 2.8) we keep records about the request. They do not contain your prompts or the AI's output:

• Provider attempt records — the provider we sent the request to (and, if a request is retried with another provider, each attempt), the model requested and the model sent to the provider, when the request was sent, how long it took (to the first output and in total), the token counts (input, output, and prompt-cache reads and writes), the HTTP status, the type of any error, and the provider's request identifier. They are linked to your account.
• Usage records — for each request that consumed tokens, the model you asked for, the model and provider that served it, the token counts (input, output, and prompt-cache reads and writes), what the request cost and what was charged for it, a request identifier, and the type, version and platform of the app or tool that sent it. They are linked to your account.

We use these records to bill your usage, to measure each provider's availability, speed and error rate so that requests can be routed as described in Section 2.8, and to diagnose errors. How long we keep them is set out in Section 7.

2.12 Website Analytics and How You Found Us

Our website counts visits and a few actions on its pages with self-hosted analytics (Section 10): which pages were viewed, which download or sign-in button was used, when an installation command or code example is copied, and the steps of signing up and checking out. These counts use no cookies. The only browser storage involved is a marker kept for the current tab when you return from a card checkout, so that one purchase is not counted twice.

When you create an account we also record how you first reached us: the campaign parameters in the link you arrived on (utm_source, utm_medium, utm_campaign, utm_term, utm_content), the domain (not the full address) of the website that referred you, and the path of the first page you opened. Your browser keeps this only in memory until you sign up; nothing is stored on your device. It is stored with your account.

Our servers additionally record account events for analytics: that an account was created and how (email or a named sign-in provider), that an email address was verified, which kind of client signed in (our desktop app or CLI, an engine plugin, or another MCP client by its registered name) and whether it was the account's first, and that a purchase was confirmed with its plan, net amount and currency. These events identify the account only by a one-way pseudonymous code, never by name or email, and carry the traffic source above. We also count desktop app downloads served from our site by platform and version, without any account link.

2.13 Image, Video, Audio and 3D Generation (Paid Plans)

On paid plans you can ask the Service to generate or transform images, video, audio (speech, sound effects and music) and 3D models. This is not available on the free tier or during the free trial. What is sent. To run a request we send the provider that serves it the text of your prompt (and negative prompt, if any) or the text to be spoken, the generation settings (such as duration, resolution, aspect ratio, voice and seed) and any images or other files you chose to provide — for example first and last frames, reference images, an image to edit, or a 3D model to texture or convert. We do not send your email address, your IP address or the identifiers described in Section 2.9, and except for image requests to OpenAI (below) we do not send your account identifier; the provider sees a request from our servers carrying our own credentials, not one from your device.

Our copy. Files you upload for generation, and the results, are stored privately on our servers and linked to your account, and are deleted automatically after 7 days — except files you upload to Tripo and everything Tripo returns (3D models and images, below), which are not yet deleted automatically: we keep them until you ask us to delete them at privacy@ai-game.dev. A record that a file existed (its name, type, size, checksum and dates, but not its content) remains with your usage records. The text of your request is kept with the record of that request for no longer than the billing records of the usage (Section 7); the text of a price quote you did not go ahead with is not yet deleted automatically. Results are not shared with anyone else.

Providers. We may choose the provider for each request, and if the chosen provider rejects it we may send it to another provider listed here for the same model:

