Contents
- Information We Collect
- How We Use Information
- How We Share Information
- Cookies and Similar Technologies
- How Long We Keep Information
- Security
- International Data Transfers
- Your Choices and Rights
- Notice to California Residents
- Users in the European Economic Area, the United Kingdom, and Switzerland
- Children
- Third-Party Services
- Changes to This Privacy Policy
- Contact Us
This Privacy Policy explains how WASD Engine (“WASD Engine,” “we,” “us,” or “our”) collects, uses, shares, and protects information about you when you use our websites, including wasdengine.com and its subdomains, your WASD Engine account, the WASD Engine desktop application and other software we distribute, our hosted AI features and model gateway, the pages where people play the games released with WASD Engine, and our other services (together, the “Services”), and the choices and rights you may have. Capitalized terms that this policy does not define have the meanings given in our Terms of Service.
By using the Services, you acknowledge that we will handle your information as this Privacy Policy describes. If you do not agree, do not use the Services.
1. Information We Collect
Information you give us
- Account information: your email address and password when you create an account. We store your password only as a salted one-way hash, never in readable form.
- Account status: for example, whether you have confirmed your email address and whether your account is on our waitlist or approved.
- Communications: the contents of emails and other messages you send us, and the contact details they come from.
- Payment information: if you buy a paid plan, our payment processor, Stripe, collects your payment card or other payment details. We do not receive or store full card numbers; we receive limited information, such as your name, billing address, card type and last four digits, your plan, and your transaction history.
- Feedback: suggestions and bug reports you send us. The Feedback item in the desktop app opens the new-issue page of our public GitHub repository in your browser, with your account ID, app version, and a description of your device and screen in the link, so GitHub receives them. Anything you post there is public and is handled by GitHub under its own privacy statement.
- Games you release: when you release a game, the web build of the game (its code, art, sound, and other files), its title, description, cover image, and release notes, and each version’s number, size, and release date. Games you release are public; see How We Share Information.
- Comments and votes: the comments and replies you post on game pages, with the version of the game you were looking at and when you posted them, and your votes on comments.
- Display name: the name you choose to show with your games and comments. Until you choose one, we show a generic name, such as “Player,” instead; we never show your email address.
Content you send to our hosted AI features
When you use the built-in AI of the desktop app, an API token, or our web tools, your agent’s requests to our model gateway contain whatever the agent puts in them. That can include your prompts and instructions, the conversation so far, code, the contents of files and folders the agent reads, images, the results of commands and tools it runs, web search queries, and the addresses of pages to fetch (“AI Request Content”), and the model’s responses come back the same way. AI Request Content can contain personal information about you or others if you or your agent include it.
Our gateway relays AI Request Content and responses between your device and our model provider. It does not save them to our databases or logs, although they pass through our servers’ memory while each request is handled.
Information we collect automatically
- Usage records: for each request to our model gateway and web tools, your account ID, the token that made it, the route and model, the response status and any error type, the numbers of input, cached, and output tokens, the duration, request identifiers, and the time.
- Sign-in and security records: the tokens that keep you signed in, which we store only as one-way hashes, with their names, which can include your computer’s model (for example, “WASD Engine desktop (MacBookPro18,3)”), and when they were created, last used, and expire; the one-time links we email you to confirm your address, which we also store only as one-way hashes, with the address each was sent to and when it was sent and used; details of desktop sign-in requests, such as their language, platform, and status; and failed sign-in attempts and lockouts.
- Device and connection information: your IP address and the technical information browsers and apps send with requests. We use IP addresses to limit repeated sign-in and sign-up attempts, and our hosting provider processes them to deliver and protect the Services. Our server logs record account IDs, routes, statuses, durations, and request identifiers, and for each game release, the game, its version, and the size of its build.
- Browser storage: see Cookies and Similar Technologies.
The desktop app, as we distribute it, does not send us analytics, telemetry, or crash reports; crash reports stay on your computer unless you choose to share them. The app contacts our servers to sign you in and check your account while you are signed in, to use the hosted AI features, and to open account pages such as Usage. It may also download components, such as game-tool runtimes and software packages, from third-party sources such as GitHub and package registries, which receive your IP address and request details under their own policies.
Information from other sources
We may receive information about you from service providers, such as our payment processor (payment status) and our email provider (whether our messages were delivered, bounced, or marked as spam), and from public sources, such as your activity on our public GitHub repository.
