This page covers what EURUS collects about you, why, who else sees it, how long it sticks around, and what you can do about it.
What we collect
You give us:
- Account info - email, password (hashed), chosen username, and the character you customize.
- Game prompts - the text you type to build a game, plus any remix modifiers you add.
- Game results - scores, achievements, daily challenge completions.
- VS and safety information - matchmaking status, opponent usernames, match scores, and reports. If you enable VS voice chat, the browser processes microphone audio for the live peer call. Voice starts off, requires explicit permission, and EURUS does not record the call.
- Optional purchase info - credit pack interest. When real billing launches: your payment processor (Stripe) will collect card details directly; we never see them.
The system automatically collects:
- Basic technical data - IP, browser/OS, timestamps - captured by our infrastructure (Vercel, Supabase) for security and abuse prevention.
- Moderation events - when a prompt is blocked, we log the prompt text + reason so we can improve the safety filters.
- Generated assets - the AI-generated images for your characters, obstacles, backgrounds. Stored alongside your game so it’s playable on demand.
How we use it
- To create the games you asked for.
- To award sparks, streaks, achievements, and rank you on global + per-game leaderboards.
- To prevent abuse - filtering disallowed prompts, rate-limiting obvious script behavior, and investigating reports.
- To improve the product - aggregate usage patterns, which templates resonate, where users drop off. We do NOT sell personal data, ever.
Who else sees it
We use a small set of processors to deliver the service. Each one only sees what they need for their function:
- Supabase - hosts your account, profile, project rows, and generated images in a private storage bucket.
- OpenAI - receives your prompts and a moderation pre-check. It returns game config + images; prompts may be retained briefly per OpenAI’s own data-use policy.
- Vercel - runs the website and serverless functions; sees only the data needed to route requests.
- Stripe (once billing launches) - handles card payment information end-to-end. We never store full card data.
What other users see
Your username, character avatar, sparks balance, and scores appear on public leaderboards. Anyone with the share link to one of your games can see the game’s title, generated config, and the leaderboard for that game. Your email is never shown to other users; we derive a display name from your chosen username instead.
Retention
- Account data persists until you delete your account from the Settings page.
- Moderation logs persist for a rolling window (months, not years) and are accessible only to the service role.
- To stop repeated guest-trial creation, we keep a keyed one-way network fingerprint for 30 days. We do not store the raw IP address in the guest-limit table, and the fingerprint is used only for trial enforcement.
- On account deletion, profiles + projects + scores cascade within a reasonable window; backups age out per Supabase’s retention schedule.
Your rights
Depending on where you live, you may have the right to access, correct, delete, port, or object to the processing of your personal data. The Settings page provides:
- Export - JSON download of everything we store about your account.
- Delete - destructive, irreversible removal of your account.
- Change email / password - both via confirmation emails so an attacker with momentary access to an open tab can’t lock you out.
For requests we can’t handle in-app, contact us through hello@gameforge.dev. U.S. residents can read the additional U.S. Privacy Notice. We do not discriminate against anyone for exercising a privacy right.
Children
Independent EURUS accounts are for people 13 or older, subject to the higher minimum age in their country. Children under 13 may participate only through a school-, teacher-, parent-, or guardian-managed classroom experience where the responsible adult has authority to provide any required permission. For U.S. children under 13, we do not permit independent account creation. School participation is limited to the educational context selected by the teacher or school.
Classroom students use first name and last initial instead of an email address. Classroom/student sessions cannot access stranger matchmaking or stranger voice. Parents, guardians, and authorized schools may ask us to access, correct, or delete a child’s information. We do not use classroom student information for behavioral advertising, sell it, or use it to build commercial profiles unrelated to the school activity. See our Child Safety policy and School Privacy Notice.
Security
Data sits behind Supabase row-level security, with internal tables (moderation log, asset cache, billing events) locked to the service role only. Password resets, email changes, and account deletions all go through email confirmation. We can’t promise perfect security - no service can - but we’re conservative about what we expose at the API surface.
Changes
If we materially change what we collect or how we use it, we’ll update the “Last updated” date above and flag the change inside the app.
Contact
Operator: EURUS
Mailing address: Atlanta, Georgia, USA
Email: hello@gameforge.dev
Telephone: +1 (470) 746-7306
Privacy questions, parent requests, and data requests may be submitted using either contact method. We may need to verify your identity or authority before acting.