Effective Date: September 16, 2026

1. Introduction

This Privacy Policy explains what information Gameweave collects, why we collect it, who we share it with, how long we keep it, and the choices you have. It covers our websites, our web app, our desktop and mobile apps, and the registry.

Gameweave, Inc. is the controller responsible for the personal data described in this policy. Our contact details are in the Contact Us section at the end.

Two things are worth saying up front, because they shape everything below. We do not sell your personal information and we do not run advertising. And Gameweave is a social platform as well as a place to play: messages, calls, profiles and published games involve other people, so some of what you do here is visible to them — sections 7 and 8 set out exactly what.

2. Information We Collect

The categories below cover everything we hold about you. Some of it you give us directly, some is created as you use Gameweave, and some is generated by our systems to keep the platform working and safe.

Account and Identity Information

Your email address, username, display name, avatar image, and profile bio. Depending on how you sign in, we also hold passkey (WebAuthn) credentials, a link to your Google or Apple account, magic-link tokens, session and refresh tokens, and any personal access tokens you create. If you started as a guest and later registered, we keep a record of that account merge.

A passkey credential is a public key and an identifier. Your device keeps the private key and any biometric data it uses to unlock it — we never receive either.

Gameplay and Game History

Game sessions, moves, game state, results, checkpoints and events; tables you join and invitations you send or receive; achievements, badges, progression and play counts; the games you favourite and the reviews you write.

Content You Create and Publish

Game definitions and projects you build in the editor, including collaborative editing history and any assets you upload. If you publish to the registry, we hold your publisher profile, the package contents you submit, and the review thread between you and our staff about a publication.

Technical, Usage and Device Information

Pages visited, features used, actions taken, and session timing; device type, operating system, browser type and version, screen resolution and language preference; IP address, approximate location derived from it, and network request diagnostics. When something goes wrong we also collect error reports, including stack traces and the page you were on.

This diagnostic and usage data is linked to your account and session identifiers so we can trace a single request across our systems. It is not anonymous.

Notification and Preference Data

•
Push subscription endpoints registered by your browser or device
•
Notification preferences, privacy toggles and display settings
•
Your recorded consent to this policy, the Terms, and cookies, including which version you accepted and when

3. Communications, Social and Safety Information

Messages and Images

Direct messages, group conversations, and in-game and table chat, including message text, images you attach, reactions, read receipts, link previews generated from URLs you send, and unsent composer drafts (kept for up to 90 days so a half-written message survives a reload).

Messages are stored so conversations persist across devices. They are not end-to-end encrypted: we can access message content, and we do so when a message is reported or flagged by automated moderation.

Voice and Video Calls

Gameweave supports voice and video calls in conversations and at tables. With your permission, your browser or device provides camera and microphone access for the duration of a call.

We do not record calls. Audio and video travel directly between participants; our servers relay only the connection-setup messages needed to establish the call. We do keep call metadata — which room, which participants, and when the call started and ended.

Social Connections and Presence

•
Friendships, friend requests, and the people you follow and who follow you
•
Accounts you have blocked
•
Presence and online status, and whether you are currently in a game
•
Invitations you send by email, including the recipient address

Safety and Moderation Records

Reports you file and reports filed about you, moderation queue entries, the evidence snapshot captured with a report, enforcement actions taken on your account, and staff audit records. Where a report concerns the sexual exploitation of a minor, we open a segregated child-safety case; section 15 explains how those are handled.

4. AI Features

Gameweave includes AI opponents, a rules tutor, and tools that help generate game rulebooks, concepts and artwork. Using them involves three kinds of processing you should know about.

•
Stored transcripts. The prompts we send, the model's replies, and the questions you ask the tutor are stored verbatim for up to 90 days, linked to your account. We use them to diagnose bad answers and improve the feature.
•
Third-party models. Some AI features run on models hosted by Amazon Web Services (Amazon Bedrock). Content you send to those features is transmitted to that service to produce a response.
•
Automated moderation. Text you post or publish may be classified by a language model, and images you upload are scanned by Amazon Rekognition, to detect content that breaks our rules. Section 16 explains what follows from that.

