Privacy Policy

1. Who we are and scope

This Privacy Policy explains how we collect, use, share, retain and protect personal data when you use the HavenGG website, applications, games and related services (the "Service"). It applies to everyone who uses the Service, including visitors who are not signed in. We are the controller of your personal data under the EU/UK General Data Protection Regulation ("GDPR") and the data fiduciary under India's Digital Personal Data Protection Act, 2023 ("DPDP Act"). Our contact and grievance details are in section 15.

2. Personal data we collect

• Account data: username, display name, email address, a securely hashed password (we never store your password in plain text), an account identifier from a third-party sign-in provider if you choose to use one, profile picture, bio and profile link.
• Authentication and session data: IP address, browser/device (user-agent) information, session identifiers and timestamps, used to keep you signed in and to secure and revoke sessions.
• Content you submit: the prompts and edits you write, the games and game configurations you create, generated voice audio, community posts, comments, roadmap items, and images you upload.
• Usage and credit data: your generation activity and token/usage accounting, and your credit ledger (credits, debits, refunds, adjustments).
• Payment data: the payment provider's order identifier, amount, currency and status, and the email associated with the order. We do not receive or store your full card or bank details; those are handled by the payment provider.
• Moderation data: whether submitted text was allowed or blocked, the reason and categories, and the related log.
• Preferences: your notification preferences and the email-verification state of your account.

We do not use advertising or analytics tracking, and we do not collect your precise location.

3. Cookies and similar technologies

We use cookies that are necessary to operate the Service: they keep you signed in, record that you have entered any site access password, and attribute activity you carry out while signed out so the Service works without an account. With your consent we also use Google Analytics to understand anonymous usage and improve the Service. Analytics cookies are set only after you accept them, and you can reject them — the Service works fully either way. Separately, we keep server-side request counts in aggregate (per day, endpoint and response class) — these contain no personal identifiers and set no cookies. We do not use advertising or session-replay/other third-party tracking cookies.

4. How and why we use your data, and our lawful bases

• To provide the Service — create and secure your account, generate, compile, voice and publish games, save drafts, display content and run the credits system. Lawful basis: performance of a contract.
• To keep the Service safe — moderate content, detect and prevent abuse, fraud and spam, enforce rate limits, and secure the Service. Lawful basis: our legitimate interests and, where applicable, legal obligation.
• To take payments — process credit purchases and maintain accurate balances and tax records. Lawful basis: performance of a contract and legal obligation.
• To communicate with you — send account-critical emails such as email verification and password reset, and respond to your requests. Lawful basis: performance of a contract and our legitimate interests.
• With your consent — where you opt in to optional communications or features. You may withdraw consent at any time.

5. AI processing and automated decisions

To generate and edit games, and to moderate content, we send your prompts, edits and submitted text to third-party artificial-intelligence providers (see section 6) for processing on our instructions. Moderation is an automated decision that can block or allow content. It does not produce legal effects, but if your content is blocked you can appeal to a human reviewer through our Grievance Redressal process. We do not use your private content to train AI models without your separate, explicit consent.

6. How we share data

We do not sell your personal data. We share it only with service providers who process it on our behalf and under contract, and where required by law. The categories of recipients are:

• Cloud hosting and database providers — who host the Service and store its data.
• Payment processors — who process credit purchases, including a processor that acts as merchant of record for card payments (charging, taxes and invoicing).
• Email delivery providers — who send account-critical transactional email.
• Artificial-intelligence providers — who generate game content and perform automated content moderation.
• Voice-synthesis providers — who generate voice audio for games.
• Third-party sign-in providers — if you choose to sign in with one.

We disclose the identity of these providers only where required by law. We may also disclose data to comply with the law, to respond to lawful requests from authorities, to enforce our Terms, or in connection with a merger, acquisition or sale of assets (in which case we will require the recipient to honour this Policy).

7. International transfers

We are based in India and our database is hosted in the United Kingdom, and some of our providers process data in other countries, including the United States. Where we transfer personal data internationally, we rely on the safeguards required by applicable law and take steps to ensure your data receives an adequate level of protection.

8. How long we keep data

We keep personal data for as long as your account is active and as needed to provide the Service. You can delete your content at any time and permanently delete your account from Settings. On account deletion:

• your games are delinked from your account and kept (they remain available under "Community");
• your profile, posts, comments, sessions and credit ledger are deleted;
• a minimal snapshot of the account is archived for legal, accounting and compliance purposes, and moderation logs are retained for safety and appeals.

We retain records we are legally required to keep (for example tax and payment records) for the period required by law, and backups are purged on a rolling basis. When data is no longer needed we delete or anonymise it.

Analytics: consent-based page analytics (which include your account or anonymous id) are kept for up to 14 months, then deleted or aggregated. Server-side request counts are stored only in aggregate (per day, endpoint and response class, with no personal identifiers) and are kept for up to 24 months.

9. Security

We protect your data with appropriate technical and organisational measures, including encryption and access controls, and we limit access to personal data to those who need it. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we become aware of a personal-data breach that affects you, we will notify you and the relevant authority where required by law.

10. Your rights

Subject to applicable law, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data (you can edit much of it in Settings);
• Delete your data or your account;
• Restrict or object to certain processing;
• Portability — receive your data in a portable format;
• Withdraw consent at any time where processing is based on consent;
• Nominate another person to exercise your rights in the event of death or incapacity (under the DPDP Act); and
• Complain to your data-protection authority (in the EU/UK, your local supervisory authority; in India, the Data Protection Board of India).

To exercise any right, use Settings or email [email protected]. We will respond within the time required by law. You may also lodge a grievance using our Grievance Redressal process.

11. Children

The Service is for adults: accounts are limited to people aged 18 and over, and we do not knowingly collect personal data from anyone under 18. Some games are rated 18+ (mature) and are gated so they cannot be played by users we have not verified as 18 or older. If we learn that someone under 18 has provided us data, we will delete it. If you believe someone under 18 has provided us data, contact us at the address in section 15.

12. Notifications and marketing

We send in-app notifications you have opted in to. We do not currently send marketing email. Email is limited to account-critical messages (for example email verification and password reset), which you cannot unsubscribe from while you hold an account because they are necessary to operate it.

13. Automated decisions

Our content moderation uses an automated classifier. Where it blocks content, you may request a human review through our grievance process. We do not use solely automated processing to make decisions that produce legal effects concerning you.

14. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes we will provide reasonable notice (for example by email or a notice on the Service) and update the effective date above. Continued use after the effective date means you accept the updated Policy.

15. Contact, grievance officer and data protection

Grievance Officer / privacy contact: Abhishek Mitra, Equanimity Labs (OPC) Pvt Ltd, Bengaluru, Karnataka, India. Email: [email protected]. See our Grievance Redressal page for how we handle complaints.