• fal (fal – Features & Labels, Inc.; United States) — the main route for most video models and for audio generation. fal processes data in the United States and other countries. Its documentation states that it keeps request inputs and outputs in its request history for up to 90 days by default, and that media files stay on its servers for a period set per request or per account, for which it publishes no fixed default. Its terms allow it to use anonymized or aggregated data derived from customer input to develop its products and AI models; they do not say whether it trains models on the content itself. We have not agreed no-training or zero-retention terms with fal.
• Runway (Runway AI, Inc.; United States) — serves some video models and is the failover route for others. Runway's terms state that inputs and outputs may be used by Runway to train and improve its AI models, and we have not agreed different terms with Runway. Runway's result links are temporary, and it publishes no retention period for inputs that we could find. Requests from accounts in the EU/EEA, the United Kingdom or Switzerland are never sent to Runway, and neither are requests from accounts whose country we cannot determine.
• Google (Google LLC; United States) — the failover route for Veo video models, through Vertex AI, and only for accounts whose holder has confirmed they are at least 18. Unlike Gemini, Veo requests are sent to Google's us-central1 location in the United States rather than its global endpoint. The description of Google's no-training terms and abuse-monitoring logs in Section 2.8 applies. Google publishes no separate retention period for Veo that we could find.
• OpenAI (Section 2.8) — serves image generation and editing with OpenAI's image models. With these requests we also send our internal identifier for your account (a random code, not your name or email address), which OpenAI uses to detect misuse of its service. OpenAI's terms and retention described in Section 2.8 apply.
• Tripo (tripo3d.ai) — serves 3D generation and the image generation and editing steps it offers for 3D work. Tripo's website terms name Holymolly Limited as the operator of its service, and its technology is developed by VAST, a company based in China. Tripo's published materials do not let us confirm which entity contracts with API customers, where API data is processed (including whether that is China), or how long it is kept. Its terms treat free and paid users differently on the use of content to improve its models, and we have not agreed separate terms with Tripo. Requests from accounts in the EU/EEA, the United Kingdom or Switzerland are never sent to Tripo, and neither are requests from accounts whose country we cannot determine.

Model developers. Many video models are developed by other companies (for example ByteDance, Kuaishou, Alibaba, MiniMax, Tencent, Lightricks and Google). The developer is not necessarily the company that processes your request, but fal and Runway offer some models through partners, and neither tells us, model by model, where partner-operated models run. For some models your request may therefore be processed by the model's developer, including in China. Requests from accounts in the EU/EEA, the United Kingdom or Switzerland are sent only to models that are not operated by a company based in China.

Your files. Do not upload images of identifiable people unless you are entitled to and they have agreed, and do not upload anything you cannot share with these providers.

3. How We Use Your Information, and Our Legal Basis

Where data-protection law (such as the EU/UK GDPR) applies, we rely on the following legal bases for each purpose:

• Provide the Service and process payments (account creation, authentication, running subscriptions, charging and renewing paid plans) — performance of a contract with you.
• Operate and secure the platform (monitoring uptime, diagnosing errors — including the crash and error reports described in Section 2.10 — enforcing rate limits and usage allowances, detecting abuse, preventing fraud, recognizing and cleaning up stale connections left behind by a crashed or force-closed app instance, and measuring AI provider reliability to choose which provider serves a request, using the records described in Section 2.11) — our legitimate interests in running a reliable, secure service.
• Comply with legal obligations (tax, accounting, and invoicing requirements for paid transactions) — compliance with a legal obligation.
• Send service communications (email verification, password resets, billing notices, critical service notifications) — performance of a contract and/or legitimate interests.
• Optional notifications you request (e.g. engine waitlists) — your consent, which you may withdraw at any time.
• Understand how the website is used and which channels bring users (the analytics and sign-up source described in Section 2.12) — our legitimate interests in improving our website and measuring our marketing. You may object at any time (Section 9).

4. How We Share Your Information (Sub-processors)

We do not sell or rent your personal data, and we do not share it for third-party marketing. We share data only with the service providers (sub-processors) needed to operate the Service, and where required by law:

