AnyWorldAI

Privacy Policy

Effective: May 20, 2026

This Privacy Policy explains what data AnyWorld AI collects, how we use it, who we share it with, and your rights. Reach us any time at privacy@anyworldgame.com.

1. Data we collect

  • Account: email, country code, 18+ confirmation, date-of-birth-derived adult flag (the DOB itself is hashed; we store only the boolean).
  • Authentication: Google / Apple / Email magic-link, via Supabase Auth.
  • Gameplay: characters you create, worlds you save (private, never redistributed), chat messages, memory records.
  • Usage analytics: events like "world started", "turn completed", "subscription started" via PostHog. We send the event name, properties, and an internal user ID. No raw conversation content is sent to PostHog.
  • Per-call cost telemetry: input/output tokens and cost for every AI call, stored against your user ID, used only for our operational margin reporting.
  • Payments: handled by Razorpay; we receive a payment reference and amount, never your full card details.
  • Errors: exception traces via Sentry. We scrub email/PII from error payloads before sending.

2. How we use your data

  • Operate the Service (run your turns, save your characters, restore them across devices).
  • Process payments and provide billing receipts (via Razorpay).
  • Send transactional emails (login links, receipts, renewal reminders) via Resend.
  • Apply rate limits and enforce subscription tiers.
  • Improve the product (aggregated usage analytics in PostHog).
  • Detect abuse, fraud, and breaches of our Terms.
  • Comply with legal obligations.

3. What we don't do

  • Sell your personal data.
  • Share your custom worlds publicly. There is no "community feed" of custom worlds and there never will be.
  • Use your gameplay or custom-world content to train third-party AI models.
  • Show third-party ads.

4. Subprocessors

We share minimum-necessary data with these vendors:

  • Supabase, database, auth, storage (US region by default).
  • Vercel, hosting and edge compute.
  • OpenRouter, routes AI calls to inference providers (DeepSeek, Google, etc.). They handle the prompt+response in transit; per OpenRouter's policy this data is not retained for training.
  • Razorpay, payments processing.
  • Resend, transactional email.
  • PostHog, product analytics.
  • Sentry, error monitoring.

5. Where your data lives

Primary storage is in Supabase (US region). Backups inherit the same region. AI inference calls are routed through OpenRouter and may be processed by their inference providers in various regions. Payments data is processed by Razorpay, primarily in India.

6. International transfers

If you access the Service from outside the US, your data is transferred to and processed in the US (Supabase region) and potentially other regions via our subprocessors. We rely on Standard Contractual Clauses and our subprocessors' certifications where applicable.

7. Retention

Account data: retained while your account is active. After account deletion, all personal data is removed within 30 days. Backups retain residual data up to 60 days. Anonymized aggregate analytics may be retained indefinitely.

8. Your rights

Depending on where you live, you may have rights to access, correct, delete, port, or restrict our processing of your personal data. To exercise these rights, email privacy@anyworldgame.com. We respond within 30 days (usually within 7).

9. Children

The Service is for users 18+. We don't knowingly collect data from anyone under 18. If you believe we have, email privacy@anyworldgame.com and we will delete it immediately.

10. Cookies

We use first-party cookies for authentication (Supabase session) and a small number of analytics cookies set by PostHog. We don't use third-party advertising cookies. You can clear cookies any time from your browser; this will sign you out.

11. Security

We use industry standards: HTTPS everywhere, row-level security on all database tables, scoped service-role keys, encrypted backups. No system is perfect; if we discover a breach affecting your data, we will notify you and applicable regulators within 72 hours where legally required.

12. Changes

Material changes to this Policy will be announced via email at least 14 days before the effective date. The latest version is always live at this URL.

13. Contact

Email privacy@anyworldgame.com for any privacy question.