Privacy policy

Teleplay turns a description of a game into a game you can play in your browser, at https://www.teleplay.ai. This page says what we keep to do that, why, who else handles it, what anyone can see, and what you can ask of us. Teleplay is a product of Electrica, Inc. Electrica, Inc., a Delaware corporation, at [address to be added]("Electrica", "we"), decides how your information is used: it is the "controller". Teleplay is not offered in the United Kingdom for now; accounts made there before keep everything this page says. For anything about your information, write to us at info@teleplay.ai.

What we keep

• Your account: your email address and the username you choose. Supabase, which runs our sign-in, keeps your password in hashed form; we never store it ourselves. It also records when the account was made and when it last signed in. If you sign in with Google or GitHub, we receive your name, email address and profile picture from them, and from GitHub your username too, and keep them with your account; we never see your Google or GitHub password. Google or GitHub learn that you used their account to sign in to Teleplay.
• The games you build: what you type to describe a game, the plan made from it, the game itself, your conversation with the studio and the changes you ask for there, with a note for each of how it was understood, what came of it and what it cost, which account built which game, when each new game and chat edit was started, to count the day's limits, and what building it cost us.
• How each game is built: once build records are switched on, separately from visitor analytics, the steps of building or changing a game, as the section on them below says.
• How you use the site: only as the section on visitor analytics below says: which parts of the site you open, roughly how long you are active, the games you load and how each play ends, your sign-ins and sign-outs, the buttons you press to sign up and to create, open and share games, when your builds start, finish or fail, the link that brought you here, and your browser, type of device and country.
• Plans and payments: your plan; if you buy Pro, Extreme or a promotion, the customer and subscription references Stripe gives us, the subscription's price, status and the period paid for, and your request to start at once with the time you made it; how many new games, studio edits and promotions you have used in the period; the credits each build and studio change took, what it cost us to make in the credits' own unit, and the gift credits a promo code gave you; which of your games you promoted and when; and, from the question asked before any payment page, only that you said you are 18 or over, or that you are under 18, with when you said it, never your age. We never receive or keep your card details.
• Remixes and saves: which game a remix was made from, whether a game's maker lets it be remixed, and the games you saved to your library.
• Promo codes: if you redeem a promo code, we record which code your account used and how much of it is left, with your email address in a standard form so that each address redeems one code, and delete that with your account.
• Feedback: if you send us feedback, your answers, with your account's username and email. If you ask us to keep you posted, the address you give for that.
• Contact: we use your account email to write to you about your account and, from time to time, to ask for your feedback on Teleplay and the games you build. We never send you advertising this way. You can opt out at any time. If you do, we record when, and keep that with your account so that we don't write to you for feedback again.
• Logs: for security and error detection we record IP address, browser details, request path and error details. We can access these records for 30 days and keep them no longer ourselves. Our host, Railway, may keep infrastructure logs longer under its own retention policy. Legal basis: legitimate interest (keeping the service secure). To limit password reset emails, sign-ins, sign-ups, password checks, privacy choices and visitor analytics' records, it also counts requests per network address, in memory only, for up to an hour.

In your browser

The site sets these cookies, all of them its own. Scripts on the page cannot read any of them.

There are no advertising cookies, and no tracking scripts or analytics from other companies. The site also keeps a few things in your browser's own storage, which stay on your device: the descriptions you have typed before, your saved progress and best scores in games, unsent studio messages, the description you are about to build while you sign in (in that tab, until the build starts), which finished build you have already been told about, which games you opened in the last minute, in each tab, so that a game opened twice is not counted as two plays, when you were last asked for feedback and when you last sent it, and display settings such as the theme, the library's layout, the sidebar and sound. While visitor analytics may record, it also keeps there which visit this browser is on, with your account's ID if you are signed in, and which of its tabs sends the records; declining removes them.

