DRAFT FOR LAWYER REVIEW — NOT LEGAL ADVICE. This document has not been approved by a lawyer and does not by itself protect the operator or anyone else.

Privacy Policy

This draft describes what the RIFTYARD beta is designed to collect and why. It is written from the current data model and must be re-checked against the running system before it is approved. Text marked [LEGAL REVIEW] must be confirmed by the operator's lawyer; text marked [ENGINEERING] must be confirmed by the engineering team.

1. Who is responsible

The operator of RIFTYARD is [OPERATOR LEGAL ENTITY NOT CONFIGURED], [OPERATOR ADDRESS NOT CONFIGURED].

Privacy enquiries and requests: [LEGAL CONTACT NOT CONFIGURED].

[LEGAL REVIEW] Whether the operator is an entity bound by the Privacy Act 1988 (Cth) and the Australian Privacy Principles (APPs) — including the effect of any small business exemption and of any choice to opt in — and whether privacy laws of other countries apply to users located there. This draft is written on the assumption that the operator will act consistently with the APPs regardless.

2. What we collect

Account and identity

Data	Notes
Email address	Held by our authentication provider (Supabase Auth) and used to sign you in, verify your account and recover access. It is not used as a public identifier or as an ownership key.
Password	Stored by the authentication provider as a hash. We do not see it.
Handle, display name, short bio, generated avatar seed	Public. Shown on your profile and next to your games.
Age attestation	The time you confirmed you are 18 or over, and the method (currently `self_declared`). We do not collect your date of birth and we do not collect identity documents.
Invite code used	To administer the invite-only beta.
Country code	Optional two-letter code, used only if needed for eligibility. [ENGINEERING] confirm whether and where this is populated.
Account status	Onboarding time, suspension time and reason if any, deletion request time.

Agreements

For each document you accept we store the document slug, version, a SHA-256 hash of its exact text, the context (for example onboarding or publication) and the time. For each version you submit we store the rights declaration you affirmed.

Things you make

Projects, draft revisions, submitted and published versions, the prompts you send to the generation system, the stages and outcomes of generation jobs, the AI model used, token counts and our cost. Published games, their titles, summaries and your handle are public.

Things you do

Play records: which game and version you launched, whether you joined a room, whether it was by invitation and whether the match was completed. Guests are recorded under a random guest identifier, not an account.
Match results and leaderboards: server-verified results including the display names of the players in the match, kills, revives, points and run times. Leaderboard entries are public.
Library: games you saved or marked as favourite.
Social: friend requests and friendships, users you have blocked, your privacy settings, notifications.
Rooms: room identifier, invite code, region, player count and timestamps.

Safety and complaints

Reports you make (target, reason, details) and their outcome.
Appeals you lodge and the decisions on them.
Moderation actions and strikes recorded against an account.
Rights complaints: the complainant's name, email, organisation, statements, signature and supporting evidence; and any counter-notice with its statement and signature. A complainant does not need an account.

Sparks and payments

A ledger of Spark grants, reservations, charges and releases for your account.
Payment card details are collected and held by Stripe, not by the operator. We receive only references such as a checkout session or payment identifier, the amount, currency and status.
Creators who onboard for payouts provide identity and bank information directly to Stripe through Stripe's hosted onboarding. We receive the connected account identifier and status flags, not the documents.

[ENGINEERING] The payments and ledger tables were not present in the migrations reviewed for this draft. Confirm the exact fields before approval. Live payments are disabled.

Technical data

Structured server logs containing request, job, version and room identifiers, timestamps and error details. Logs are designed to redact secrets and to avoid recording prompts or identity data unnecessarily. IP addresses are processed transiently to deliver the service and to apply rate limits. [ENGINEERING] Confirm whether IP addresses are stored, where, and for how long; confirm which cookies or local storage keys are set and whether any analytics tool is used.

