Privacy Policy

1. Introduction

SpawnForge ("we," "us," or "our") respects your privacy and is committed to protecting the personal information you share with us. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web-based game creation platform ("the Service").

By using the Service, you consent to the data practices described in this policy. If you do not agree with this policy, please do not use the Service. This policy should be read alongside our Terms of Service.

2. Information We Collect

2.1 Account Information

When you create an account, we collect information provided through our authentication provider, Clerk. This may include:

• Email address
• Display name
• Profile image (if provided via your authentication method)
• Authentication identifiers

2.2 Payment and Billing Data

When you subscribe to a paid plan, payment information is collected and processed by Stripe, our payment processor. SpawnForge does not directly store your full credit card number, bank account number, or other sensitive payment credentials. We receive from Stripe:

• Subscription status and plan tier
• Billing history and invoice records
• Last four digits of your payment method (for display purposes)
• Billing address (if provided)

2.3 User Content and Project Data

We store the content you create on the platform, including:

• Game projects, scenes, and scene configurations
• Scripts, visual scripting graphs, and game logic
• Uploaded assets (images, audio files, 3D models)
• AI-generated assets created through the Service
• Published game data

2.4 Usage Data

We automatically collect certain information when you access or use the Service, including:

• Browser type, version, and rendering capabilities (WebGPU/WebGL2)
• Device type and operating system
• Pages visited within the Service and features used
• Time spent on the Service and session frequency
• AI feature usage and token consumption
• Error logs and performance metrics
• IP address

2.5 AI Interaction Data

When you use AI-powered features (chat-based editing, asset generation), we may collect:

• Prompts and instructions you provide to AI features
• AI-generated responses and outputs
• Token usage statistics

If you use the BYOK (Bring Your Own Keys) feature, your API keys are encrypted at rest using AES-256-GCM encryption. We do not log or inspect the content of requests made with your own API keys.

2.6 Communication Data

If you contact us for support, provide feedback, or participate in community features, we may collect the contents of those communications.

3. How We Use Your Information

We use the information we collect to:

• Provide, maintain, and improve the Service
• Process subscriptions, payments, and token credit transactions
• Authenticate your identity and manage your account
• Store and serve your game projects and published games
• Process AI requests and deliver generated assets
• Track AI token usage and enforce subscription tier limits
• Send administrative communications (account confirmations, billing notifications, security alerts)
• Analyze usage patterns to improve the Service and user experience
• Detect, prevent, and address technical issues and security threats
• Enforce our Terms of Service and acceptable use policies
• Comply with legal obligations

We do not sell your personal information to third parties. We do not use your User Content to train AI models.

4. Third-Party Services

SpawnForge integrates with third-party services that may collect and process your data according to their own privacy policies. These services include:

4.1 Clerk (Authentication)

We use Clerk for user authentication and session management. Clerk processes your login credentials and session tokens. For more information, see Clerk's Privacy Policy.

4.2 Stripe (Payments)

We use Stripe to process payments and manage subscriptions. Stripe collects and processes your payment information directly. SpawnForge does not have access to your full payment card details. For more information, see Stripe's Privacy Policy.

4.3 AI Service Providers (Asset Generation)

When you use AI asset generation features, your prompts and certain project context may be sent to third-party AI providers for processing. These providers include services for:

• 3D model and texture generation
• Sound effect and voice generation
• Music generation
• Natural language scene editing

Each AI provider has its own privacy practices and data retention policies. We send only the minimum information necessary to fulfill your generation requests. When using BYOK, requests are made directly with the provider under your own account and API terms.

4.4 Cloud Infrastructure

The Service is hosted on cloud infrastructure providers. Your data may be processed and stored on servers operated by our hosting providers, subject to their security practices and certifications.

5. Cookies and Tracking Technologies

The Service uses cookies and similar technologies for the following purposes:

5.1 Essential Cookies

These cookies are necessary for the Service to function and cannot be disabled. They include:

• Authentication session cookies (managed by Clerk)
• Security tokens (CSRF protection)
• User preference settings (editor layout, quality presets)

5.2 Functional Cookies

These cookies enable enhanced functionality, including:

• Remembering your editor preferences and workspace layout
• Storing local project data and cached WASM engine binaries
• Theme and display settings

5.3 Analytics

We may use analytics tools to understand how the Service is used. This data is collected in aggregate form and does not personally identify individual users. You may opt out of non-essential analytics through your browser settings.

