Privacy Policy

1. Who we are

Playbaker is operated by TODO: legal entity name, a company registered in the Republic of Türkiye (MERSİS number: TODO: MERSİS number), with its registered office at TODO: registered address ("Playbaker", "we", "us"). We are the data controller (in Turkish law, the veri sorumlusu) for the personal data described in this policy, except where we say that another company acts as an independent controller.

• Privacy contact: TODO: privacy contact or data protection officer, [email protected]
• KEP address: TODO: KEP address
• VERBİS (Data Controllers' Registry): TODO: VERBİS registration number or exemption
• Representative in the EU: TODO: EU representative (Article 27 GDPR), or remove if not required
• Representative in the UK: TODO: UK representative (Article 27 UK GDPR), or remove if not required

2. What this policy covers

This policy applies to our website at playbaker.com, the Playbaker studio and the related services (the "Service"). It applies to visitors, people who create an account, and members of team workspaces. It sits alongside our Terms of Service. This policy does not cover the people who later see the ads you publish: the playables you export run on ad networks' platforms, under their own privacy policies.

3. Information we collect

Information you give us

• Account data: your name, email address and password. We store passwords only as a one-way hash, never in plain text. We also record whether your email address is verified, your settings, and the team workspaces you belong to. If a team admin invites you, they give us your email address.
• Google sign-in data: if you choose to sign in with Google, your name, email address, profile picture and Google account ID (see section 6).
• Project content: your prompts and chat messages, store links, screenshots, gameplay videos, artwork and other uploads, and everything the Service generates for you (code, images, audio, 3D models, builds, exports and version history). When you paste a store link, we fetch the public information on that store page, such as the game's name, description and screenshots. Uploads can contain personal data, for example a person's face in a screenshot.
• Communications: what you write to us by email or through support, and any feedback.

Information created when you use the Service

• Billing data: your plan, subscription status, renewal date and the Paddle identifiers for your customer record, subscription and transactions. Paddle collects your payment details, billing address and tax details directly; we never receive or store your full card number.
• Usage and credit ledger: the credits you receive and spend, which jobs used them, and when.
• Technical logs: IP address, browser user agent, request IDs, timestamps, pages and API endpoints requested, and error details. We use these for security, rate limiting and fixing problems.
• Bot protection signals: Cloudflare Turnstile checks signals from your browser to tell people from bots when you sign up or sign in.
• Cookies and local storage: see section 9.

You don't have to give us personal data, but we need your account data to create an account and provide the Service. We don't ask for special categories of personal data (such as health or religious data), and please don't upload them.

4. How we use it and our legal bases

We use personal data only for the purposes below. The table shows the legal basis we rely on under the EU and UK GDPR and under Article 5 of Türkiye's Law No. 6698 on the Protection of Personal Data (KVKK).

Where we rely on consent, you can withdraw it at any time, for example by using the unsubscribe link in an email. Withdrawing consent doesn't affect processing that already happened. Where we rely on legitimate interests, we have weighed them against your rights, and you can object (see section 12).

We don't make decisions about you based solely on automated processing that have legal or similarly significant effects. Automated security checks, such as bot protection or rate limits, can block a request; if that happens to you, contact us and a person will look at it.

5. How AI processing works

• To generate code, images, audio and 3D models, we send the relevant parts of your project content (prompts, uploads, store page information and project context) to AI providers: language models through OpenRouter, and image, audio and 3D models through fal.ai and the model providers they work with.
• We don't send your password, payment data or technical logs to AI providers. We don't deliberately send your name or email address, but anything you type into a prompt or include in an upload is sent as part of the request.
• We don't use your content to train our own AI models. AI providers process requests under their own terms. Where a provider offers a setting that stops it training on data sent through its API, we use it.
• We don't publish your content, for example in our showcase, without your permission.

6. Google user data

If you choose to sign in with Google, this section explains exactly what we receive and how we use it.

