Privacy Policy

This Privacy Policy explains how OddShed collects, uses, stores, and shares information when you visit the public website, create an account, build or publish games, purchase credits or a subscription, apply for the partner program, or contact us.

OddShed is the data controller for personal information processed under this policy. If you have privacy questions, you can reach us at support@oddshed.com.

We collect information in the following categories:

• Account information: email address, username, profile details, authentication records (you sign in with Google or with an email and password), plan tier, credit balance, account preferences, and email verification status. If you connect GitHub to export projects, we also store an encrypted GitHub access token until you disconnect it.
• Project and game content: prompts, AI chat history, project metadata, generated source files, uploaded or AI-generated assets, audio, thumbnails, project visibility and publish status, moderation status, and project settings.
• Usage and diagnostic data: agent action events, tool call logs, AI model usage, token and credit accounting, preview errors, browser and device metadata, session identifiers, IP addresses, security events, and support logs.
• Evaluation and benchmark review data: prompts, generated files, agent trace summaries, model routing details, validation results, runtime/playtest results, cost and latency data, and feedback used to evaluate and improve the quality, reliability, and efficiency of the Service.
• Billing information: subscription status, plan tier, credit transaction history, Polar order and invoice references, and refund records. Polar is our Merchant of Record and authorized reseller, and it handles checkout, payment processing (through its own payment provider), billing, invoicing, tax, and refund disbursement on our behalf. Your payment card details are collected and stored by Polar and its payment provider, not on our servers.
• Partner and referral information: name, email, channel or platform URL, audience description, referral codes used or generated, attribution data, application review status, and referral credit records.
• Communications: messages, support requests, feedback, and email preference settings, including whether you opted in to marketing emails.
• Technical identifiers: cookies, browser local storage values, session tokens, referral or partner attribution codes captured at landing, UTM campaign parameters, user agent strings, and hashed IP values used for abuse and rate-limit protection. If you arrive through a tagged link or from another website, we keep the campaign tags in that link (utm_source, utm_medium, and utm_campaign) and the name of the website you came from, for example reddit.com, in your browser for up to 30 days. When you create an account, we save those tags once with it so we can tell which channels bring people to OddShed. We do not store the full address, the pages you visited, or anything else about how you found us.

We use the information we collect to:

• provide, operate, and maintain the game builder, project storage, and publishing features;
• process and fulfill AI generation, asset creation, playtesting, export, and validation requests;
• manage accounts, credit balances, subscription plans, billing events, and refunds;
• send product emails about your account (receipts, account actions, build results), which are always sent, and marketing emails, which we send only to people who opted in;
• attribute referrals, manage partner relationships, and pay referral credits;
• detect and prevent fraud, abuse, spam, security attacks, and policy violations;
• measure and improve generation quality, user experience, reliability, and documentation;
• run private internal evaluations and benchmarks of prompts, agents, tools, models, and runtime behavior;
• comply with legal, tax, regulatory, audit-trail, and security obligations.

Where applicable law requires a legal basis for processing personal data, we rely on:

• Contract performance: processing needed to provide the Service you signed up for, including running AI generations, storing projects, and managing billing.
• Legitimate interests: fraud prevention, security monitoring, product improvement, and analytics, balanced against your privacy interests.
• Legal obligation: compliance with applicable laws, tax requirements, and court or regulatory orders.
• Consent: marketing emails and optional analytics features, where we ask for your permission. You may withdraw consent at any time.

When you build or modify a game, your prompts, project files, prior chat context, and relevant logs are sent to AI and infrastructure providers so we can generate, debug, preview, and validate your project. The AI agent that plans, writes, and debugs your game runs on open-weight AI models that OpenRouter routes to model hosts, and so do the models that translate, classify, and review screenshots of your project. Image generation and web search use specialist providers instead: OpenAI GPT Image 2 for images, PixelLab for pixel art and sprites, and Firecrawl or Parallel (through OpenRouter's web search feature) for web search. They receive the request content that feature needs, such as a description of the image to make, a source image you supplied, or a search query, and they process it under their own published terms and privacy policies. Sound effects and music come from our own library, so no audio provider receives your requests. The specific providers and models may change over time.

Do not include passwords, API keys, private credentials, sensitive personal information, or third-party content you do not have the right to use in your prompts or project files. AI output can be imperfect, non-unique, or legally ambiguous; you are responsible for reviewing any game before publishing or commercializing it.

We may review AI interactions, generated project files, agent traces, validation results, runtime/playtest evidence, cost, latency, and feedback by default to improve the Service and run private internal evaluations. Raw private projects and tester traces are not published as benchmark examples; any public benchmark, case study, or report must use aggregate, redacted, anonymized, or separately approved material.

Requests to the models that OpenRouter routes for us, including the agent's models, go only to endpoints with zero data retention and only to model hosts that do not collect user data. Those hosts do not keep your prompts, conversations, or project files and do not use them to train any model. They still process the request content needed to answer it and may retain limited security, billing, abuse-prevention, or operational metadata under their terms. Provider routing, retention, and data-use controls are separate from OddShed's internal product review.

Image generation and web search providers (OpenAI, PixelLab, Firecrawl, and Parallel) are not covered by the zero data retention commitment above. That includes searches that run through OpenRouter: its zero data retention setting covers the model that carries the search, not the search engine. Depending on their published terms, they may keep request data, for example for abuse monitoring, debugging, or quality work, and some may use it to improve their own services. Your account, projects, and usage records are stored in our own database as described in this Privacy Policy.

