Privacy Policy

What we collect

• Google account info — when you sign in, Google sends us your account ID, email, and display name. We use these to identify your account across sessions.
• Decks you create — title, card text, images, and styling. Saved decks get a public shareable slug at playmade.ai/<slug>; anyone with the link can view them. You can delete a deck any time from your profile.
• Discover saves — when you save a card from the Discover feed, we keep a per-user list so you can build a deck from it later.
• Access tokens — if you connect Playmade to Claude Desktop (MCP) or to a Custom GPT in ChatGPT, we mint a bearer token tied to your account. Tokens expire after 90 days; you can revoke them at /settings/mcp.
• Usage stats — daily counts of LLM input/output tokens per user and per IP, retained 90 days. We use them to enforce per-user spend caps and rate limits, not to profile you.
• Session cookie — an HTTP-only cookie that keeps you signed in. Required to use the app.

We do not use third-party analytics or advertising trackers, and we do not sell or rent your data.

Who else sees your data

Playmade is a thin layer over a few external services. When you use a feature that needs one of these, the relevant data goes to them:

• Google — for sign-in. Receives your auth handshake; gives us your account ID, email, and name. Google's privacy policy.
• Anthropic — when you generate or edit cards, your prompts and the topic / card text are sent to the Claude API. Anthropic's privacy policy.
• Pixabay — when you ask for images, we send the visual description as a search query. Pixabay's privacy policy.
• Replicate — when Pixabay has no good match, the same prompt is sent to Replicate to generate an image. Replicate's privacy policy.
• Cloudflare — hosts the site and stores all of the above (decks, saves, tokens, usage stats) in Cloudflare KV and R2 storage. Cloudflare's privacy policy.
• OpenAI — only if you use the Playmade Custom GPT in ChatGPT. ChatGPT sees your conversation and the API responses Playmade sends back. OpenAI's privacy policy.

How long we keep things

• Decks and Discover saves — until you delete them or delete your account.
• Bearer tokens — 90 days, or until you revoke them.
• Usage stats — 90 days, then automatically discarded.
• Account info — until you ask us to delete it.

Your rights

You can:

• View and delete individual decks at /my-games.
• Revoke any MCP / Custom GPT token at /settings/mcp.
• Ask us to delete your account and all associated data — email [email protected] and we'll do it within a few days.
• Ask for an export of the data we have on you — same email.

Changes

If we materially change what we collect or who we share it with, we'll update the date at the top of this page. The version of this policy you accepted when you signed in is whichever was live at that time.

Contact

Questions, data deletion requests, or anything else: [email protected].