Privacy policy

Game Piece Studio needs some personal data to run your account, save your projects, and process Lite and Pro subscriptions. We use it to deliver the product, keep it secure, and make it better.

• We do not sell your personal information.
• Your game content stays yours. We process it only to host, sync, share, publish, and export it as you ask.
• We use essential cookies for sign-in and, only with your consent, analytics to understand product usage.
• Payment details are handled by Stripe, our payment partner. We do not store full card numbers.
• If you are in the UK or EEA, you have rights to access, correct, delete, and object to certain processing.
• Questions or requests? Email [email protected].

Game Piece Studio is the data controller for personal data described in this policy. That means we decide why and how your personal data is processed when you use our website and studio.

For privacy questions, data-rights requests, or complaints, contact us at [email protected].

This policy should be read together with our Terms of service, which cover how the product works, billing, and account rules.

This policy applies when you visit our website or docs site, create an account, use the studio, upload assets, collaborate on games, start a Lite or Pro trial, link a Discord account, connect tools through our MCP server, or contact us for support.

It covers personal data we collect directly from you, data generated when you use the service, and data we receive from service providers that help us operate Game Piece Studio.

It does not cover third-party websites you reach through links in our product. Those sites have their own privacy policies.

The personal data we process depends on how you use Game Piece Studio. It may include:

• Account and identity data, such as your email address, name, profile picture, display name, authentication method, and account settings. If you sign in with Google, Discord, or Facebook, we receive your name, email address, and profile picture from that account.
• Sign-in and security data, such as session tokens, password credentials if you choose password sign-in, email sign-in codes, password-reset codes, bot-check results from Cloudflare Turnstile, and records of failed sign-in attempts used to prevent abuse.
• Workspace and project data, such as game names, design documents, datasets, variables, comments, collaborator roles, and metadata needed to save and sync your work.
• Uploaded content, such as images, fonts, cover art, and export cache files you choose to store with a project.
• Collaboration data, such as the email addresses you invite to a game or share link, invite status, access level, and the name shown to others while you work together.
• Billing data, such as your plan tier, billing history references, and subscription status in our systems. Card and payment-method details are processed by Stripe, our payment partner.
• Usage and diagnostics data, such as pages visited, features used, export and upload activity, error reports, session recordings (only with your consent), and pseudonymous analytics identifiers. Where possible, we avoid putting unnecessary personal data into analytics events.
• Technical data, such as browser type, device information (for example screen and window size and number of processor cores), approximate location derived from IP address, and server logs used for security and reliability.
• Preferences, such as theme, currency, or other choices stored in your browser when you set them.
• Discord link data, if you link a Discord account: your Discord user ID, username, and display name.
• Connected-tool data, if you connect an AI assistant or other tool through our MCP server: the name, permissions, and last-used time of each access token, and a record of the actions those tools take. We store access tokens only in hashed form.
• Support communications, such as the name, email address, topic, and message you send through our contact form or by email, and the information needed to respond.

You choose what project content to upload. Please do not upload personal data in game content unless you need it for your project and have a lawful basis to do so.

We use personal data to:

• Create and manage your account.
• Authenticate you and keep sessions secure.
• Store, sync, display, and export your projects.
• Enable collaboration, share links, and invitations you send.
• Provide Lite and Pro trials, subscriptions, invoices, and billing support.
• Send service emails such as sign-in codes, invitations, account and security notices, and billing receipts.
• Give your linked Discord account the community roles that match your plan.
• Monitor performance, fix bugs, prevent abuse, and improve the product.
• Comply with law, respond to lawful requests, and enforce our terms.

Under UK GDPR, we rely on one or more of the following legal bases depending on the activity:

• Contract, where processing is necessary to provide the service you signed up for.
• Legitimate interests, where we need to keep the service secure, understand how it is used, and improve reliability, balanced against your rights.
• Legal obligation, where we must keep certain records, for example for tax or accounting.
• Consent, where required for optional cookies or similar technologies. You can withdraw consent at any time with the cookie button in the site footer, or by contacting us.

We do not use your personal data for cross-context behavioural advertising.

We use cookies, local storage, and similar browser storage so Game Piece Studio works properly and, only if you agree, so we can understand product usage. This is what we store on your device:

• Strictly necessary
  • Your cookie choice (the cc_cookie cookie), shared by gamepiece.studio and our docs at docs.gamepiece.studio so you only choose once.
  • Sign-in and session cookies from Clerk, our sign-in provider.
  • Bot checks from Cloudflare Turnstile, and Cloudflare security cookies set on our sign-in provider.
  • Short-lived cookies for share links, sign-in hand-offs, account linking, and contact-form rate limits, plus the details of share links you create or join.
  • Unsaved edits and undo history, kept in your browser so work is not lost.
  • Export and preview caches, and export files stored so you can download them again.
• Preferences you choose, such as theme, currency, designer layout and panel sizes, keyboard shortcuts, and export settings.
• Analytics, only with your consent. PostHog stores a random ID in your browser and records page views, feature use, error reports, device details, and session recordings so we can fix problems and improve the studio. Session recordings are replays of how you use the studio, including what you type and the images on screen. Passwords, sign-in codes, and private share links are always hidden. Device details are your browser, operating system, screen and window size, and number of processor cores, which help us make the studio work well on the screens and devices people use. We also remember which blog posts you viewed today so each view is counted once. Analytics data is processed in the EU and is not used for ad targeting. The same choice applies to our docs, where analytics records only page visits and clicks on links to the studio, without session recordings.
• Other sites you visit through us. When you sign in with Google or Discord, start checkout, or open the billing portal, you go to that provider's own site (including Stripe for payments), which sets its own cookies under its own privacy policy.