Voice input is optional. On some browsers, paid accounts send a voice clip to a speech-to-text model on a zero data retention route (Voxtral through OpenRouter). We keep only the text. On other browsers, voice input uses the browser's own speech recognition under the browser's terms.

To help prevent abuse, the requests we send to OpenRouter and OpenAI include a coded identifier for your account. It is a one-way hash, not your email address or name, and it lets a provider spot misuse by a single account without learning who you are.

We may share information with:

• Service providers: Lovable (website hosting, sign-in, and sending account emails), Supabase (database and file storage), Polar (payments, as Merchant of Record), MailerLite (newsletters), Cloudflare (network delivery and cookie-free website analytics), OpenRouter and the open-weight model providers it routes to with zero data retention (the agent's models and voice transcription), OpenAI (GPT Image 2 image generation), PixelLab (pixel art and sprites), Firecrawl and Parallel through OpenRouter (web search), and Hetzner (build servers and multiplayer rooms in Germany). The specific providers and models may change over time. These providers receive request data needed to perform their services, and their handling of that data is governed by applicable agreements, data-use controls, and terms.
• Other users and the public: when you intentionally publish a game or share a public link, your game content and publisher handle become visible to others.
• Legal and safety purposes: to comply with law, respond to valid legal process, enforce our terms, protect the rights and safety of users or third parties, or detect and prevent fraud or security incidents.
• Business transfers: if OddShed is involved in a merger, acquisition, financing, reorganization, or sale of assets, your information may be transferred as part of that transaction, subject to confidentiality obligations.

We do not sell personal information to third parties for their own marketing purposes.

We use cookies, browser local storage, and similar technologies for the following purposes:

• Strictly necessary: authentication session tokens, CSRF protection, and security identifiers required for the Service to function. These cannot be disabled without breaking the Service.
• Functional: saved preferences, language settings, game state, editor configuration, and local score data that improve your experience.
• Attribution: partner or referral codes stored locally so that launch-update requests and sign-ups can be correctly attributed.
• Analytics: aggregated product usage data to understand how features are used and how to improve them.

Your browser can block or clear cookies and local storage, but core features including login will not work without strictly necessary storage. We currently do not respond differently to browser Do Not Track (DNT) signals, as there is no common standard for how to interpret them.

Projects are private by default unless you choose to publish or share them. A published game may expose its title, description, thumbnail, public gameplay, generated runtime files, publisher handle, and related metadata to anyone with the link or who finds it through the OddShed library. You can unpublish a game from your workspace, but copies already exported, cached, screenshotted, indexed by search engines, or shared outside the Service may remain outside our control.

We retain information for as long as needed to provide the Service, maintain security, resolve disputes, comply with legal and tax obligations, enforce our terms, and improve the product. Specifically:

• Account and project data are retained while your account is active.
• Billing and transaction records are retained for the period required by applicable tax and accounting law, typically 7 years.
• Administrative security and audit records may be retained for up to 2 years.
• Raw client error reports are automatically deleted after 30 days.
• Raw private agent evaluation traces are automatically deleted after 90 days. A separately reviewed, redacted, and anonymized benchmark case may be retained after its source trace is deleted.
• Runtime playtest evidence and its private screenshots are automatically deleted after 90 days.
• Build feedback is retained for up to 365 days, or for 180 days after it is resolved or closed, whichever cleanup rule applies first.
• If you delete your account in Settings, under Danger Zone, we delete your account, projects, published games, and files within 30 days, and you can cancel the request until then. Deletion also removes you from our mailing list. Tax and billing records we must keep are anonymized and kept.

Depending on where you live, you may have rights to access, correct, export, or delete your personal information; restrict or object to certain processing; withdraw consent where processing is based on consent; and opt out of marketing messages at any time by clicking the unsubscribe link in any email or contacting us directly.

California residents may have additional rights under the California Consumer Privacy Act (CCPA/CPRA), including the right to know what personal information we collect and share, the right to delete, the right to correct, the right to opt out of sale or sharing (we do not sell personal information), the right to limit use of sensitive personal information, and the right to non-discrimination for exercising these rights.

EEA and UK residents may have rights under the GDPR or UK GDPR, including the right to lodge a complaint with a supervisory authority if you believe your data is being processed unlawfully.

To exercise any privacy right, contact us at support@oddshed.com. We will respond within the timeframe required by applicable law.

You must be 18 or older to create an account on OddShed, and we do not knowingly collect personal information from anyone under 18. Published games can be played without an account. If you believe someone under 18 has an account or has given us personal information, contact us at support@oddshed.com and we will delete it.

We implement reasonable technical, administrative, and organizational safeguards to protect personal information from unauthorized access, disclosure, alteration, or destruction. These include encryption in transit and at rest, access controls, and security monitoring. However, no online service can guarantee absolute security. You should use a strong, unique password, enable any available account security features, and avoid including secrets or credentials in prompts or project files.

We process and store information in the European Union (Germany) and the United States, where we and our service providers operate. These countries may have privacy laws that differ from those in your country. Where required, we implement appropriate safeguards for cross-border data transfers, such as Standard Contractual Clauses approved by the European Commission, to ensure your information receives adequate protection.

We may update this Privacy Policy as the product, our providers, applicable laws, or our operations change. The date at the top shows when the policy was last updated. We will provide notice of material changes (for example by email or in-app notification) where required by law. Your continued use of the Service after the effective date constitutes acceptance of the updated policy.

You can delete your account yourself in Settings, under Danger Zone. For other privacy requests, data subject rights, email removal, or general privacy questions, contact us at support@oddshed.com.