• What we access. We request only the basic sign-in scopes openid, email and profile. From Google we receive your name, email address, profile picture and Google account ID. We don't access your Gmail, Drive, Calendar, contacts or any other Google data.
• Why. We use this data only to create your Playbaker account, sign you in, and identify you in your account, for example by showing your name and picture. Your email address becomes your account email, which we use for the service emails described in section 4.
• How we store it. It is stored with your other account data on our servers in the EU and protected as described in section 11.
• What we don't do. We don't sell Google user data. We don't use it for advertising, and we don't use it to train or improve AI models, ours or anyone else's. We don't send it to AI providers. We share it only with the service providers that host and run the Service, as needed to provide it, or where the law requires. Our staff don't read it except with your permission, for security purposes, or to comply with the law.
• How to revoke access. You can remove Playbaker's access at any time on your Google account permissions page. This stops future sign-ins with Google, but doesn't delete the data we already have. If you need help signing in another way afterwards, contact us.
• How to delete it. Delete your account in your account settings or email [email protected]. We delete your Google user data with the rest of your account data within 30 days.

Playbaker's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Who we share it with

We don't sell your personal data, and we don't share it for advertising. We share it only with the recipients below. Processors act on our instructions under data processing terms. Independent controllers decide for themselves how to use the data, under their own privacy policies.

We may also share personal data:

• with members of your team workspace, who can see the content and member details of the workspace according to their roles;
• with professional advisers, such as lawyers, accountants and auditors, under confidentiality duties;
• with courts, regulators, law enforcement and other authorities when the law requires it, or to protect our rights, our users or the public;
• with a buyer or successor if we are involved in a merger, acquisition or sale of assets, under this policy or one at least as protective, and we will tell you before your data becomes subject to a different policy.

We may update the list of providers as the Service changes. We will update this page when we add a provider that processes personal data.

8. International transfers

We are based in Türkiye and our servers are in the EU, but some of our providers and their sub-processors are in other countries, including the United States. When personal data moves between countries, we protect it as the law requires:

• From the EU/EEA: we rely on an adequacy decision of the European Commission (for example the EU-US Data Privacy Framework, where the recipient is certified) or on the Standard Contractual Clauses.
• From the UK: we rely on UK adequacy regulations (including the UK Extension to the Data Privacy Framework) or on the International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses.
• From Türkiye: we rely on the safeguards in Article 9 of KVKK, such as the standard contracts published by the Personal Data Protection Board, notified to the Personal Data Protection Authority as required, or on another basis the law allows.

You can ask us for more information about these safeguards by emailing [email protected].

9. Cookies and similar technologies

We use only cookies and similar technologies that are needed to run the Service, plus a few preferences saved in your own browser. We don't use advertising cookies, cross-site tracking or third-party analytics. Because of this, we don't show a cookie banner. Our fonts are served from our own servers.

You can block or delete cookies in your browser settings, but you won't be able to sign in without the session cookie. If we ever want to use non-essential cookies, such as analytics, we will ask for your consent first where the law requires it and update this policy.

10. How long we keep data

We may keep data for longer if the law requires it, or if it is needed to establish, exercise or defend a legal claim. When data is no longer needed, we delete it or anonymise it so it can no longer identify you.

11. Security

• Data is encrypted in transit with TLS.
• Passwords are stored only as one-way hashes. Sessions use an HttpOnly cookie that page scripts can't read.
• Access to production systems and personal data is limited to the people who need it (least privilege).
• We use rate limits, bot protection and network protection against abuse and attacks.

No system is completely secure. If a personal data breach puts your rights at risk, we will notify the relevant authorities and you as the law requires. Please help by using a strong, unique password and keeping your email and Google account secure.

12. Your rights

Depending on where you live, you have some or all of these rights:

• Access: ask whether we process your personal data and get a copy of it.
• Correction: fix inaccurate or incomplete data. You can change most account details in your settings.
• Deletion: delete your account in your settings, or ask us to delete your data.
• Portability and export: download your playables from the studio (exporting needs a paid plan), and ask us for a copy of your personal data in a common machine-readable format.
• Objection and restriction: object to processing based on legitimate interests, or ask us to limit processing in some circumstances.
• Withdraw consent at any time, where we rely on consent.
• Complain to a data protection authority, for example the authority where you live or work in the EU/EEA, the Information Commissioner's Office in the UK, or the Personal Data Protection Board in Türkiye (see section 13). We'd appreciate the chance to help first.