The cookie preferences dialog lists each cookie, who sets it, what it is for, and how long it lasts.

When you browse Google Fonts in the studio or open a project that uses them, your browser loads those fonts directly from Google, which receives your IP address.

You can change your choice at any time with the cookie button in the site footer. You can also control cookies through your browser, but blocking strictly necessary cookies may stop sign-in or checkout from working.

We share personal data only when needed to run Game Piece Studio, comply with law, or protect users and the service. We do not sell personal information.

Categories of recipients include:

• Infrastructure and hosting providers that store application data, run our backend, and serve the website: Hetzner (servers), Convex (database), and Cloudflare (network and content delivery).
• Object storage providers that store uploaded images, fonts, and export files: Backblaze B2.
• Authentication and email providers: Clerk, which runs sign-in and sends sign-in and password-reset codes, and Resend, which sends our other service emails and delivers contact-form messages to us.
• Security and abuse-prevention providers such as Cloudflare Turnstile, which helps us distinguish legitimate sign-in attempts from automated abuse.
• Payment processors that handle subscriptions, trials, invoices, and card payments: Stripe.
• Analytics and diagnostics providers that help us understand usage and errors: PostHog, using its EU hosting.
• Discord, if you link your Discord account. Our bot gives it a role that matches your plan, which other members of our Discord server can see.
• Professional advisers and authorities where required by law, regulation, court order, or to protect rights, safety, and security.

Service providers may only use personal data on our instructions and must protect it appropriately. If we use a provider outside the UK, we put safeguards in place as described below.

If you invite collaborators or create a share link, project data and invite details are shared with the people you choose and at the access level you assign. If you publish a game to the community library, it is shown publicly with your display name.

We aim to keep core service data in the UK and EEA where possible. Our main database (Convex), stored files (Backblaze B2), and analytics (PostHog) are hosted in the EU. Some providers may process data in other countries, including the United States, to deliver sign-in, email, payments, or global network services.

When personal data leaves the UK, we use appropriate safeguards such as the UK International Data Transfer Agreement, EU Standard Contractual Clauses, or another lawful transfer mechanism recognised under UK GDPR.

You can contact [email protected] if you want more information about safeguards for a specific type of processing.

We keep personal data only for as long as we need it for the purposes described above.

• Account and project data is kept while your account is active. If you delete content, we delete or anonymise it within a reasonable period, subject to backup cycles and legal holds. If you delete your account, you can cancel within 7 days; after that we permanently delete your account and stored project data. Comment threads you started that others replied to stay in place, shown as "Deleted user" with your text removed.
• Account exports you request stay available to download for 30 days.
• Billing and subscription records may be kept longer where needed for tax, accounting, fraud prevention, or dispute resolution. After account deletion, we keep a one-way hash of your email address so the same address cannot claim another free trial.
• Security and abuse-prevention records may be kept for a limited period after an incident or failed sign-in pattern.
• Analytics data is kept according to the retention settings configured in our analytics tools, typically on a rolling basis rather than indefinitely.
• Support messages are kept long enough to resolve your request and improve future support.

Backups may persist for a limited time after deletion before they roll off. During that window, deleted data may still exist in backup systems but is not used for ordinary product operation.

If you are in the UK, you have rights under UK GDPR and the Data Protection Act 2018. If you are in the EEA, similar GDPR rights apply through local law.

Depending on your situation, your rights may include:

• The right to access a copy of personal data we hold about you.
• The right to ask us to correct inaccurate data.
• The right to ask us to delete data in certain circumstances.
• The right to restrict or object to certain processing.
• The right to data portability for data you provided, where applicable.
• The right to withdraw consent at any time, where processing is based on consent, without affecting processing that already happened lawfully.

You can download a copy of your account data with Export account, and delete your account, in Account settings. To exercise any of these rights, you can also email [email protected] from the address linked to your account so we can verify your request safely. We respond within one month in most cases, and may extend that period for complex requests as UK law allows.

You also have the right to complain to the UK Information Commissioner's Office (ICO). We would appreciate the chance to resolve your concern first, but you may contact the ICO at ico.org.uk.

We use technical and organisational measures designed to protect personal data, including access controls, encrypted transport, malware scanning of uploaded files, and separation between production and non-production environments where practical.

No online service can guarantee perfect security. You play an important part by using a strong, unique password if you enable password sign-in, keeping devices updated, and not sharing account access.

If we become aware of a personal data breach that is likely to affect your rights, we will notify you and regulators where required by law.

Game Piece Studio is not intended for children under 18, or under the age of legal majority where you live. We do not knowingly collect personal data from children.

If you believe a child has created an account, contact [email protected] and we will take appropriate steps to delete the account and related data where required.

We may update this policy when our service, providers, or legal obligations change. When we do, we will update the "Last updated" date at the top of this page.

If a change is material, we will make reasonable efforts to notify you by email or through the product before it takes effect.

For privacy requests, questions about this policy, or concerns about how we handle personal data, email [email protected].

Please include the email address associated with your account and a clear description of your request. That helps us verify identity and respond faster.