Privacy Policy

What we collect

Your account. Your email address. If you sign in with Google, also your name and profile picture. Your creator name is the name shown as the creator on your published games. A new account starts with a neutral one (such as creator-1a2b3c4d) that is not taken from your email address, and you choose your own. Accounts created before this change may still have a creator name made from the first part of the email address (before the @), until their owner picks a new one.

What you make. The descriptions and chat messages you write, files you upload (images, audio, documents), the games the AI builds for you and their versions, your settings, covers, and publishing details.

Payments. Stripe handles your card. Looti keeps your plan, subscription status and billing dates, your Stripe customer ID, and the invoices and payment events Stripe sends us. We never see or store your full card number.

Credits and usage. Your credit balance and its history, and a record of each AI run (what ran, how long it took, what it cost, whether it failed). We use it to charge correctly, to help you, and to keep Looti reliable.

Technical data. Your IP address, browser and device type, and the pages you open, in server logs and in the services listed below. To limit abuse and to count plays, we store a salted one-way hash of your IP address, not the address itself.

Analytics and errors. When it is turned on, PostHog counts what happens in Looti: page views, sign-ups, a first game created, a game published, a game played. It knows you by your internal account ID, not your email, and it does not record your screen. Sentry receives error reports (what broke and in which page) so we can fix it.

Waitlist and reports. If you join the waitlist: your email, an optional name, your invite code and a hash of your IP address. If you use the report form: your name, your email, the game address and what you write, plus a hash of your IP address.

Accounts you connect. If you connect another account, for example GitHub or your own Cloudflare account, to export or publish a game, we store the access we need to act for you, in encrypted form. You can disconnect it at any time.

Messages to us. What you write when you email us.

How we use it

• To run Looti: sign you in, build and keep your games, publish them, and show them to players.
• To take payments, give you the credits you paid for, and keep billing records.
• To keep Looti safe: stop abuse and fraud, apply limits, and review reports.
• To help you and to send service emails, such as sign-in links and notices about your account or plan.
• To understand how Looti is used and to make it better.
• To follow the law.

We don’t sell your personal information. If we add ads to games, we will update this policy first. [PABLO: if you will send marketing or product-update emails, say so here and add an opt-out]

AI and your games

To build and change your game, Looti sends what you wrote, the files you attached and your game’s code to AI model providers (Anthropic and others, through the Vercel AI Gateway). The code is built and previewed in a temporary sandbox run by E2B. These companies process the information to give us the result.

[PABLO: confirm whether the AI providers’ terms exclude training on our data, and say so here]

Who we share it with

We use these companies to run Looti. Each gets only what it needs for its job:

• Supabase: your account, sign-in and our database.
• Vercel: hosting the website and the app, and the gateway to the AI models.
• Cloudflare: storing and delivering published games and files.
• Stripe: payments and subscriptions.
• E2B: the temporary sandbox where a game is built and previewed.
• AI model providers: Anthropic and others, reached through the Vercel AI Gateway, to build and change your game.
• Resend: sending email: sign-in links and service messages.
• PostHog: product analytics, if it is turned on.
• Sentry: error reports, so we can fix what breaks.

Published games are public. Anyone with the link can open a game and see its title, description, cover, play count and the creator name. Don’t put personal information in a game.

We may also share information when the law requires it, to protect people’s safety or Looti’s rights, to pass a copyright notice on to the creator of a game, or if Looti is part of a sale or merger.

Cookies and similar tools

• Your sign-in session is kept in cookies. Without them you can’t stay signed in.
• People who play a game get a cookie with a random ID, kept for up to a year, so a visitor who plays twice counts once.
• If you arrive from a campaign link, we remember which campaign for 30 days (a cookie and a copy in your browser) and save it with your account if you sign up.
• Your light or dark choice is saved in your browser.
• Our analytics (PostHog), when it is on, sets no cookie and writes nothing to your browser: it keeps what it needs only in the page’s memory.

We don’t use advertising cookies today. You can block cookies in your browser, but parts of Looti will stop working.

How long we keep it

We keep your account and your games until you delete them or ask us to delete your account. We keep payment and tax records for as long as the law requires.

[PABLO: retention periods for logs, run records, hashed IPs and reports, and how long a deleted game stays in backups]

Your choices and rights

You can delete a game, disconnect an account you connected, and cancel your plan yourself. For anything else, such as deleting your account, write to support@getlooti.com.

Depending on where you live (for example the EU, the UK or California), you may have the right to see, correct, delete or get a copy of your personal information, to object to or limit some uses, and to withdraw consent you gave. Write to us to use any of these. We may need to check that it is you, and we answer within the time the law requires. You can also complain to your local data protection authority. We won’t treat you worse for using your rights.

Where your information goes

Looti and the companies above process information in the United States and other countries. [PABLO: the region of the Supabase project and of the other providers, and the safeguards used for transfers (for example standard contractual clauses)]

Security

We use encrypted connections and access rules so that people can only read their own information. No system is perfectly secure, so we can’t promise absolute safety.

Children

Looti is not for anyone under [PABLO: minimum age to use Looti (13 is the usual floor in the US, 16 in parts of Europe)]. If you think a child has given us personal information, write to support@getlooti.com and we will delete it.

Changes to this policy

We will post any update here with a new date, and tell you about important changes (for example by email or in the app) before they take effect.

Contact

Privacy questions and requests: support@getlooti.com. Our Terms of Use explain the rest of how Looti works.