• Paddle (payment provider and merchant of record; Paddle.com Inc., Paddle.com (Canada) Ltd or Paddle.com Market Limited, depending on your country — see Section 2.4) — from the effective date of this Policy, Paddle sells the purchase, takes payment, prevents fraud, calculates, collects and remits taxes, and issues invoices, receipts and refunds. Paddle acts as our processor for the billing and subscription-management data it handles on our instructions, and as an independent controller for its own merchant-of-record processing — tax determination, invoicing, and fraud, anti-money-laundering and chargeback decisioning. Paddle receives the billing data described in Section 2.4 and is governed by its own privacy notice and data processing addendum.
• Stripe (payment processor; United States) — legacy rail only. Stripe is retained solely to keep subscriptions bought before the effective date of this Policy running; no new purchase is sent to Stripe. For those legacy subscriptions we were the merchant of record, and Stripe acts as our processor for subscription management and as an independent controller for its own fraud-prevention and anti-money-laundering purposes. Stripe receives the billing data described in Section 2.4 for those subscriptions only, and this row falls away once the last legacy subscription ends.
• AI providers — Anthropic (US), OpenAI (US and Ireland), Google (US) and, for the open-weight models, DeepInfra, Sail Research and NEAR AI (all US) — process proxied AI requests on paid plans and the free trial only (see Section 2.8). Other free-tier traffic is never sent to them. Requests to the DeepSeek-family and other open-weight models are processed by one of the open-weight model providers listed below, chosen for each request as described in Section 2.8. Chat requests from EU/EEA, UK or Swiss accounts are never sent directly to DeepSeek. OpenAI processes requests routed to its models for accounts in any country where those models are offered — including the EU/EEA, the United Kingdom and Switzerland. The entity we contract with is OpenAI OpCo, LLC (United States); for data subjects in the EEA and Switzerland, OpenAI's data processing addendum makes OpenAI Ireland Limited the OpenAI entity that processes the request. Section 5 sets out, by region, where each request is processed and under which transfer safeguard.
• Deep Infra Inc. (DeepInfra; AI model hosting; United States) — hosts open-weight models and can serve paid AI chat requests to the DeepSeek-family models, from every country where they are offered, and summarises web searches from EU/EEA, UK and Swiss accounts (it receives the search query and the result extracts returned by Brave). DeepInfra is not DeepSeek and does not send this data to DeepSeek.
• Sail Research Co. (AI model hosting; United States) — can serve paid AI chat requests to the DeepSeek-family models and, once they are available again, the GLM models, for accounts outside the EU/EEA, the United Kingdom and Switzerland only.
• Jasnah, Inc. (NEAR AI; AI model hosting; United States) — can serve paid AI chat requests to the GLM models only, once they are available again.
• Google LLC (Gemini chat models, and Veo video as a failover; United States) — Gemini for paid accounts on the Studio plan and above that have confirmed they are 18 or older, never for EU/EEA, UK or Swiss accounts or accounts whose country we cannot determine (Section 2.8). Veo only for accounts that have confirmed they are 18 or older (Section 2.13).
• fal – Features & Labels, Inc. (video and audio generation; United States) — receives prompts, settings and files you provide for video and audio generation (Section 2.13).
• Runway AI, Inc. (video generation; United States) — receives the same, for accounts outside the EU/EEA, the United Kingdom and Switzerland whose country we can determine. Its terms permit it to use inputs and outputs for training.
• Tripo (3D generation) — receives prompts, settings and files you provide for 3D generation, for accounts outside the EU/EEA, the United Kingdom and Switzerland whose country we can determine (Section 2.13).
• DeepSeek (web search; China) — web search only, for accounts outside the EU/EEA, the United Kingdom and Switzerland (Section 2.8). It receives the search query, a short fixed instruction, a session identifier and the AI agent component's installation identifier (Section 2.9), and runs and summarises the search on its own service, so this data is processed in China. This applies whichever model you selected. DeepSeek is never used for web searches from EU/EEA, UK or Swiss accounts.
• Brave Software, Inc. (web search; United States) — web search for EU/EEA, UK and Swiss accounts only. It receives only the text of the search query, with no user identifier and not your IP address, and returns search results with short extracts.
• Server hosting / infrastructure provider — hosts the application, database, and supporting services strictly as needed to run the platform.
• Email delivery — handled by our self-hosted mail service on our own infrastructure; transactional email is not shared with a third-party email-marketing provider.
• Analytics (Umami) — self-hosted on our own infrastructure (Sections 2.12 and 10); not shared with third parties.
• Crash and error reporting (GlitchTip) — self-hosted on our own infrastructure (Section 2.10); not shared with third parties.
• Legal and safety — when required by law or valid legal process, or to protect the security, rights, and integrity of the service and its users.