We do not use your content to train AI models — not our own, and not a provider's. Our agreements with our AI providers prohibit them from using content we send for model training.

Some AI opponents run entirely in your browser or on your device. When they do, the game position is not sent to us or to any third party.

5. How We Use Your Information

We use the information we collect to:

•
Provide and maintain the platform — accounts, gameplay, multiplayer sessions, messaging, calls, the editor and the registry
•
Show you to other players in the ways described in section 7, and let people find and connect with you
•
Send notifications you have opted into, such as turn reminders and game invitations, and service messages such as security alerts and policy changes
•
Diagnose errors, measure performance and understand how features are used, so we can fix and improve them
•
Keep the platform safe — detect and act on abuse, spam, cheating, ban evasion and illegal content, and review reports
•
Operate AI features, as described in section 4
•
Meet legal obligations, including child-safety reporting and responding to lawful requests

We do not use your information for advertising, and we do not build advertising profiles.

6. Our Legal Bases

If you are in the United Kingdom, the European Economic Area or Switzerland, we rely on the following legal bases under the UK and EU GDPR. Where we rely on legitimate interests, we have weighed those interests against your rights and you can object at any time.

•
Performance of a contract — creating and running your account, delivering gameplay, messaging, calls, the editor and publishing. Without this processing we cannot provide the service you asked for.
•
Legitimate interests — keeping the platform secure and free of abuse, diagnosing errors, understanding how features are used, preventing ban evasion, and defending legal claims.
•
Consent — non-essential cookies and similar technologies, push notifications, camera and microphone access for calls, and any optional analytics. You can withdraw consent at any time, and doing so does not affect processing that already happened.
•
Legal obligation — child-safety preservation and reporting, responding to valid legal process, and keeping records we are required to keep.
•
Vital interests — acting on a credible report of imminent risk to someone's life.

7. How Information Is Shared

We do not sell your personal information, and we do not share it for cross-context behavioural advertising as those terms are used in US state privacy laws. We share information only as described here.

•
With other players. Your username, display name, avatar and bio are visible to other users. Depending on your settings, so are your online status, read receipts, follower and following lists, favourites, badges and achievements. Your moves and in-game actions are visible to the players and observers in that game, and your messages are visible to the people in that conversation.
•
Service providers. The processors listed in section 9, who act on our instructions under contract.
•
Safety and child protection. Where we find apparent child sexual exploitation, we are required by law to report it to the National Center for Missing & Exploited Children (NCMEC), which may forward it to law enforcement. We preserve the related records as described in sections 11 and 15.
•
Legal requests. Where required by law or valid legal process, or to protect the rights, property or safety of our users, the public, or us. We review each request and push back on those that are overbroad or defective.
•
Business transfers. If we are involved in a merger, acquisition, financing or sale of assets, information may transfer as part of that transaction. We will give you notice before your information becomes subject to a different privacy policy.

8. Public and Indexed Information

Some information is public to anyone on the internet, not just to signed-in users, and can be indexed by search engines and copied by third parties. Assume that anything in this list may be seen, cached and retained by people outside Gameweave.

•
Your publisher profile page, if you opt in to publishing — including your username, display name, avatar, bio, tagline, website, social links and published catalogue
•
Packages you publish to the registry, including their contents, rules text and artwork, together with your attribution as publisher
•
Reviews you write on public games, under your display name
•
Games you are currently playing, where you have left observer visibility set to public

You control several of these in your privacy settings, and publishing is always something you choose to do. Removing something from Gameweave does not remove copies already made by search engines or other third parties.

9. Service Providers We Use

These providers process personal information on our behalf, under contracts that limit them to our instructions and require appropriate confidentiality and security.

