Privacy Policy

1. Who is responsible for your data

The controller under the General Data Protection Regulation (GDPR) is:

Name

Kristijan Đokić, RuleMaker Games e.U.

Address

Davidgasse 96/32, 1100 Vienna, Austria

Email

[email protected]

Write to us at this email address about anything to do with your data, including to use any of your rights (section 9). We have not appointed a data protection officer; the law does not require one for a service of this size.

2. The waitlist

V-Forge is not open yet. Until it opens, the website collects a waitlist.

What we keep

• Your email address.
• When you joined, and which form on the page you used (the one at the top or the one at the bottom).
• If you choose to give them: the idea you tell us about and the kind of person you say you are (game maker, teacher, learner, parent or other).
• The sentence next to the form’s button that you agreed to (“We’ll only email you when there’s a big update, and when V-Forge opens. Unsubscribe any time.”).
• Where your entry stands (waiting for your confirmation, or confirmed), when you confirmed, and when we last sent you the confirmation email.

Nothing else: no name, and we do not store your IP address with your entry.

What we use it for

• To send you one email with a link to confirm that the address is yours and that you want to be on the list. Only confirmed addresses are on the list.
• To tell you when V-Forge opens (planned for 2027). No automated system decides anything about you.
• Only when there is a big update, a short email about it.

Legal basis

Your consent (Art. 6(1)(a) GDPR; for the emails also § 174 of the Austrian Telecommunications Act 2021). Joining is voluntary; without an email address we cannot tell you when V-Forge opens. You confirm your consent by clicking the link in the confirmation email. We keep a record of the sentence you agreed to, of when you joined and of when you confirmed, to be able to show that you asked to be on the list (Art. 7(1) GDPR). The idea and the kind of person are optional, and you give them by your own choice.

Leaving the list

You can withdraw your consent at any time, without giving a reason: write to [email protected], or use the link to leave the list that is in every update email we send (it opens a page with one button, and the button deletes your entry; the unsubscribe button of your mail app works too). We then delete your entry. Withdrawing does not make what we did before it unlawful.

Who processes it, and for how long

The list is stored in a database run by Cloudflare, which keeps the data in the EU. Our emails, the confirmation email included, are sent through Resend, from its EU region (Ireland); Resend and Cloudflare are US companies (sections 6 and 7). An address you do not confirm is deleted after 30 days at the latest; the link in the email works for 7 days. We keep a confirmed address until you leave the list or the waitlist ends. If you never create an account, we delete it at the latest 12 months after V-Forge opens. If you do create one, the entry is kept with your account and deleted with it.

3. Your account and what you make

• Account: your email address and password. The password is stored only as a one-way hash (bcrypt), never in readable form. We also keep when you created the account, when you accepted the Terms, and, if you asked to delete it, when.
• What you make: your projects and everything in them (worlds, mechanics, learning goals, decisions, blueprints, notes, pictures and builds of your game) and your conversations with Mila, the in-app assistant.
• Embers: your balance and its history, and for each AI request the feature, the model, its size and cost, and the Embers charged.
• Coding agents: if you connect your own coding agent, the access tokens you create (stored only as a hash), their names and permissions, and the agent profiles you set up.
• Feedback: what you write to us through the feedback button, with the page you were on, your browser type and your screen size.

Legal basis: our contract with you, to provide V-Forge (Art. 6(1)(b) GDPR); for feedback, our legitimate interest in answering it and improving V-Forge (Art. 6(1)(f) GDPR). You need an email address and a password to have an account; everything else is up to you.

V-Forge takes no payments at the moment. Embers are credits we give you; no payment data is collected.

4. How AI processes your content

V-Forge generates with AI models run by other companies. When you use a feature that generates something (suggestions, Mila, the blueprint, pictures for your game, the scene that shows a mechanic in play), we send that model what you typed and the parts of your project the feature needs, and receive the result. We never send your email address or password. If you write personal details about yourself or others into a project, they travel with it, so please keep them out.

• OpenAI: most generating features, including Mila; the search index of your project; the pictures for your game.
• Google (Gemini API): many design and checking features; summaries of feedback and error reports.
• OpenRouter, passing on to Alibaba Cloud’s Qwen model: the scene that shows a mechanic in play.

We record every AI request in Langfuse (what went in, what came out, your account ID and the project ID) to find faults and improve quality. Legal basis: for generating, our contract with you (Art. 6(1)(b) GDPR); for the record in Langfuse, our legitimate interest in a service that works (Art. 6(1)(f) GDPR), which you may object to (section 9).

We do not use your content to train AI models. AI output can be wrong or incomplete; check it before you rely on it. We make no decisions about you by automated means that have legal or similarly significant effects (Art. 22 GDPR).

