Privacy Policy

1. Who we are

Maniacs Games ("we", "us") operates Maniacs, a platform for creating short interactive games from a written brief. We are the data controller for the personal data described in this policy.

For any privacy question or request, write to legal@maniacsengine.com.

2. What this policy covers

This policy covers every part of the service you can reach:

• The marketing website, including the contact, partnership, event and waiting list forms
• Your Maniacs account and the workspace where you create games
• Games you publish and the people who play them
• Email we send you, such as verification, activation and sharing messages

3. Data we collect

We collect data to operate, improve and secure Maniacs. It falls into the following categories.

Account data. Your name, email address, and password or Google sign-in identifier. If you sign in with Google we receive your name, email address and profile picture from Google, never your Google password.

Content you create. The briefs and messages you send to the AI, the conversations they belong to, the games generated from them, and every saved version of those games.

Contacts you add. Names and email addresses you enter in order to share a game. Please only add people who expect to hear from you.

Play data. When someone plays a published game we record the session result, such as score, completion and duration, along with a play count. Players do not need an account, and we do not ask them for their name or email.

Form submissions. When you use the waiting list, contact, partnership or event forms we collect what you type into them, typically your name, email address, company, and a short description of what you want to build or what is blocking you.

Technical data. Our hosting provider records standard server logs, including IP address, browser and device type, and timestamps, for security and performance.

4. Cookies and analytics

We use a small number of cookies and similar technologies. They fall into two groups, and you control the second one.

• Necessary. Set so the site works at all, and always active. These include a session cookie that keeps you signed in and a language cookie (NEXT_LOCALE) that remembers whether you are reading in English or Turkish. We also store your cookie choice itself in your browser so we do not have to ask again.
• Analytics. Set only if you accept them. We use Google Tag Manager and Vercel Analytics to understand which pages and features are used, how the site performs, and where people drop out of a flow.

Analytics does not load until you accept it. You can change your mind at any time using the "Cookie preferences" link in the footer of every page.

We do not use advertising cookies, and we do not allow third parties to track you across other websites.

5. How AI processing works

Creating a game sends your brief, the conversation it belongs to, and the current state of the game to Anthropic, the provider of the Claude models we use. Anthropic processes it in order to return the generated game and does not use it to train its models.

Please do not put personal data about other people, credentials, or confidential information into a brief. Anything you type becomes part of the conversation we store.

The AI does not make decisions that produce legal effects for you. Nothing about your account is decided automatically without a person involved.

6. Why we use it, and our legal basis

We process personal data for specific, clear purposes. Each has a lawful basis under GDPR:

• To provide the service, including account setup, authentication and generating your games. Basis: performance of a contract.
• To operate published games and report their results back to their owner. Basis: performance of a contract.
• To send transactional email such as verification, activation and game sharing. Basis: performance of a contract.
• To answer the forms you submit and follow up about early access or a partnership. Basis: consent, withdrawable at any time.
• To keep the platform secure through access control, logging and monitoring for abuse. Basis: legitimate interests.
• To understand and improve how the product is used. Basis: consent, through the analytics cookie choice above.
• To meet legal obligations such as record keeping and responding to lawful requests. Basis: legal obligation.

7. Who we share it with

We do not sell your personal data, and we do not share it for advertising.

We use a small number of service providers to run Maniacs. Each receives only the data needed for its function and is bound by a data processing agreement:

• Vercel - hosting, server logs, analytics and performance monitoring. See vercel.com/legal/privacy-policy
• Prisma Data Platform - the database that stores your account, projects, games and form submissions. See prisma.io/privacy
• Anthropic - processes briefs and game state to generate games. See anthropic.com/legal/privacy
• Resend - sends transactional email. See resend.com/legal/privacy-policy
• Google - optional sign-in with Google, and Google Tag Manager where you have accepted analytics. See policies.google.com/privacy

We also share data where the law requires it, for example in response to a valid legal request, or to establish or defend a legal claim.

If you publish a game, the game itself becomes publicly accessible to anyone with its link. Do not put personal data into a game you intend to publish.

8. International transfers

Our providers operate in the United States and other countries, so your data may be transferred outside the EU, the EEA and Turkiye.

Where GDPR requires it, these transfers are covered by the European Commission's Standard Contractual Clauses or another approved safeguard. For KVKK, transfers are made on the basis of your explicit consent or another lawful ground under Article 9.

9. How long we keep it

We keep data only as long as it serves the purpose it was collected for:

• Account data, for as long as your account is open, and up to 30 days after you delete it
• Projects, conversations and generated games, for as long as your account is open
• Published games, until you delete them or close your account
• Play results, for 24 months from the session
• Sharing contacts, until you remove them or close your account
• Form and waiting list submissions, for 18 months from your last contact with us
• Server logs, for up to 12 months

You can ask us to delete your data sooner. Deleting your account removes your projects, games and conversations. We may keep a minimal record where the law requires it.

10. Your rights

Under GDPR and KVKK you have the following rights over your personal data:

• Right of access. Request a copy of the personal data we hold about you.
• Right to rectification. Request correction of inaccurate or incomplete data.
• Right to erasure. Request deletion of your personal data where the law permits.
• Right to restrict processing. Request that we limit how we use your data.
• Right to data portability. Request your data in a portable format, or its transfer to another service.
• Right to object. Object to processing based on our legitimate interests, including analytics.
• Right to withdraw consent. Withdraw consent at any time, without affecting processing already carried out.
• Right to complain. Raise a complaint with a supervisory authority.

To exercise any of these, write to legal@maniacsengine.com. We respond to valid requests within one month, as GDPR requires, and free of charge.

11. Security

We protect data in transit with TLS encryption and store it in managed, access controlled infrastructure. Access to production data is limited to the team members who need it, passwords are stored hashed and never in plain text, and published games run in a sandboxed frame so a game cannot reach the rest of the platform.

No service can promise perfect security. If a breach affects your personal data we will notify you and the relevant supervisory authority as GDPR and KVKK require.

12. Children

Maniacs is not intended for anyone under 16, and we do not knowingly collect personal data from children. If you believe a child has given us their information, write to legal@maniacsengine.com and we will delete it.

Games published with Maniacs may be played by children in a classroom or similar setting. In that case the organisation running the session is responsible for any consent required, and we only receive the session result described in section 3.

13. Changes to this policy

We may update this policy as the product develops. The "Last updated" date at the top always reflects the most recent change, and we will tell account holders by email before a material change takes effect.

14. Contact us

For any question, concern or request about this policy, or to exercise the rights in section 10, write to legal@maniacsengine.com.

If you are in the European Union you may also complain to your national Data Protection Authority. If you are in Turkiye you may apply to the Personal Data Protection Authority (KVKK Kurumu).