Privacy Policy
Draft pending legal review. This is not formal legal advice and is not a substitute for counsel.
Version 2026-10-13-draft.
Guest progress and scores are saved anonymously but cannot be recovered. An account stores cloud saves, identities, votes, and reputation history. You can download or delete that data from Account. Iterkai is in beta, so stored data may be reset while the product is still changing.
Lawful bases (GDPR)
- Contract — creating an account, cloud saves, reputation, voting, and developer tools.
- Legitimate interests — security, fraud and sybil resistance, geo-blocking sanctioned networks, and keeping governance tallies consistent after deletion.
- Consent — non-essential cookies and personalised ads. Guests never receive personalised ads.
- Legal obligation — sanctions screening and responding to lawful requests.
Your rights
You can access and export your personal data, correct your display name, withdraw ads consent, and delete your account from Account. Those controls are the product wiring for GDPR access, portability, and erasure. You may also object to legitimate-interest processing or complain to a supervisory authority.
Personal-data export
The export JSON includes email, identities, session history, play activity, scores, reputation history, votes, comments, date of birth, terms version, and cookie-ads consent. Saves appear only as a summary (which games, last updated). Raw save files are never exported.
Account deletion
Deletion removes saves, sessions, and identities. Votes and reputation history stay on an anonymized “Deleted player” so governance tallies stay consistent. Locked reputation runs to the end of its 90-day lock and then remains on that anonymized record. Proposal, challenge, and fork holds still resolve through the existing tick.
Retention
Sessions last 14 days or until logout. Verification and reset hashes expire in hours. Audit logs and anonymized reputation and vote rows are kept for the life of the governance record. Beta resets can remove them sooner.
Contact
Privacy requests that Account does not cover: support3@iterkai.com. See also Help.
Processors
Depending on configuration: Vercel (hosting), Neon (Postgres), Upstash (Redis), Resend, Cloudflare (Turnstile, DNS, and object storage for game builds), Sentry (error reports), Google (sign-in, optional ads), Telegram, Discord, and ipinfo.io (optional geo lookup). We do not sell personal data. Error reports are scrubbed of email addresses and IP addresses before they are sent.
Saves
Cloud saves are written only by the authenticated Iterkai SDK during a play session. There is no save-file upload and no save-file download.
Children
We do not knowingly create accounts for children under 13 (COPPA). Guest play does not collect a name, email, or persistent profile beyond a device cookie needed to run the session.