Privacy Policy
Effective 2026-06-08 · Last updated 2026-06-08
This Privacy Policy explains how Um Family Labs, LLC (“we”, “us”, “our”) collects, uses, shares, and protects personal information when you use du-game-maker (https://du-game-maker.umfamily.org and https://app.du-game-maker.umfamily.org, together the “Service”).
We aim to be a good steward of your information. If anything in this policy is unclear, please email us at privacy@du-game-maker.umfamily.org.
At-a-glance summary
- We collect the minimum information needed to provide and improve the Service.
- We do not sell or rent your personal information.
- You can export or delete your account data at any time at https://app.du-game-maker.umfamily.org/account/danger-zone.
- We use industry-standard security measures and notify you of breaches as required by law.
- For EU/UK/Swiss residents: you have rights under the GDPR (Section 9).
- For California residents: you have rights under the CCPA (Section 10).
- Other state and country-specific rights are listed in Section 11.
1. Information we collect
1.1 Information you provide to us
- Account information: name, email address, password (stored as a salted hash, never in cleartext).
- Profile information: optional fields you fill in, such as avatar image or bio.
- Billing information: when you purchase a subscription, billing data is collected and stored by Stripe, our payment processor. We receive limited metadata (last 4 digits of card, brand, expiration) for display purposes only.
- Content: anything you submit to the Service in the course of using it.
- Support communications: when you contact us, we keep a record of the conversation and any information you provide.
1.2 Information collected automatically
- Usage data: pages and features accessed, timestamps, and similar telemetry needed to operate the Service and detect abuse.
- Log data: IP address, browser type, device type, operating system, referring URL, and similar HTTP headers. Captured by our servers and content delivery network.
- Cookies and similar technologies: see our Cookie Policy.
- Performance and error data: when something breaks or runs slowly, we record diagnostic information (browser console errors, page-load timings, route changes). This data is anonymized by default.
1.3 Information from third parties
- Identity providers: if you sign in via Google, GitHub, Apple, or another social provider, we receive your name, email, and an identifier from that provider, in accordance with the scopes you authorize.
- Payment processor: Stripe shares limited billing metadata as described above.
- Bot protection: Cloudflare Turnstile may collect anonymized signals from your browser during signup or contact form submission to verify you are human.
We do not purchase or otherwise acquire personal information from data brokers.
2. How we use information
We use personal information for the following purposes, each tied to a legal basis under applicable Data Protection Laws (see Section 9 for the GDPR-specific summary):
| Purpose | Examples |
|---|---|
| Provide the Service | Authenticate you, store your content, deliver features you use |
| Maintain & secure the Service | Detect abuse, prevent fraud, debug issues, restore from backups |
| Communicate with you | Send transactional emails (verification, password reset, billing receipts, security notices); respond to support requests |
| Process payments | Charge for subscriptions, calculate taxes, issue refunds |
| Improve the Service | Aggregate usage trends, evaluate feature changes, fix bugs |
| Marketing (only with consent or where permitted) | Send product updates if you opted in; never share with third parties for their marketing |
| Comply with law | Respond to lawful requests, enforce our Terms, pursue legal claims |
We do not use your content to train AI models without your explicit opt-in consent. Where the Service includes AI features that process your content (e.g., AI assistance), the relevant content is sent to the LLM provider only to satisfy your request and is not retained by us beyond what is needed to deliver the response.
3. How we share information
We do not sell or rent personal information. We share information only in the following circumstances:
- Service providers (sub-processors): third parties that process personal information on our behalf, such as hosting, payment processing, transactional email, and bot protection. Each is bound by a Data Processing Agreement. The current list is at /legal/sub-processors.
- Legal obligations: when required by law, subpoena, or court order. We push back on overbroad requests where appropriate and, where lawful, notify you of legal demands affecting your data.
- Vital interests / safety: when necessary to protect the rights, property, or safety of any person.