Visitor analytics

Teleplay records how its pages and games are used, to see what works and improve Teleplay. It records which parts of the site you open (the studio, the library, Discover, a game's page and so on, never a page's full address), when each visit starts and ends, and roughly how long you are active; your sign-ins and sign-outs; the games you load, when each is ready and when you start playing, roughly how long you play, and whether a play ends in a win, a loss or your leaving; these presses: Create, Make your own on a game's page, sending the sign-up form, submitting a description to be built (not its text), opening a game from Discover and sharing a game to Discover, and when a build of yours starts, finishes or fails, with the game's ID for a build, an opening and a share; the link that brought you here, on your first visit and your latest (the site it came from, without its page, the part of this site it led to, and the campaign tags in the link: utm_source, utm_medium, utm_campaign, utm_content and utm_term); and your browser and its version, operating system, type of device and country. A random code in the teleplay-visitor cookie lets one browser's visits be counted together.

When analytics is on, 3D games also report technical performance numbers (load time, frame rate, device type), never what you type or play.

It does not record the text you type, the contents of forms, your network address or anything that identifies your device itself, and it builds no advertising profile. It records the presses listed above; other clicks and keys only tell it that you are active, not what they were. We don't send visitor data to any other company's analytics or advertising service: it is kept in our own database (Supabase, below). From Google Search Console and Google Analytics, we only read aggregate reports about the site.

• If you are in the European Union, Iceland, Liechtenstein, Norway, the United Kingdom, Gibraltar, Jersey, Guernsey, the Isle of Man, Switzerland or Turkey, or we can't tell where you are, nothing is recorded unless you accept when we ask.
• Anywhere else, it records unless you decline.
• Wherever you are, if your browser sends Do Not Track or Global Privacy Control, nothing is recorded and no visitor cookie is set.
• You can change your answer at any time under Privacy choices, in the site's menu. Once you decline, nothing more is recorded from that browser, and its visitor cookie and what visitor analytics kept in your browser are deleted. Your answer is kept in the teleplay-consent cookie for 180 days; after that we ask again where we ask first, and elsewhere visits are recorded again until you decline again.
• If you are signed in, what is recorded is linked to your account, and so are this browser's earlier visits and the link it first came from. If your account is deleted, the records lose that link.
• To know whether to ask, our server looks up which country your network address is in, in a database it keeps itself: the IP to Country Lite database by DB-IP, used unchanged under the Creative Commons Attribution 4.0 licence (IP Geolocation by DB-IP). Your address is used for that lookup alone, in memory, and is not stored or logged; only the country is kept, with the records above, and only when they are recorded.
• The records are deleted after 90 days (a browser's own, 90 days after its last visit). Daily totals made from them, with no account, browser or game in them, are kept for 13 months. What was recorded before you declined stays until then, unless you ask us to delete it sooner.

How games are built

A game is built by our AI from what you asked for: it writes the game's code itself, or, for older games, called the engine's own tools. The AI may write a game's code itself, the whole game or a part of it. That code runs only inside the game's sealed frame, with no access to your account, cookies or the network, and it is checked before the game is published.

Build records are switched on separately from visitor analytics. Once they are, each step of building or changing a game is recorded: which AI model and provider did it, when it started and how long it took, whether it was retried or failed and with what error, the tokens it used and what it cost; an error message can include part of what you typed. They are recorded against the game, which links them to the account that built it. We need them to run Teleplay, find what fails and keep its costs in hand, so they are part of providing the service: your answer about visitor analytics neither starts nor stops them. They are deleted after 90 days; daily totals made from them, with no account or game in them, are kept for 13 months.

AI, and what it keeps

We do not sell personal data, and we do not use your prompts, games or messages to train AI models. What you type, the plan made from it and the changes you ask for are sent to the AI services below to build and change your game, and nothing else. Under the terms we use them on, Anthropic, Microsoft and TypeSafe don't train their models on it either. Some keep it for a while, as each entry below says: Anthropic for up to 30 days, longer when it must for its usage policy or by law; Microsoft a short cache for the next request of the same game, and anything it flags as possible misuse, for review; TypeSafe nothing once it has answered. ElevenLabs, which is not switched on, would receive only short descriptions of a game's sounds; we will say what it keeps before it is.

What Teleplay itself keeps of what you made: the game, its plan and its code, with the history of its versions and your studio conversation, for as long as the game exists; the records of how it was built, for 90 days; and error records, also for 90 days. An error message can include part of what you typed.