5. International Data Transfers

Our infrastructure, our payment providers, and our AI providers may process your data in the United States, the United Kingdom, the European Union and other countries outside your own. Where we transfer personal data of EU/UK individuals to a country that has not been recognized as providing an adequate level of protection, we rely on appropriate safeguards — principally the European Commission's Standard Contractual Clauses (SCCs) and, for UK transfers, the UK International Data Transfer Addendum.

• Paddle (merchant of record, from the effective date of this Policy) — Paddle's data processing addendum provides that personal data transferred out of the EEA or the UK is processed either in a jurisdiction recognized as adequate or under the EU SCCs (Module Two: controller to processor), with the UK International Data Transfer Addendum covering the UK leg. We do not rely on the EU–US Data Privacy Framework for this transfer.
• Stripe (legacy subscriptions only) — transfers rely on the EU SCCs and the UK International Data Transfer Addendum incorporated in Stripe's data processing agreement, for as long as any legacy subscription remains active.
• Anthropic (United States) — transfers rely on the SCCs in its data protection terms.
• OpenAI — EU/EEA and Switzerland. For data subjects in the EEA and Switzerland, OpenAI's data processing addendum provides that OpenAI Ireland Limited processes that personal data, whichever OpenAI entity we contract with. Any onward transfer of it to the United States is made by OpenAI under OpenAI's own Standard Contractual Clauses in that addendum — not under ours; we are not the exporter of that onward transfer.
• OpenAI — United Kingdom. Your request is processed by OpenAI OpCo, LLC in the United States. That transfer relies on the EU SCCs (Module Two: controller to processor) in OpenAI's data processing addendum, with the UK International Data Transfer Addendum covering the UK leg.
• OpenAI — everywhere else. Your request is processed by OpenAI OpCo, LLC in the United States, the entity we contract with. The EU/EEA, Swiss and UK transfer safeguards described above are not engaged for those requests.
• OpenAI — all regions. OpenAI's models are not withheld from EU/EEA, UK or Swiss accounts based on account country, so when we route a request from such an account to one of those models, it does reach OpenAI. We do not rely on the EU–US Data Privacy Framework for any transfer to OpenAI.
• Deep Infra Inc. (United States) — requests from any account to the open-weight models it hosts, and the summary step of web searches from EU/EEA, UK and Swiss accounts, are processed by DeepInfra in the United States.
• Sail Research Co. (United States) — may process the requests it serves in several regions. Requests from EU/EEA, UK and Swiss accounts are never sent to Sail, so their data is not transferred to it.
• Jasnah, Inc. (NEAR AI; United States) — transfers rely on the EU SCCs (Module Two: controller to processor) and, for UK transfers, the UK standard contractual clauses in NEAR AI's data processing agreement.
• We do not rely on the EU–US Data Privacy Framework for transfers to DeepInfra, Sail Research or NEAR AI.
• Brave Software, Inc. (United States) — for web searches from EU/EEA, UK and Swiss accounts, only the text of the search query is transferred to Brave in the United States; no user identifier, and not your IP address, is sent with it.
• Google LLC (United States) — Gemini requests are never sent from EU/EEA, UK or Swiss accounts, so their data is not transferred to Google for Gemini. Veo video requests, which can come from any account whose holder has confirmed they are at least 18, are sent to Google's us-central1 location in the United States. For EU/EEA, UK and Swiss data subjects the transfer relies on the EU SCCs (controller to processor) incorporated in Google's Cloud Data Processing Addendum, which also addresses UK and Swiss data-protection law. We do not rely on the EU–US Data Privacy Framework for this transfer.
• fal – Features & Labels, Inc. (United States) — fal's data processing addendum, which forms part of its online terms, applies the EU SCCs (Module Two: controller to processor), the Swiss-modified SCCs and the UK International Data Transfer Addendum. fal commits to notify us before adding sub-processors, and it is responsible under that addendum for its onward transfers. We do not rely on the EU–US Data Privacy Framework for this transfer.
• Runway AI, Inc. and Tripo — requests from EU/EEA, UK and Swiss accounts are never sent to them, so no data of those data subjects is transferred to them.