5. Cookies, analytics and error reports

Always on, because the site needs them

• Delivering the site: each request from your browser, with your IP address, passes through Cloudflare to our server so the page can be delivered and attacks blocked.
• Sign-in cookies that keep you signed in and protect sign-in against forgery.
• Storage in your browser for your choices and your work in progress: light or dark theme, your cookie choice, drafts and the state of your workspace. It stays on your device.
• When something fails on our server, Sentry receives the error with emails, tokens and AI text removed, and your account ID and IP address only in a one-way hashed form. Our server logs hold the same hashed values with the time and the page or API path requested.

Legal basis: storing on your device what the service you asked for needs (§ 165(3) of the Austrian Telecommunications Act 2021) and our legitimate interest in a secure, working service (Art. 6(1)(f) GDPR).

Only if you say yes

• PostHog analytics: which pages you view, what you click, how long you stay, your browser and device, and your approximate location from your IP address. After you sign in it is linked to your account ID, never to your email. On the waitlist form it records that the form was sent and which one, not your address.
• Sentry error reports from your browser.

Legal basis: your consent (Art. 6(1)(a) GDPR and § 165(3) of the Austrian Telecommunications Act 2021). You choose in the banner on your first visit and can change your mind at any time with “Cookie preferences” in the footer. If your browser sends a Do Not Track signal, both stay off and we do not show the banner. The Cookie Policy lists each cookie.

6. Who receives your data

We do not sell your data and do not share it for advertising. These companies process it on our behalf, under a data processing agreement that lets them use it only to provide their service to us:

Others who see some of your data

• IGDB (Twitch, USA) and BoardGameGeek (USA): when you search for games to take inspiration from, our server sends them only the words you searched for. The cover pictures are loaded by your browser straight from their image servers, which therefore see your IP address and browser type. They are independent of us and handle that data under their own privacy notices.
• Your own coding agent: if you connect one, it reads your project with the token you gave it. What that agent’s provider does with the data is between you and them.
• Authorities and courts, where the law obliges us to disclose data.

7. Data sent outside the EU

Cloudflare, Resend, OpenAI, Google and OpenRouter are in the USA, and Alibaba Cloud is outside the EU, so data sent to them may be processed there. We rely on the EU Standard Contractual Clauses in each company’s data processing terms (Art. 46(2)(c) GDPR) and, for US companies certified under the EU–US Data Privacy Framework, on the European Commission’s adequacy decision of 10 July 2023 (Art. 45 GDPR). You can ask us for a copy of the safeguards.

8. How long we keep your data

• Waitlist entry: an address you do not confirm, 30 days at the latest; a confirmed one, until you leave the list; without an account, at the latest 12 months after V-Forge opens; with an account, as long as the account.
• Account, projects, Mila conversations, Embers history, coding-agent tokens and feedback: as long as your account exists. When you delete your account, you have 30 days to change your mind by signing in again; after that it is erased for good.
• The cost record of each AI request: when your account is erased, everything that links it to you is removed and only the anonymous figures remain.
• Error records on our server and AI request records in Langfuse: 90 days.
• Server logs: 30 days.
• Error reports in Sentry: up to 90 days.
• Analytics in PostHog: up to one year.
• Emails sent through Resend: Resend keeps a short delivery log (address, subject, whether it arrived) under its own retention period.
• Backups of our database: 30 days, so data erased from V-Forge leaves the backups within 30 days.
• Your cookie choice in your browser: until you change it or clear your browser’s storage.

We keep data longer only where the law obliges us to.

9. Your rights

Under the GDPR you have the right to:

• see the data we hold about you and get a copy (Art. 15);
• have it corrected (Art. 16);
• have it erased (Art. 17);
• have its processing restricted (Art. 18);
• receive it in a common machine-readable format, or have it sent to someone else (Art. 20);
• object to processing based on our legitimate interests, for reasons arising from your situation (Art. 21);
• withdraw any consent at any time, without affecting what was done before (Art. 7(3)).

In the app, Settings lets you download your data (“Download my data”) and delete your account. For everything else, write to [email protected]. We answer within one month.

You can also complain to a data protection authority. In Austria it is the Österreichische Datenschutzbehörde (Austrian Data Protection Authority), Barichgasse 40–42, 1030 Vienna, dsb.gv.at; you may also complain in the EU country where you live or work.

10. Children

V-Forge is not directed at children under 16. You confirm you are at least 16 when you create an account, and the waitlist is for people of 16 and over too. If you think a child under 16 has given us data, write to [email protected] and we will delete it.

11. How we protect your data

Passwords are stored only as bcrypt hashes. Connections to V-Forge are encrypted (HTTPS). Emails, tokens and AI text are removed from logs and error reports before they leave our server, and account IDs and IP addresses in them are hashed. Our database is not reachable from the internet, and only the operator has administrative access. No system is perfectly secure, but we work to keep yours safe.

12. Changes to this policy

When what we do with data changes, for example a new AI provider, we update this policy before the change takes effect and change the date at the top. If the change matters to you, we tell you by email or in the app.

See also the Imprint, Terms of Service and Cookie Policy.