6. Data Retention

We retain your information for as long as necessary to fulfill the purposes outlined in this policy:

• Account data: Retained for the duration of your account. Upon account deletion, personal data is removed within 30 days, except where retention is required by law.
• Project and content data: Retained for the duration of your account. Upon account deletion, you will have 30 days to export your content before it is permanently deleted.
• Payment records: Retained for a minimum of 7 years to comply with tax and financial regulations.
• Usage and analytics data: Retained in aggregate, anonymized form indefinitely for service improvement purposes. Identifiable usage logs are deleted within 90 days.
• AI interaction data:Prompts and AI responses associated with your account are retained for the duration of your account. AI provider data retention is governed by each provider's policies.
• Published games: Remain accessible at their published URLs until you unpublish them or your account is terminated.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

7.1 Right to Access

You have the right to request a copy of the personal data we hold about you. You can access most of your data directly through your account settings and dashboard.

7.2 Right to Correction

You have the right to request correction of inaccurate personal data. You can update your account information directly through the Service or by contacting us.

7.3 Right to Deletion

You have the right to request deletion of your personal data. You can delete your account through your account settings. Upon deletion, we will remove your personal data within 30 days, subject to our data retention obligations.

7.4 Right to Data Portability

You have the right to export your data in a machine-readable format. SpawnForge provides export functionality for your game projects (as .forge files) and game exports (as standalone HTML/JS bundles). You may request a full data export by contacting us.

7.5 Right to Object

You have the right to object to certain processing of your personal data, including processing for direct marketing purposes. You can manage your communication preferences through your account settings.

7.6 Exercising Your Rights

To exercise any of these rights, contact us at privacy@spawnforge.ai. We will respond to your request within 30 days. We may ask you to verify your identity before processing your request.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. These measures include:

• Encryption of data in transit using TLS/HTTPS
• Encryption of sensitive data at rest (including BYOK API keys using AES-256-GCM)
• Content Security Policy (CSP) headers to prevent cross-site scripting
• Sandboxed script execution environment for user-created game scripts
• Rate limiting and abuse prevention on API endpoints
• Regular security reviews of authentication and authorization flows
• Secure payment processing through PCI-DSS compliant Stripe integration

While we strive to use commercially acceptable means to protect your personal data, no method of transmission over the Internet or method of electronic storage is 100% secure. We cannot guarantee absolute security.

9. Children's Privacy

The Service is not directed to children under 13 years of age. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and you are aware that your child has provided us with personal information without your consent, please contact us at privacy@spawnforge.ai.

If we become aware that we have collected personal information from a child under 13 without verification of parental consent, we will take steps to remove that information from our servers within a reasonable timeframe.

Users between 13 and 18 years of age may use the Service with the consent of a parent or legal guardian who agrees to be bound by our Terms of Service and this Privacy Policy.

10. International Data Transfers

Your information may be transferred to and processed in countries other than the country in which you reside. These countries may have data protection laws that are different from the laws of your country.

When we transfer personal data outside of your jurisdiction, we ensure that appropriate safeguards are in place, such as Standard Contractual Clauses approved by relevant data protection authorities, or reliance on the recipient's participation in recognized data protection frameworks.

By using the Service, you consent to the transfer of your information to the United States and other jurisdictions where we and our service providers operate.

11. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Post a prominent notice on the Service
• Send an email notification to registered users when feasible

We encourage you to review this Privacy Policy periodically. Your continued use of the Service after changes are posted constitutes your acceptance of the revised policy.

12. Contact Information

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

• Privacy inquiries: privacy@spawnforge.ai
• General inquiries: legal@spawnforge.ai
• Website: https://spawnforge.ai

For data protection inquiries from the European Economic Area, you also have the right to lodge a complaint with your local data protection supervisory authority.