What stays on your computer
The desktop app keeps your game projects, files, conversation history, settings, and agent configuration on your computer, and the game tools it runs (Godot, Blender, GIMP, and SuperCollider) run there too. We do not receive this information unless you or your agent send it to our hosted Services, for example as AI Request Content or by releasing a game. The Model Context Protocol (MCP) server that lets other AI agents use WASD Engine’s tools listens only on your computer; those agents send what they process to their own providers under those providers’ terms, not to us.
2. How We Use Information
We use information to:
- provide, operate, and maintain the Services, including creating and securing your account, signing you in on the web and in the desktop app, relaying requests to AI models and web tools, and showing you your usage;
- publish the games you release and the comments you post, list released games on our Explore page, and show your display name with them;
- measure usage, enforce usage limits and plan entitlements, and process payments;
- manage access to the Services, including email confirmation and our waitlist;
- communicate with you, including by sending service messages, such as email confirmations, access approvals, security alerts, and notices of changes to our terms and policies, and by responding to your requests;
- protect the Services and our users, including by detecting, investigating, and preventing fraud, abuse, security incidents, and violations of our Terms, and by limiting repeated sign-in attempts;
- understand and improve the Services, including by analyzing usage records and aggregate statistics, such as sign-ups, usage, and retention, by debugging, and by developing new features;
- comply with law, legal process, and requests from authorities, and establish, exercise, or defend legal claims;
- carry out a merger, acquisition, financing, reorganization, or other business transfer; and
- do anything else we describe when we collect the information, or that you consent to.
We do not currently use AI Request Content or model responses to train AI models. We do not make decisions about you that produce legal or similarly significant effects based solely on automated processing.
We may create aggregated or de-identified information that no longer identifies you and use or share it for any lawful purpose. When we do, we keep it in de-identified form and do not attempt to re-identify it, except as the law permits.
4. Cookies and Similar Technologies
Our website uses no advertising cookies and no third-party analytics, and it loads no content from other companies’ servers. It uses your browser’s local storage and session storage, which work like cookies, only to run the site: to keep you signed in (with a session token that you can revoke on your account page), to remember whether you prefer light or dark appearance, and to connect an open page to our server. You can clear this storage in your browser’s settings; doing so signs you out.
Games that people release run on their game pages in a separate, isolated frame that cannot read our website’s storage or your sign-in. A game is its creator’s content, not ours: it may contact servers its creator chose, which then receive your IP address and whatever the game sends them, under their own policies.
Some browsers send “Do Not Track” or Global Privacy Control signals. Because we do not sell personal information, share it for targeted advertising, or track you across other websites, these signals have nothing to turn off; where the law requires, we treat Global Privacy Control as a request to opt out of sales and sharing.
If we start using analytics or other non-essential cookies, we will update this Privacy Policy first and ask for your consent where the law requires.
5. How Long We Keep Information
We keep information for as long as we need it for the purposes this Privacy Policy describes, including to provide the Services, comply with our legal obligations, resolve disputes, prevent abuse, and enforce our agreements. In particular:
- Account information, usage records, display names, and votes are kept while your account exists. After your account closes, we take down the games it released and delete or de-identify its information, including its comments, within a reasonable time, except what we need to keep to comply with law, resolve disputes, prevent fraud or abuse, or enforce our Terms.
- Released games stay published until they are taken down, at your request or under our Terms. Taking a game down deletes its builds and cover image from our storage; we keep its record, such as its title, description, and release history.
- Comments stay on a game’s page until you or the game’s creator delete them. Deleting a comment erases its text; we keep a record that it existed, with its author, time, and votes, so that replies keep their place.
- AI Request Content is not kept by our gateway after a request completes. Our model provider keeps it as its own policies provide.
- Server logs are generally kept for up to 30 days.
- Counters of sign-in and sign-up attempts by IP address are kept only as long as rate limiting needs them and are deleted periodically.
- Database backups are generally kept for up to 7 days, after which information deleted from our database is gone from them too.
- Communications are kept as long as we need them to respond and to keep records of our correspondence.
6. Security
We use reasonable administrative, technical, and physical safeguards designed to protect information, including encryption in transit, one-way hashing of passwords and tokens, encryption of our database at rest, and access controls. No method of transmitting or storing information is completely secure, however, and we cannot guarantee the security of any information. You are responsible for keeping your password, tokens, and devices secure, and for the files and secrets you let AI agents access. If we learn of a security breach that affects your personal information, we will notify you as the law requires.