Why we use it

• To run your account, and to build, show and keep your games, including sending what you type to the AI services below and showing ready games on Discover. That is the service you asked for.
• To keep Teleplay working, safe and affordable: the limits (3 new games and 3 chat edits per account in any 24 hours), the daily budget, error records, the records of how games are built, and stopping abuse.
• To see how Teleplay is used and improve it: visitor analytics, only where and when it may record.
• To read your feedback and improve Teleplay, and to write to you: about your account, and with news if you asked us to keep you posted.
• To ask the people who build games for their feedback, by email, so we can improve Teleplay.
• To improve Teleplay from what you ask in the studio: the team reads the requests made in the studio chat, and what came of each, to see what people ask for that Teleplay can't do yet and decide what to add next. We don't use them to train AI models.
• To meet legal obligations, and to establish or defend legal claims.

We don't use your information for advertising, we don't sell it, and we don't make decisions about you by automated means alone that have legal or similarly significant effects on you.

Who else handles it

These companies process information for us, only to provide their service to Teleplay:

• Supabase: accounts and sign-in, the database of games, studio conversations, feedback, visitor analytics and the other records above, the storage the game files are served from (through its content delivery network), and the account emails it sends. Kept in the region of our project, in the United States (us-west-2, Oregon); Supabase also processes information in the United States and Singapore. Transfers rely on the Standard Contractual Clauses in its data processing agreement. Supabase's privacy policy.
• Anthropic (Claude): what you type, the plan made from it, and the changes you ask for in the studio, to design and build the game. Anthropic stores it in the United States and may process it in other countries; it does not train its models on it, and deletes it within 30 days unless it must keep it longer to enforce its usage policy or by law. Transfers rely on the Standard Contractual Clauses in the data processing agreement of Anthropic's commercial terms. Anthropic's privacy policy.
• Microsoft (Azure OpenAI): pictures are drawn with Microsoft's Azure OpenAI service, in Microsoft Foundry, and nowhere else. The same service also writes part of a game's code: OpenAI's GPT-6.1 Sol model, run there by Microsoft, writes how a game looks, such as its menus, colours and lettering. We send Microsoft descriptions of the pictures a game needs, written from what you type and the plan made from it; the changes you ask for to a picture in the studio; so that a game's pictures match, a picture already drawn for it; and, for the code it writes, the game's design, written from what you type and the plan made from it, the parts of the game that code must fit, the pictures already drawn for the game, the problems our checks find in the code it wrote, which can quote the game's text, and the changes you ask for in the studio. No account details go with them. Our Azure resource is in the United States (East US 2). Because it uses a global deployment, Microsoft may process a request in any region where the model runs. Anything Microsoft stores, including data it keeps for abuse monitoring, stays in the United States. Microsoft processes requests on our instructions, to provide its service; they are not available to OpenAI or to Microsoft's other customers, and Microsoft doesn't use them to train models or to improve its products or anyone else's. The model keeps nothing it is sent. For the code, Microsoft's service keeps a temporary cache of the start of each request (the game's design and plan, and its pictures) for at least 30 minutes, and may keep it longer, so that the game's next requests can reuse it. The cache is held where the request is processed, so it may be in any region where the model runs, and it is not shared with other Azure subscriptions. If Microsoft's systems flag a request as possible misuse, it may be checked by automated means and, where needed, kept for review by authorized Microsoft employees. Microsoft is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, and transfers also rely on the Standard Contractual Clauses in Microsoft's data protection addendum, with the UK Addendum for the United Kingdom. Microsoft's data, privacy and security page for Azure OpenAI.
• TypeSafe (Jev): TypeSafe AI, Inc., in San Francisco. Once it is switched on: what you type, the plan made from it, and the changes you ask for in the studio with the game's description, with descriptions of a game's pictures and music written from them, to help decide how a game is built or changed, for example what kind of game it is; and the problems our checks find in a game, which can quote its text, with the list of its parts, to decide which part a change you ask for or a problem belongs to. No account details go with them. TypeSafe processes them only to provide its service, on our instructions, and deletes them once it has produced its response; it does not train or fine-tune AI models on them. As a separate controller, it may use technical and billing information about our use of its service to improve its products. Its service is hosted in the United States. Transfers rely on the Standard Contractual Clauses in its data processing agreement, with the UK Addendum for the United Kingdom. TypeSafe's privacy policy.