•
Amazon Web Services — hosting, databases, file storage, email delivery, event streaming, application performance and error monitoring, AI model hosting (Amazon Bedrock) and image moderation (Amazon Rekognition). United States.
•
Google and Apple — only if you choose to sign in with a Google or Apple account, to authenticate you and return the identity details you approve.
•
Browser and device push services — operated by Google, Apple and Mozilla, to deliver push notifications you have enabled to your device.

We will update this section before adding a provider that handles personal information in a materially different way.

10. Where We Process Your Information

Gameweave is operated from the United States, and our infrastructure runs in Amazon Web Services regions in the United States. If you use Gameweave from outside the United States, your information is transferred to and processed there, where privacy laws may differ from those in your country.

For transfers of personal data out of the United Kingdom, the European Economic Area or Switzerland, we rely on the European Commission's Standard Contractual Clauses (and the UK International Data Transfer Addendum where applicable), together with the technical and organisational measures described in section 12. You can request a copy of the safeguards we rely on using the contact details in section 20.

11. How Long We Keep Your Information

We keep information for as long as we need it for the purpose we collected it, then delete or anonymise it. In practice each store we hold falls into one of these categories:

•
For the life of your account — profile, settings, social connections, gameplay and creator content. Deleted when you delete your account, as described in section 15.
•
Short-lived — sign-in tokens, magic links, passkey challenges and similar security artefacts, which expire automatically, usually within minutes to days.
•
Fixed window — AI transcripts and unsent message drafts for 90 days; images awaiting moderation for 7 days.
•
Shared game history — games you played with someone else are kept as long as that other player's record exists, with your identity removed once you delete your account.
•
Public content — reviews and published packages, which stay available with your identity removed unless you take them down.
•
Safety and audit records — reports, enforcement actions and staff audit entries, kept after account deletion so that bans cannot be evaded by re-registering and so we can answer questions about a past decision.
•
Legal hold — child-safety cases and their evidence, preserved for at least one year as US federal law requires. See section 15.

12. Storage and Security

We encrypt data in transit and at rest, restrict access to personal data to the staff who need it, log administrative access to sensitive records, and keep child-safety evidence in a segregated, access-logged store.

No system is perfectly secure, and we cannot guarantee that information will never be accessed without authorisation. If a breach affects your personal information, we will notify you and the relevant regulators where the law requires, without undue delay.

Your part matters too: keep your sign-in method secure, use a passkey where you can, and tell us promptly if you think someone else has access to your account.

13. Cookies and Similar Technologies

We use a small number of cookies, plus your browser's local storage and IndexedDB. We do not use advertising cookies and we do not allow third parties to track you across other websites.

•
Strictly necessary. Cookies prefixed __gw_ keep you signed in across our apps, carry your session between them, and protect forms against cross-site request forgery. These are required for the service to work and are set without consent.
•
Preferences. Local storage holds your theme, layout and display choices, and caches game data so the app works offline.
•
Analytics and diagnostics. Performance and error monitoring, which records the usage and diagnostic data described in section 2. We ask for your consent before enabling these, and you can change your answer at any time.

You can clear cookies and site data in your browser at any time. Clearing the strictly necessary ones will sign you out.

14. Your Rights and Choices

These rights are available to everyone who uses Gameweave, wherever you live. Some of them are also legal rights under the UK and EU GDPR and under US state privacy laws.

•
Access and portability — see what we hold about you and download it in a machine-readable format from your account settings.
•
Correction — update your profile and account information at any time.
•
Deletion — delete your account, subject to the exceptions in section 15.
•
Objection and restriction — object to processing we carry out on the basis of legitimate interests, or ask us to restrict it while we consider your objection.
•
Withdrawing consent — turn off notifications, analytics cookies, and camera and microphone access without losing access to the rest of the platform.
•
Complaint — raise a concern with your local data protection authority. We would appreciate the chance to address it first.

To exercise a right, use your account settings or contact us with the details in section 20. We respond within 30 days and will tell you if we need longer. We will not treat you differently for exercising a right. If we refuse a request we will explain why, and you can ask us to reconsider by replying to that decision.