3. What we do not collect

Date of birth, government identifiers or identity documents.
Precise location.
Voice or video. There is no voice chat in the beta, and free-text room chat is switched off by default.
Files you upload. The beta has no user upload feature.

4. Why we use it

To provide accounts, games, multiplayer rooms and Studio.
To enforce the 18+ invite-only beta and the Community Standards.
To run generation jobs and account for Sparks.
To show real activity counts and rank discovery. Test accounts are excluded from statistics.
To handle reports, complaints, appeals and legal obligations.
To keep the service secure, prevent fraud and control cost.
To process payments and payouts, if and when those features are activated.

We do not use your content or prompts for advertising. Draft commitment, to be confirmed before approval: the operator does not intend to sell personal information. [LEGAL REVIEW] Confirm this commitment can be made accurately and define "sell".

Recipient	Purpose	Location
Supabase	Authentication, database and storage	Intended project region: Sydney (`ap-southeast-2`). [ENGINEERING] confirm at deployment.
Anthropic	Generating and editing game projects from your prompts, when the live AI provider is enabled	[LEGAL REVIEW / ENGINEERING] confirm processing location and the provider's data-use and retention terms.
Stripe	Payments and creator payouts, when activated	[LEGAL REVIEW] confirm.
Hosting providers for the web app, game runtime, room server and worker	Running the service	[ENGINEERING] to be decided; see `docs/DEPLOYMENT.md`.

When generation runs in offline fixture mode, prompts are not sent to an AI provider.

Some of these providers may process data outside Australia. [LEGAL REVIEW] Cross-border disclosure obligations under the APPs and the wording of this section.

We may also disclose information where required or authorised by law, to a rightsholder or creator as part of a complaint or counter-notice (see the Copyright and Trademark Complaints policy), or to protect someone's safety.

6. How long we keep it

[LEGAL REVIEW] All retention periods below are placeholders: [CONFIGURABLE — TO BE SET PER JURISDICTION ON LEGAL ADVICE].

Account and profile: while your account exists.
Terms acceptances and rights declarations: for the period needed to evidence the agreement.
Complaint evidence, counter-notices, strikes and moderation records: until the retain_until date set for the record under the retention policy, then deleted or de-identified.
Financial ledger entries: for the period required by tax and financial record-keeping law.
Audit log: append-only; retention period to be set.
Logs: short operational retention, to be set.

7. Your choices

Access and export. You can request an export of your account data.
Correction. You can edit your display name and bio; contact us to correct anything else.
Deletion. You can request deletion of your account. On deletion, your profile, projects and library are removed. Some records are kept where we must or reasonably need to: ledger entries, records needed for an open complaint or appeal, strikes, and audit records. Published versions that other creators have lawfully remixed may need to be retained in restricted form so that existing remix grants remain traceable. [LEGAL REVIEW / ENGINEERING] Confirm the deletion behaviour and whether retained lineage records can be fully de-identified.
Privacy settings. You control who can send friend requests and invitations and whether your recently played list is shown. Recently played is hidden by default.
Blocking. You can block other users.

[ENGINEERING] Confirm that export and deletion are implemented end to end and state the response time once known.

8. Security

We use access controls at the database level, keep administrative and financial data in a separate schema that is not reachable from the browser, run games on a separate web origin that never receives your account session, and restrict staff access by role. No system is perfectly secure. An independent security review has not yet been carried out.

If a data breach occurs that is likely to result in serious harm, we will assess it and notify affected people and the regulator as required by law. [LEGAL REVIEW] Application of the Notifiable Data Breaches scheme to the operator.

9. Children

RIFTYARD is not intended for anyone under 18. If we learn that an account belongs to a person under 18, we will close it.

10. Complaints

Contact [LEGAL CONTACT NOT CONFIGURED] first. If you are not satisfied you may be able to complain to the Office of the Australian Information Commissioner. [LEGAL REVIEW] Confirm the complaints process and wording.

11. Changes

We will ask you to accept a new version of this policy before a material change takes effect.