• ElevenLabs: Eleven Labs, Inc. Once a server sets the money it may spend (it spends nothing until then): short descriptions of the music and the sound effects a game needs, written from the game's plan (which is written from what you type), for example "a cartoon jump for a fox in a forest", to make them. No account details go with them. The sounds it makes are kept in our library, with their descriptions, and other games may use them. ElevenLabs is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework. ElevenLabs's privacy policy.
• Railway: hosts the site and its server, a copy of the game files, and the server's logs, in the United States (Railway's US West region); Railway is largely operated in the United States. Railway is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework. Railway's privacy policy.
• Cloudflare R2: stores the sprite library, the collection of artwork that games are made from, in Eastern North America (Cloudflare's ENAM location). Cloudflare is certified under the EU-U.S. Data Privacy Framework and its UK and Swiss counterparts, and its data processing agreement also has the Standard Contractual Clauses. Cloudflare's privacy policy.
• Cloudflare Turnstile: checks that a person, not a program, is signing up, signing in, asking for a password reset or typing a current password. It runs in the sign-in window and on the password page, in a frame from Cloudflare, and sees your IP address and information about your browser and device, which Cloudflare uses for this check and to keep its service secure. It sets no cookie on this site. Cloudflare is certified under the EU-U.S. Data Privacy Framework and its UK and Swiss counterparts. Turnstile's privacy addendum.
• Google Workspace (Gmail): our own email, sent and received. When we write to you, about your account or to ask for your feedback, and when you write to us: your email address, your name if your email carries it, and the emails themselves. Google keeps them in its data centres in the United States and elsewhere. Google is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, and transfers also rely on the Standard Contractual Clauses in Google's Cloud Data Processing Addendum, with the UK Addendum for the United Kingdom. This is apart from signing in with Google, above, which Google provides as a sign-in service. Google's privacy policy.
• Stripe: takes payment for Pro, Extreme and promotions, and runs the pages where you pay and where you switch, manage or cancel your plan. It receives your email address, the payment details you enter there (which it keeps itself; we never see them), your country, and what you buy and pay. Stripe is in the United States and Ireland. Stripe is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework, and transfers also rely on the Standard Contractual Clauses in its data processing agreement. Stripe also uses some of this for its own purposes, such as preventing fraud and meeting its own legal duties, as its privacy policy says. Stripe's privacy policy.
• Resend: delivers the account emails Supabase sends, such as the sign-up confirmation and the password reset: your email address and the email itself. Resend stores them in the United States. It is certified under the EU-U.S. Data Privacy Framework and its UK Extension, and its data processing agreement also has the Standard Contractual Clauses. Resend's privacy policy.

Sign-in providers

Signing in with Google or GitHub appears in the sign-in window only once we switch it on. If you use one of them, Google or GitHub is a separate controller of what it handles for that sign-in, under its own policy (Google's, GitHub's). What we receive from it is in the first section above.

What is public

• A game is public once it is built and ready to play. Anyone, signed in or not, can find it on Discover, see its title and cover, and play it on its own page. A game that is still being built, one whose build failed, one held back after a check, and one the team has taken off Discover are shown only to the person who made it, in their own library, and to the team.
• Anyone playing a game can tune it for themselves while they play, its speed or its lives for example. Those changes stay in their own browser tab: they are not sent to us or saved, and nobody else sees them, the game's maker included. Only the person who made a game, and the team, can change the game itself.
• What you typed to make a game, the plan made from it, and the account that built it are not shown to other visitors. The team's admin pages show them, to run the site.
• Every game you make goes on Discover with the public name you choose beside it, there and on the game's own page; you can move any game to the link or keep it to yourself instead. Choose a name you do not sign in with.
• Pictures drawn for a game written as code stay with that game. Artwork drawn for games made by our older engine joined the sprite library, and other people's games can use it.
• Your username and email are not shown to other visitors.

