Privacy policy - EURUS

This page covers what EURUS collects about you, why, who else sees it, how long it sticks around, and what you can do about it.

What we collect

You give us:

Account info - email, password (hashed), chosen username, date of birth, declared country and state or region, legal-consent records, and the character you customize.
Game prompts - the text you type to build a game, plus any remix modifiers you add.
Game results - scores, achievements, daily challenge completions.
VS and safety information - matchmaking status, opponent usernames, match scores, and reports. If you enable VS voice chat, the browser processes microphone audio for the live peer call. Voice starts off, requires explicit permission, and EURUS does not record the call.
Optional purchase info - credit pack interest. When real billing launches: your payment processor (Stripe) will collect card details directly; we never see them.

The system automatically collects:

Basic technical data - IP, browser/OS, timestamps - captured by our infrastructure (Vercel, Supabase) for security and abuse prevention.
Approximate jurisdiction signals - country and state or region derived by hosting infrastructure from an IP address. We use these signals together with account declarations, not as precise location tracking, to apply legal and safety rules.
Remy records - private wallet balance, transaction and escrow history, match acceptance, settlement, device-risk hashes, and fraud-review evidence. Other players do not receive your wallet balance.
Moderation events - when a prompt is blocked, we log the prompt text + reason so we can improve the safety filters.
Generated assets - the AI-generated images for your characters, obstacles, backgrounds. Stored alongside your game so it’s playable on demand.

How we use it

To create the games you asked for.
To award sparks, streaks, achievements, and rank you on global + per-game leaderboards.
To prevent abuse - filtering disallowed prompts, rate-limiting obvious script behavior, and investigating reports.
To enforce age, jurisdiction, competition, and Remy eligibility rules and maintain evidence of accepted legal terms.
To improve the product - aggregate usage patterns, which templates resonate, where users drop off. We do NOT sell personal data, ever.

Lagos Rush locations and private races

Location suggestions send the text you type to Photon, or Geoapify when configured. Explicit place searches may use OpenStreetMap Nominatim. Map tiles load from OpenStreetMap, which receives your IP address and the areas you view. Selected coordinates go to FOSSGIS/OSRM to find drivable roads. You can choose a street or map pin instead of entering your full home address. Device location is requested only when you press “My location”. Search-provider address labels are not included in new shared race-route records or route downloads.

Joining a friend race creates or uses a guest session without requiring registration. Invitations allow two drivers and expire after one hour. Supabase holds the route, participant identifiers and temporary WebRTC connection signals. Expired room records are removed when subsequent rooms are created. Connection signals can contain network addresses. Direct connections may reveal your IP address to the other driver; Cloudflare STUN helps the browsers establish that connection.

Room text and voice travel directly between the two browsers. Eurus does not save chat transcripts or record audio. Text remains in your current browser session until you leave or reload. Voice starts only after you enable it and grant microphone permission. The other participant can independently copy messages or record what they hear. Use mute, leave, and report controls, and share invitations only with people you trust.

Who else sees it

We use a small set of processors to deliver the service. Each one only sees what they need for their function:

Supabase - hosts your account, profile, project rows, temporary race rooms and connection setup data. Generated media is stored separately on Cloudflare R2.
OpenAI - receives your prompts and a moderation pre-check. It returns game config + images; prompts may be retained briefly per OpenAI’s own data-use policy.
Vercel - runs the website and serverless functions; sees only the data needed to route requests.
Stripe (once billing launches) - handles card payment information end-to-end. We never store full card data.

What other users see

Existing Eurus builder, project and game pages are restricted to the verified owner. Lagos Rush solo scores are displayed for the current run. In a friend race, the other driver sees your car and the messages you send, and hears your voice only when your microphone is enabled. Your account email is not included in race-room responses.

Retention

Account data persists until you delete your account from the Settings page.
Moderation logs persist for a rolling window (months, not years) and are accessible only to the service role.
To stop repeated guest-trial creation, we keep a keyed one-way network fingerprint for 30 days. We do not store the raw IP address in the guest-limit table, and the fingerprint is used only for trial enforcement.
On account deletion, profiles + projects + scores cascade within a reasonable window; backups age out per Supabase’s retention schedule.

Your rights

Depending on where you live, you may have the right to access, correct, delete, port, or object to the processing of your personal data. The Settings page provides:

Export - JSON download of everything we store about your account.
Delete - destructive, irreversible removal of your account.
Change email / password - both via confirmation emails so an attacker with momentary access to an open tab can’t lock you out.

For requests we can’t handle in-app, contact us through hello@eurusarc.com. U.S. residents can read the additional U.S. Privacy Notice. We do not discriminate against anyone for exercising a privacy right.

Children

Independent EURUS accounts are for people 13 or older, subject to the higher minimum age in their country. Children under 13 may participate only through a school-, teacher-, parent-, or guardian-managed classroom experience where the responsible adult has authority to provide any required permission. For U.S. children under 13, we do not permit independent account creation. School participation is limited to the educational context selected by the teacher or school.

Classroom students use first name and last initial instead of an email address. Classroom/student sessions cannot access stranger matchmaking or stranger voice. Parents, guardians, and authorized schools may ask us to access, correct, or delete a child’s information. We do not use classroom student information for behavioral advertising, sell it, or use it to build commercial profiles unrelated to the school activity. See our Child Safety policy and School Privacy Notice.

Security

Data sits behind Supabase row-level security, with internal tables (moderation log, asset cache, billing events) locked to the service role only. Password resets, email changes, and account deletions all go through email confirmation. We can’t promise perfect security - no service can - but we’re conservative about what we expose at the API surface.

Changes

If we materially change what we collect or how we use it, we’ll update the “Last updated” date above and flag the change inside the app.

Contact

Operator: EURUS
Mailing address: Atlanta, Georgia, USA
Email: hello@eurusarc.com
Telephone: +1 (470) 746-7306
Privacy questions, parent requests, and data requests may be submitted using either contact method. We may need to verify your identity or authority before acting.