DeepSeek (China). One use of the Service reaches DeepSeek's own service in China: web searches from accounts outside the EU/EEA, the United Kingdom and Switzerland, whichever model you selected (Section 2.8). That data — the search query, a short fixed instruction and the two identifiers described in Section 2.9 — is processed in China. Chat requests to DeepSeek-family models are served by the providers listed in Section 2.8, none of which is DeepSeek or based in China. If you do not want your data processed in China, do not use web search; there is currently no setting in the Service that turns it off. No chat or web-search request from an EU/EEA, UK or Swiss account is sent to DeepSeek or processed in China, on any route. This paragraph concerns chat and web search; image, video, audio and 3D generation is covered by Section 2.13 and the entries above.

6. Data Storage and Security

Your data is stored in a PostgreSQL database on our server infrastructure. We use industry-standard security practices:

• All connections are encrypted with TLS (HTTPS) via automatically renewed certificates
• Passwords are stored as bcrypt hashes and API tokens are stored as SHA-256 hashes — never in plain text
• Payment-card data is handled by the payment provider (Paddle, or Stripe for legacy subscriptions) and never stored on our servers
• JWT-based session tokens have configurable expiry (15-minute access tokens and 7-day refresh tokens, or 30-day refresh tokens if you choose “remember me”)
• Redis-backed rate limiting protects against brute-force attacks
• Admin endpoints require a separate API key

7. Data Retention

• Account and profile data is retained for as long as your account is active. You can request account deletion at any time, after which we delete or anonymize your account data within a reasonable period, subject to the billing/tax and free-trial exceptions below.
• Billing, invoice, and tax records are retained for at least 7 years (and longer where required — for example, approximately 10 years for EU VAT purposes) after the transaction to comply with tax, accounting, and audit obligations, even after account deletion.
• Checkout consent records (Section 2.4) — the evidence that you were shown and accepted the pre-payment disclosures required in the EU/UK — are retained for six years, running from the end of the subscription period that the payment covered (for a prepaid-balance top-up, from the date of the transaction), because they exist precisely to be produced if a charge is disputed long after it was made. This period is separate from, and shorter than, the tax-record period above. Deleting your account does not destroy this evidence; instead the record is de-identified so that it no longer points at your account.
• Free-trial card hashes (Section 2.4) are retained for 24 months after the card was last used for a trial or subscription. Deleting your account does not delete these card hashes: we keep them until the 24 months end and then delete them. You can still object (Art. 21) at privacy@ai-game.dev.
• Other hashed free-trial signals (Section 2.4) are kept after account deletion for as long as we offer the trial, only to enforce one trial per person.
• Operational request logs and MCP events are used primarily within a rolling 90-day window for analytics, monitoring, and reporting in our dashboards. We retain these operational records until they are no longer needed and are purged, and we work to minimize how long identifiable log data is kept. We do not currently guarantee automatic deletion at a fixed age.
• AI provider attempt records (Section 2.11) are deleted automatically 60 days after the request. If you delete your account before then, they are kept until that date without the link to your account.
• AI usage records (Section 2.11) determine what you were charged, so they are kept for the same period as the billing records above.
• Uploaded files and results of image, video, audio and 3D generation (Section 2.13) are deleted automatically 7 days after they are created, except files uploaded to or returned by Tripo, which are not yet deleted automatically and are kept until you ask us to delete them. A record that a file existed, without its content, is kept with your usage records. The text of a generation request is kept for no longer than those records; the text of a price quote you did not go ahead with is not yet deleted automatically.
• How you first reached us (Section 2.12) is kept with your account and deleted when the account is deleted. Website analytics events (Section 2.12) are kept for reporting until they are no longer needed; we do not currently guarantee automatic deletion at a fixed age.
• Crash and error reports (Section 2.10) are kept for 90 days and then deleted automatically.
• Aggregated admin statistics are stored for approximately 42 days in 30-minute intervals, then aged out.
• Verification and reset tokens expire automatically (48 hours for email verification, 1 hour for password resets).