So don't put anything personal into a description of a game.

How long we keep it

In more detail:

• Your account and your games are kept until they are deleted. There is no delete button yet: write to info@teleplay.ai and we will delete your account and your games, and answer within one month.
• What you write in the studio is kept with your account and your game: the conversation, with its notes, until your account is deleted, and each change you asked for, in the game's history of versions, until the game is deleted.
• When you started each new game and chat edit is kept with your account, and deleted with it.
• Feedback is kept until you ask us to delete it.
• Visitor analytics' records (the presses included), the records of how games are built, and error records are deleted after 90 days. Daily totals made from them, with no account, browser or game in them, are kept for 13 months.
• What the automatic checks and repairs of each game cost, and what reading each message sent to the studio cost, with the game and the time, is kept as our record of what we spent. It holds nothing else about you.
• Records of a game held back for the team's review, which include what was typed to make it, the team's decision on it, and how many times its checks were retried, are kept beyond 90 days, since the review works from them. They are deleted with the game.
• Your answer about visitor analytics is kept in your browser for 180 days.
• The server's logs: we can access them for 30 days and keep them no longer ourselves. Our host, Railway, may keep infrastructure logs longer under its own retention policy.
• Deleting is done by an automatic job that runs once a day, so something can be deleted a few days after its period ends.
• The team can also hide a game, or remove its files, if it breaks the terms of use.

Your rights

Wherever you live, you can ask us for a copy of what we hold about you, to correct it, or to delete it, by writing to info@teleplay.ai from the address of your account. We may ask you to confirm that the account is yours. We answer within one month, and we won't treat you differently for asking.

If you are in the European Union or the United Kingdom

The legal bases for what we do with your information, under the GDPR and the UK GDPR:

• Running your account, building and showing your games, and sending what you type to the services that build them: a contract with you (Article 6(1)(b)).
• Your plan, taking payment for Pro, Extreme and promotions, counting what you use (your credits included), remixes and saved games: a contract with you (Article 6(1)(b)); and keeping payment records for as long as tax and accounting law requires: a legal obligation (Article 6(1)(c)). Keeping the answer to the age question before a paid plan: our legitimate interest in selling paid plans to adults only, as the law asks of sellers (Article 6(1)(f)).
• The limits, the budget, error records and stopping abuse; reading feedback, and the requests made in the studio, to improve Teleplay: our legitimate interests in a safe, affordable service that works and gets better (Article 6(1)(f)).
• The records of how games are built, used to build your games, fix what fails, and count the limits and what is spent: a contract with you (Article 6(1)(b)).
• The same records, used to analyse what Teleplay costs and to improve it: our legitimate interests in a service that costs what we can afford and gets better (Article 6(1)(f)). You can object to this at any time by writing to info@teleplay.ai.
• The server's logs (your IP address, information about your browser, the address requested and error details): our legitimate interests in keeping the service secure and detecting attacks (Article 6(1)(f)).
• Visitor analytics, with all that its section above lists, the presses included: your consent (Article 6(1)(a)), which you can withdraw at any time under Privacy choices, without affecting what was recorded before.
• Looking up the country of your network address to know whether to ask, and keeping your answer: our legitimate interest in asking where the law requires it, and doing what you chose (Article 6(1)(f)).
• Writing to you for feedback: our legitimate interest in improving Teleplay (Article 6(1)(f)). You can object at any time: reply "unsubscribe", use the link in the email, or turn it off in your profile, and we will not write to you for feedback again.
• Writing to you when you asked us to keep you posted: your consent (Article 6(1)(a)), which you can withdraw at any time.
• Meeting legal obligations (Article 6(1)(c)), and establishing or defending legal claims (Article 6(1)(f)).

You have the right to access your information, to have it corrected or deleted, to restrict how we use it, to receive it in a portable form, to object to what we do on the basis of our legitimate interests, and to withdraw consent at any time without affecting what was done before. To use any of them, write to info@teleplay.ai. You also have the right to complain to a data protection supervisory authority, in particular where you live or work.