- Business transfers: in the event of a merger, acquisition, or sale of assets, personal information may be transferred as part of the transaction, subject to standard confidentiality obligations and continued protection consistent with this policy.
- With your consent: any other sharing not described above will be with your prior consent.
4. Retention
We retain personal information only as long as needed for the purposes described above:
| Category | Retention |
|---|---|
| Account information (active accounts) | While your account is active |
| Account information (closed accounts) | Deleted within 30 days of account closure, except as required by law (e.g., tax records may be retained up to 7 years) |
| Billing records | Retained for as long as required by tax and accounting laws (typically up to 7 years) |
| Server / log data | 30–90 days depending on log category |
| Support communications | Up to 3 years |
| Backups | Up to 35 days; backups are rotated; deleted account data will not be restored from backup except in the event of a disaster recovery, in which case it will be redeleted immediately |
You can request earlier deletion by following Section 9 (GDPR) or Section 10 (CCPA), or by using the in-app delete flow at https://app.du-game-maker.umfamily.org/account/danger-zone.
5. Security
We implement appropriate technical and organizational measures to protect personal information, including:
- TLS 1.2+ encryption in transit
- AES-256 encryption at rest for production data stores
- Role-based access control with least-privilege defaults and mandatory MFA for production system access
- Centralized logging and monitoring
- WAF and bot protection on all public endpoints
- Vendor management with contractual data-protection requirements
- Personnel confidentiality obligations and security awareness training
No system is perfectly secure. If a security incident affects your information, we will notify you as required by applicable law.
6. International transfers
We are based in United States. Personal information you provide may be transferred to, stored in, and processed in United States and in the regions where our sub-processors operate.
For transfers from the European Economic Area, the United Kingdom, or Switzerland to a country without an adequacy decision, we rely on the European Commission’s Standard Contractual Clauses (and the UK Addendum or Swiss equivalents, as applicable). A copy of these safeguards is available on request.
7. Children
The Service is not directed to children under 13. We do not knowingly collect personal information from children under that age. If you are a parent or guardian and believe your child has provided us with personal information, please contact privacy@du-game-maker.umfamily.org and we will delete it.
8. Cookies
See our Cookie Policy for details on cookies and similar technologies. You can manage your preferences via the cookie banner or the “Cookie settings” link in the footer.
9. Your rights under GDPR (EU/UK/Swiss residents)
If you are in the European Economic Area, the United Kingdom, or Switzerland, you have the following rights:
| Right | Description |
|---|---|
| Access | Request a copy of the personal data we hold about you |
| Rectification | Correct inaccurate or incomplete personal data |
| Erasure | Request deletion of your personal data, subject to legal retention requirements |
| Restriction | Restrict our processing of your personal data in specific cases |
| Portability | Receive your personal data in a structured, machine-readable format |
| Objection | Object to processing based on legitimate interests, including profiling |
| Withdraw consent | Where processing is based on your consent, you may withdraw it at any time |
| Complain | Lodge a complaint with your local supervisory authority |
Legal bases for processing: we rely on the following legal bases depending on the activity:
| Activity | Legal basis |
|---|---|
| Providing the Service to you | Performance of a contract (Art. 6(1)(b)) |
| Billing and tax compliance | Legal obligation (Art. 6(1)(c)) |
| Security, fraud prevention, abuse detection | Legitimate interests (Art. 6(1)(f)) |
| Service improvement using aggregated/anonymized data | Legitimate interests (Art. 6(1)(f)) |
| Marketing communications | Consent (Art. 6(1)(a)), withdrawable at any time |
| Responding to lawful legal demands | Legal obligation (Art. 6(1)(c)) |
Automated decision-making: we do not engage in automated decision-making that produces legal or similarly significant effects on you within the meaning of Article 22 of the GDPR.
EU Representative (if applicable): (none).
Data Protection Officer / Privacy contact: privacy@du-game-maker.umfamily.org.
To exercise any of these rights, see Section 12 (How to contact us and exercise your rights).