8. Open Source Transparency

Much of the AI Game Dev ecosystem is open source, and you can read that code yourself. The components that run on your own machine — the per-engine editor plugins, the engine-agnostic MCP server they share, and the .NET MCP framework beneath them — are public repositories. Because those are the components that decide what leaves your computer, you can inspect them to see what the client sends to us, and when:

• Unity-MCP — Unity Editor plugin
• Godot-MCP — Godot Editor plugin
• Unreal-MCP — Unreal Engine plugin
• GameDev-MCP-Server — the engine-agnostic MCP server shared by the plugins above; it runs locally on your own machine
• MCP-Plugin-dotnet — the underlying .NET MCP framework

What is not open source. The hosted service at ai-game.dev — this website and the cloud server that receives your requests, holds your account, and proxies paid AI requests — is proprietary, and its source code is not published. You cannot verify our server-side handling by reading its code. What we do with your data on the server is described in this Policy, and the rights in Section 9 — including access, correction and erasure — are how you can check and control it in practice.

9. Your Rights

Depending on where you live, you may have the right to:

• Access the personal data we hold about you
• Correct inaccurate information in your account
• Request deletion of your account and associated data (subject to Section 7)
• Object to or restrict certain processing, and withdraw consent where we rely on it
• Receive a copy of your data in a portable format. You can export your usage data directly from your dashboard; for a copy of other personal data we hold, contact us and we will handle the request manually
• Revoke any API tokens at any time through your dashboard
• Lodge a complaint with your local data-protection authority

To exercise any of these rights, EU/EEA and UK data subjects can use our Euverify data-subject request portal; you can also email us at privacy@ai-game.dev. Exercising these rights is free of charge. We will respond to your request within one month. Where a request is particularly complex or you have made a number of requests, we may extend this period by up to a further two months, and we will tell you within the first month if we need to do so and why.

10. Cookies and Tracking

We use JSON-based authentication tokens — not cookies — for session management. When you sign in, the Service returns short-lived access and refresh tokens in the login response, and your browser or client stores them and sends them back on each request to keep you signed in. We do not use advertising cookies, tracking pixels, or third-party analytics that track you across websites.

We use Umami, a privacy-focused, open-source analytics tool, to collect usage statistics (page views, referrers, browser type, and the website actions and account events described in Section 2.12). Umami is self-hosted on our own infrastructure — no data is shared with third parties. It does not use cookies (Section 2.12 describes the one per-tab marker) and does not track individual users across websites.

The Paddle checkout — which opens over our pricing and account pages for new purchases — may set cookies or equivalent storage necessary for payment security and fraud prevention; these are set by Paddle and governed by Paddle's own privacy notice. The Stripe-hosted checkout and customer portal may likewise set such cookies where they are still reached for a legacy subscription; those are governed by Stripe's own privacy policy.

11. Children's Privacy

The free Service is not directed at children under 13, and paid subscriptions require the subscribing account holder to be at least 18, or a parent or legal guardian acting on behalf of a user who is at least 13. We do not knowingly collect personal information from children. Google's Gemini models, and video generation served by Google, are available only to accounts whose holder has confirmed that they are at least 18; an account subscribed by a parent or guardian for a user aged 13 to 17 does not have access to them. If you believe a child has provided us with personal data, please contact us and we will promptly delete it.

12. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated version number and effective date, consistent with our Terms of Service.

For material changes that affect a paid subscription or that are required by mandatory consumer or data-protection law, we will give you advance notice by email before the change takes effect and a reasonable opportunity to terminate your subscription if you do not accept the change. For non-material changes, continued use of the service after the changes take effect constitutes acceptance of the updated policy. Your mandatory statutory rights as a consumer and data subject are unaffected.