To use your rights, email [email protected] from the email address on your account. We may need to confirm your identity before acting. We answer within the time the law sets (one month under the GDPR and UK GDPR, 30 days under KVKK, 45 days under US state laws; these can be extended in some cases, and we will tell you if so). Using your rights is normally free.

13. Notice for people in Türkiye (KVKK)

This section is our information notice under Article 10 of KVKK. The data controller is TODO: legal entity name, TODO: registered address. The data we process, the purposes, the legal bases (Article 5) and the recipients are set out in section 3, section 4 and section 7, and transfers abroad (Article 9) in section 8. We collect personal data electronically, through the website, the studio and email, by fully or partly automated means.

Under Article 11 of KVKK, you have the right to:

• learn whether your personal data is processed, and request information about it;
• learn the purpose of the processing and whether the data is used for that purpose;
• know the third parties in Türkiye or abroad to whom it is transferred;
• ask for incomplete or inaccurate data to be corrected;
• ask for your data to be deleted or destroyed under the conditions in Article 7 of KVKK;
• ask that third parties who received the data are told about such a correction, deletion or destruction;
• object to a result that is against you and that comes from analysing your data exclusively by automated systems;
• claim compensation if you suffer damage because your data was processed unlawfully.

You can apply to us in writing at TODO: registered address, through your KEP address, with a secure electronic or mobile signature, or by email to [email protected] from the email address registered with us, as set out in the Communiqué on the Procedures and Principles of Application to the Data Controller. We will answer free of charge within 30 days, unless the request involves a separate cost under the Board's tariff. If your application is rejected, our answer is unsatisfactory or we don't answer in time, you may complain to the Personal Data Protection Board (www.kvkk.gov.tr) within 30 days of our answer, and in any case within 60 days of your application.

14. Notice for US residents

This section applies to residents of California and other US states with comprehensive privacy laws, to the extent those laws apply to us.

• Categories we collect: identifiers (name, email address, IP address, account and Google account IDs); commercial information (plan, subscription and credit history); internet or other network activity (technical logs and use of the Service); audio, visual or similar information you upload (for example screenshots and video); and account log-in credentials, which are sensitive personal information that we use only to authenticate you. We don't draw inferences to build a profile about you.
• Sources: you, your use of the Service, Google (if you sign in with Google), Paddle (payment and subscription status) and your team admin (if you are invited).
• Purposes: the business purposes in section 4. We disclose personal information for these purposes to the service providers in section 7.
• No sale or sharing: we don't sell personal information or share it for cross-context behavioural advertising, and we haven't done so in the past 12 months. We have no actual knowledge of selling or sharing the personal information of anyone under 16. Because we don't sell or share, browser opt-out signals such as Global Privacy Control have nothing further to switch off.
• Retention: see section 10.
• Your rights: to know what we collect and how we use and disclose it, to access, correct and delete it, and to opt out of sale or sharing (which we don't do). We won't discriminate against you for using these rights. You can use an authorised agent, and we may ask the agent for proof of authority and verify your identity with you directly. If we refuse a request, you can appeal by replying to our answer, and if you are still unhappy, contact your state attorney general.

15. Children

The Service is not intended for children. You must be at least 16 to use it, and old enough to enter a contract where you live to buy a plan. We don't knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, contact us and we will delete it.

16. Changes to this policy

We may update this policy as the Service or the law changes. The "Last updated" date shows when it last changed. If a change is material, we will tell you by email or in the app before it takes effect, normally at least 30 days ahead, and ask for consent where the law requires it.

17. Contact us

For any privacy question or request, email [email protected] (privacy contact: TODO: privacy contact or data protection officer), or write to TODO: legal entity name, TODO: registered address.