15. Deleting Your Account

You can delete your account from your account settings. Deletion is scheduled rather than immediate: for 30 days you can sign in and cancel it, and during that window your account is inaccessible to other users. After that the deletion runs and cannot be undone.

Most of what we hold is then erased. Three things are handled differently, and we would rather say so here than surprise you:

•
Shared history is anonymised, not erased. A game you played with someone else, and a message you sent to someone else, remain part of that person's record. Your identity is replaced so the content is no longer linked to you.
•
Safety and audit records are kept. Reports, enforcement actions and staff audit entries survive deletion, so that an account ban cannot be cleared by deleting the account and registering again.
•
Child-safety records are preserved by law. Where we have opened a child-safety case, the case and its evidence are preserved for at least one year under 18 U.S.C. § 2258A and the REPORT Act. This preservation overrides account deletion and overrides an erasure request. It is the one case where we cannot delete your data when you ask us to.

Published packages you chose to release publicly stay available to the people who installed them, with your identity removed, unless you take them down before deleting your account.

16. Automated Moderation and Decisions

We use automated systems to find content that breaks our rules: a language model classifies text you post or publish, image recognition scans uploads, and reports are ranked for review by a severity score. These systems can hide content, hold a publication for review, or escalate an account for action.

Decisions that suspend or ban an account are made by a person, not by a machine alone. If a decision affects you, you will be told what happened and you can contest it — the Terms of Service explain how to appeal. You can also ask us to explain the decision and ask for it to be reviewed by someone who was not involved in making it.

17. US State Privacy Rights

If you live in a US state with a comprehensive privacy law — including California, Virginia, Colorado, Connecticut, Utah, Texas and Oregon — you have the rights set out in section 14: to know what we collect and why, to access and port it, to correct it, to delete it, and not to be treated differently for asking.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have not done so in the preceding twelve months, including for anyone we know to be under 16. There is therefore nothing to opt out of, and we honour opt-out preference signals such as Global Privacy Control in any case.

The categories we collect, the purposes we use them for, and the categories of recipient are listed in sections 2 to 9. We collect a limited amount of information that some state laws treat as sensitive — your account credentials, and your approximate location derived from your IP address. We use it only to provide and secure the service, and never to infer characteristics about you.

You can use an authorised agent to make a request on your behalf; we will ask for proof of their authority and may ask you to confirm it directly. If we deny a request, you may appeal by replying to our decision, and we will respond within 45 days.

18. Children's Privacy

Gameweave is not directed at children, and you must be at least 13 years old to create an account. In parts of the European Economic Area and the United Kingdom the minimum age is higher — 14, 15 or 16 depending on the country — and the local minimum applies to you. Creating an account requires you to confirm you meet it.

We do not knowingly collect personal information from anyone below that age. If we learn that we have, we delete the account and the information. If you are a parent or guardian and believe your child has created an account, contact us at the address below and we will remove it.

Separately, we are required by US federal law to report apparent child sexual exploitation to the National Center for Missing & Exploited Children, and to preserve the related records. Section 15 explains why those records survive a deletion request.

19. Changes to This Policy

We may update this Privacy Policy. Every version carries an effective date at the top of this page, and we keep earlier versions available so you can see what you previously agreed to.

When we make a material change we ask you to acknowledge the new version the next time you use Gameweave, and we give at least 14 days notice before it takes effect where we reasonably can. If you do not agree to a change, you can delete your account before it applies.

20. Contact Us

For questions about this policy, or to exercise any right described above, contact us at privacy@gameweave.com, or by mail:

Gameweave, Inc.

43276 Sunderleigh Sq

Broadlands, VA 20148

United States

•
Tell us what you are asking for and the email address on your account, so we can find your records
•
We respond within 30 days, or 45 days for US state privacy requests where the law allows longer

Gameweave, Inc.

43276 Sunderleigh Sq

Broadlands, VA 20148

United States