If you are in Switzerland, Gibraltar, Jersey, Guernsey or the Isle of Man, the same applies, with the same rights, under Switzerland's Federal Act on Data Protection and the data protection laws of Gibraltar, Jersey, Guernsey and the Isle of Man.

Electrica is a company in the United States, and the companies above process information mostly in the United States, so your information is transferred outside the European Union and the European Economic Area. Each transfer to one of those companies relies on the safeguard named for it above: the Standard Contractual Clauses, or the EU-U.S. Data Privacy Framework where the company is certified under it. Transfers from Switzerland rely on the Standard Contractual Clauses with the Swiss addendum, or on the Swiss-U.S. Data Privacy Framework where a company above is certified under it. Our team works from Turkey and reaches records from there, only as far as needed, through a few admin accounts, each a named member of the team. When one of them hides, shows or takes down a game, or clears a public name, the account and the time are written on that game's or that account's record. Nothing else of what the team looks at is logged, apart from the server's logs of every request, above.

We have not yet appointed a representative in the European Union under Article 27 of the GDPR. Until we do, anyone can write to us directly at info@teleplay.ai.

If you are in Turkey

The information notice under Turkey's Personal Data Protection Law (KVKK) is in Turkish: Aydınlatma Metni. Transfers of information from Turkey to Electrica and the companies above rely on the standard contracts that Article 9 of that law provides for.

If you are in the United States

We do not sell or share your personal information, as the California Consumer Privacy Act defines those words, and we have not done so in the last 12 months. We don't use it for targeted advertising or for profiling.

In the last 12 months we have collected: identifiers (your email address, username and network address, and, if you sign in with Google or GitHub, your name, profile picture and GitHub username), what you put into Teleplay (descriptions, games, studio messages and feedback), and records of your use of the site (requests and errors). Through visitor analytics we also collect a random code kept in a cookie (an identifier), your activity on this site (the parts of it you use, the games you play, your sign-ins and sign-outs, and the presses its section lists), the link that brought you here, your browser and type of device, and your approximate location (your country), unless you decline or your browser sends Do Not Track or Global Privacy Control. We collect them from you and your browser, use them for the purposes above, and disclose them only to the companies above, to run Teleplay.

Depending on the state where you live, including California, you may have the right to know what we hold about you, to get a copy of it, to have it corrected or deleted, and to opt out of its sale, sharing or use for targeted advertising (which we don't do). You may use them yourself or through an authorized agent, by writing to info@teleplay.ai. If we decline a request, you can appeal by replying with the word "Appeal", and we will answer within the time your state's law sets. You can also decline visitor analytics at any time under Privacy choices, and we honour Global Privacy Control: a browser that sends it is treated as declining, wherever you are.

Children

Teleplay is not directed at children under 13, and we don't knowingly collect their information. In the European Union you must be at least 16 to make an account, unless a parent or guardian agrees for you. If we learn that a child under 13, or under 16 in the European Union without that agreement, has made an account, we delete the account, its games and its information. In Turkey, people under 18 use Teleplay only with a parent's or guardian's permission. Accounts are for people 13 and over; under 18, a parent or guardian must agree. Paid plans, Pro and Extreme, and promotions are for adults: before any payment page we ask how old you are, and keep only that you said you are 18 or over, or that you are under 18, with when you said it, never your age. We do not send feedback emails to anyone who has told us they are under 18. Parents and guardians can write to info@teleplay.ai.

Security

The site is served over HTTPS only, sessions are kept in cookies that scripts on the page cannot read, keys to the services above stay on our server, and only the team can see the admin pages. No system is perfectly secure; if something goes wrong that affects you, we will tell you as the law requires.

Changes

We may update this policy. When this policy changes, the new version is posted here with its date, and if a change matters for how we use your information, we tell you in advance by email or on the site.

Contact

Electrica, Inc., a Delaware corporation, [address to be added]. Email: info@teleplay.ai, for privacy, legal and copyright matters alike; it is also our point of contact under the European Union's Digital Services Act, in English or Turkish.