7. International Data Transfers
Our servers are in the United States, and our model provider, DeepSeek, processes AI Request Content in the People’s Republic of China. If you use the Services from elsewhere, your information will be transferred to, stored in, and processed in those countries. Their data protection laws may differ from, and be less protective than, the laws where you live, and their authorities may be able to obtain access to information under their own laws. Where the law requires a legal basis for these transfers, we rely on their being necessary to provide the Services you ask for, on your consent, or on another mechanism the law allows.
8. Your Choices and Rights
Account controls. Your account page shows your email address, sign-ins, API tokens, and usage, and lets you revoke tokens and sign out. To change your email address or close your account, contact us from the email address on your account. On a game’s page you can change your display name and delete your comments. To take down a game you released, contact us.
Privacy rights. Depending on where you live, and subject to the exceptions in the law, you may have the right to know about and access the personal information we hold about you; to receive a copy of it in a portable format; to correct it; to delete it; to object to or restrict certain processing; to withdraw consent where we rely on it; and to opt out of the sale or sharing of personal information, targeted advertising, and profiling with legal or similarly significant effects, none of which we do. We will not discriminate against you for exercising these rights.
Making a request. Email us at contact@wasdengine.com, from the email address on your account if you have one. We will verify your request, for example by confirming that you control that address, and we may ask for more information to do so. Where the law allows, you may use an authorized agent; we may require proof of the agent’s authority and verify your identity directly. We will respond within the time the law requires. We may decline a request where the law permits, for example when we cannot verify it or an exception applies, and we may keep some information as described in How Long We Keep Information.
Appeals. If we decline your request, you may appeal by replying to our decision. If we deny your appeal, you may contact your state attorney general or your data protection authority.
Marketing. If we send you marketing emails, you can unsubscribe with the link in them. We will still send you service messages.
9. Notice to California Residents
Where the California Consumer Privacy Act (CCPA) applies, this section adds to the rest of this Privacy Policy. We collect these categories of personal information:
- identifiers, such as your email address, account ID, IP address, tokens, and display name;
- customer records, such as your email address and, if you buy a paid plan, billing information;
- commercial information, such as your plan and purchases;
- internet or other electronic network activity, such as usage records, sign-in records, and server logs;
- sensitive personal information, namely your account sign-in credentials (your email address with your password); and
- other information you provide, such as AI Request Content, the games you release, your comments, and your messages to us, which may include any kind of personal information you or your agent put in them.
We collect this information from you, from your devices, and from our service providers, for the purposes described in How We Use Information, and we disclose each category for business purposes to the recipients described in How We Share Information. We do not sell or share personal information, as the CCPA defines those terms, and we have no actual knowledge of selling or sharing the personal information of anyone under 16. We use sensitive personal information only to provide the Services and for other purposes the CCPA permits, so the right to limit its use does not apply. We keep each category for the periods described in How Long We Keep Information. We do not disclose personal information to third parties for their own direct marketing purposes.
10. Users in the European Economic Area, the United Kingdom, and Switzerland
If you are in the European Economic Area, the United Kingdom, or Switzerland, WASD Engine is the controller of your personal information. We process it on these legal bases: to perform our contract with you, by providing the Services and your account; our legitimate interests in operating, securing, and improving the Services and preventing abuse, which we balance against your rights; to comply with legal obligations; and your consent, where we ask for it, which you may withdraw at any time. You have the rights described in Your Choices and Rights, and you may also lodge a complaint with your local data protection authority.
11. Children
The Services are only for people 18 and older and are not directed to children. We do not knowingly collect personal information from anyone under 18. If we learn that we have, we will delete it and close the account. If you believe a minor has given us information, contact us at contact@wasdengine.com.
12. Third-Party Services
The Services link to and work with services we do not control, such as DeepSeek, GitHub, the AI agents you connect to WASD Engine, and payment processors. Their own privacy policies, not this one, govern how they handle your information, and we are not responsible for them.
13. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will post the updated version here and change the “Last updated” date. If we make material changes, we will notify you by email or through the Services before they take effect, and we will ask for your consent where the law requires. If you keep using the Services after an update takes effect, you acknowledge the updated Privacy Policy.
14. Contact Us
For questions or requests about this Privacy Policy or your information, email us at contact@wasdengine.com.