Privacy Policy

Ludoflow (ludoflow.space) is an AI game builder: you describe a game in plain words, and an AI agent builds a playable browser game for you. Ludoflow is run by Oxodonia LTD ("we", "us"). This policy explains what personal data we collect when you use our website and apps, why we collect it, who we share it with, and the choices you have.

Oxodonia LTD is the data controller for the personal data described here. Questions go to contact@ludoflow.space.

1. What we collect

• Account details: your name, email address, profile picture, and the organizations (teams) you belong to.
• What you create: the prompts you write, your chat history with the agent, your answers to its questions, the game code and pictures it makes, and any images or files you upload.
• Billing records: your plan, top-ups, and the credits granted and spent, with dates.
• Payment details: processed by Stripe. We never see or store your full card number.
• Technical data: IP address, device and browser type, pages visited, and error reports when something breaks.
• Referral data:if you arrive through a partner's referral link, which partner referred you.
• Advertising data: only if you accept marketing cookies, the Meta Pixel records which of our pages you visit and actions such as signing up or starting a plan. See section 7.

2. How we use it

• To create your account and sign you in.
• To build, run, save and show you your games.
• To charge you correctly and keep track of your credits.
• To pay commission to the partner who referred you, if any.
• If you accept marketing cookies, to measure whether our ads work and to show Ludoflow ads to people who have visited our website.
• To find and fix bugs, and to keep the service secure and prevent abuse.
• To answer you when you contact us, and to send important notices about your account, billing or these policies.

We do not sell your personal data. We do not use your prompts, games or uploads to train AI models, and the AI providers we use do not train on data sent through their business APIs.

3. Information we receive from Google

You can sign in to Ludoflow with your Google account. If you do, Google shares the following with us, and only after you agree on Google's consent screen:

• your name,
• your email address, and
• your profile picture.

We request only the basic openid, email and profile permissions. We do not ask for access to your Gmail, Google Drive, contacts, calendar, or any other Google data.

How we use it: only to create your Ludoflow account, sign you in, show your name and picture inside the app, and contact you about your account.

How we store and protect it: it is stored by our sign-in provider, Clerk, and in our database, encrypted in transit and at rest, and accessible only to the systems that need it to run your account.

Who we share it with: nobody, except Clerk, which processes sign-in on our behalf. We never sell Google user data, never use it for advertising, and never use it to develop, improve or train AI or machine learning models. We never send information received from Google to Meta or to any other advertising company, including through the Meta Pixel.

Ludoflow's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Removing access:you can revoke Ludoflow's access at any time from your Google account permissions page. To delete the data itself, delete your account in Ludoflow, or email us.

4. Who we share data with

We use trusted companies to run Ludoflow. Each gets only the data it needs to do its job, under a contract that limits what it can do with it:

• Clerk: accounts, sign-in and organizations.
• Stripe: subscriptions, top-ups and payment processing.
• Anthropic and OpenAI: the AI models that read your prompts, write game code, and draw game pictures.
• Daytona: the cloud sandboxes where your games are built and run.
• Trigger.dev: runs the AI agent in the background.
• Neon: our database.
• Railway: hosts the website.
• Sentry: error reports, including a short recording of the page only when an error happens.
• Endorsely: tracks partner referrals so we can pay commissions.
• Meta Platforms: the Meta Pixel, only if you accept marketing cookies. See section 7.

Some of these companies store data outside your country, including in the United States. Where the law requires it, transfers are protected by standard contractual clauses or an equivalent safeguard. We may also share data if the law requires it, or to protect our users and service from fraud or abuse.

5. Games you share

Games are private by default. If you make a game public or share its link, anyone with that link can play it and see its title and picture. You can make it private again at any time.

6. Cookies

We use three kinds of cookies:

• Essential cookies keep you signed in and keep the service secure. The website cannot work without them, so they are always on.
• Referral cookiesrecord which partner sent you, if you arrived through a partner's link, so they can be credited.
• Marketing cookies are used by the Meta Pixel. They are off until you accept them, and you can change your choice at any time.

7. Meta Pixel and advertising

We advertise Ludoflow on Facebook and Instagram. To learn whether those ads work, we use the Meta Pixel, a small piece of code from Meta Platforms Ireland Ltd and Meta Platforms, Inc. ("Meta").

It only runs if you accept marketing cookies. If you decline, or make no choice, the Meta Pixel does not load and nothing is sent to Meta.

If you accept, the Meta Pixel sends Meta:

• the pages of our website you visit,
• actions you take, such as signing up or buying a plan or credits, and the value of a purchase,
• technical details: your IP address, browser and device type, and cookie identifiers,
• the Meta cookie or click identifier, if you came from a Facebook or Instagram ad.

We do not send Meta your name, email address, prompts, games, uploads, or any information we received from Google.

We use this to:

• count how many sign-ups and sales came from each ad,
• stop paying for ads that do not work, and
• show Ludoflow ads to people who have already visited our website, and to people similar to them.

Meta may link this information to your Facebook or Instagram account, and uses it under its own Privacy Policy. For the collection and sending of this data we and Meta are joint controllers; for everything Meta does afterwards, Meta alone is responsible.

Your choices: decline or withdraw marketing cookies with the cookie settings link at the bottom of our website. You can also control the ads Meta shows you in your Meta ad preferences. We do not store the data the Meta Pixel collects; Meta keeps it under its own retention rules.

8. How long we keep it

We keep your data while your account is active. If you delete your account or ask us to, we delete your personal data and your games within 30 days. We keep billing and tax records for as long as the law requires, and error reports for no more than 90 days.

9. Your rights

Depending on where you live, you may have the right to see, correct, download or delete your data, to object to or limit how we use it, and to withdraw consent. You can delete your account yourself from the app, or email us to use any of these rights. We reply within 30 days. You can also complain to your local data protection authority.

10. Security

Data is encrypted in transit and at rest. Every game runs in its own isolated sandbox that cannot reach other users' games. Access to production systems is limited to the people who need it. No system is perfectly secure, and we will tell you promptly if a breach affects your data.

11. Children

Ludoflow is not meant for children under 13. We do not knowingly collect data from them. If you think a child has given us personal data, contact us and we will delete it.

12. Changes

We may update this policy. We will change the date at the top, and tell you about important changes before they take effect.

13. Contact

Oxodonia LTD
Email: contact@ludoflow.space