10. Your rights under CCPA / CPRA (California residents)
If you are a California resident, you have specific rights under the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, “CCPA”):
10.1 Categories of personal information collected (last 12 months)
| CCPA category | What we collect | Sources | Business purpose |
|---|---|---|---|
| Identifiers | Name, email, account ID, IP address, device identifiers | You; automatic; identity providers | Provide the Service; security |
| Customer records | Profile, billing data (limited; held by Stripe) | You; Stripe | Provide the Service; billing |
| Commercial information | Subscription history, purchases, refunds | You; Stripe | Billing; legal compliance |
| Internet/network activity | Usage logs, performance data | Automatic | Operate the Service; security |
| Geolocation | Approximate (city-level) from IP address | Automatic | Security; fraud prevention |
| Audio/visual | Avatar image; support call recordings (if any) | You | Profile display; support |
| Professional/employment | (only if voluntarily provided) | You | Provide the Service |
| Inferences | Aggregated usage trends; never used for automated decisions about you | Derived | Service improvement |
We do not collect “sensitive personal information” beyond authentication credentials (which we treat with the highest sensitivity even if not strictly in scope).
10.2 We do not sell or share your personal information
We do not “sell” personal information for monetary or other valuable consideration, and we do not “share” personal information for cross-context behavioral advertising, as those terms are defined under CCPA. We have not done so in the 12 months preceding the effective date of this policy.
10.3 Your CCPA rights
- Right to know: request the categories and specific pieces of personal information we have collected about you.
- Right to delete: request deletion of personal information we have collected (with limited exceptions).
- Right to correct: request correction of inaccurate personal information.
- Right to opt out of sale/sharing: we do not sell or share — but the opt-out is honored via our /privacy-choices page in any event.
- Right to limit use of sensitive personal information: we do not use sensitive personal information for purposes beyond what is reasonably necessary to provide the Service.
- Right to non-discrimination: we will not discriminate against you for exercising any of these rights — including no denial of goods/services, no different prices or quality.
10.4 How to exercise CCPA rights
Visit /privacy-choices or email privacy@du-game-maker.umfamily.org. We verify your identity before fulfilling requests, typically by confirming you control the account email associated with the data. You may also designate an authorized agent in writing to make requests on your behalf.
We respond to verifiable consumer requests within 45 days (extendable by an additional 45 days if reasonably necessary, with notice to you).
10.5 Global Privacy Control (GPC)
We honor the GPC opt-out signal. If your browser sends GPC, we treat it as an opt-out of any future “sale” or “share” of personal information, even though we do not engage in those activities today.
11. Other state and country-specific rights
Many U.S. states and other jurisdictions have their own privacy laws. We aim to honor substantively similar rights — access, deletion, correction, opt-out — for all residents, regardless of jurisdiction. Visit /privacy-choices to submit a request, or email privacy@du-game-maker.umfamily.org.
12. How to contact us and exercise your rights
- Self-service: most account-related rights (access, export, delete) are available at https://app.du-game-maker.umfamily.org/account/danger-zone.
- Public form: /privacy-choices for any rights request, including from non-account-holders.
- Email: privacy@du-game-maker.umfamily.org
- Mail: Um Family Labs, LLC, (business address on file)
We respond to all rights requests within the timeline required by applicable law — typically 30 days under GDPR, 45 days under CCPA.
13. Changes to this policy
We may update this policy from time to time. If we make a material change — one that affects how we use your information or reduces your rights — we will notify you by email at least 30 days before the change takes effect, and the cookie consent banner may re-prompt for consent. The “Last updated” date at the top reflects the most recent revision. A history of material changes is published at https://du-game-maker.umfamily.org/changelog.
14. Specific feature notices
- AI features: see Section 2 above and our Terms of Service.
- Bot protection: signup and contact forms use Cloudflare Turnstile to verify you are human; Turnstile does not require cookies and does not track you across sites.
- Performance monitoring: we use AWS CloudWatch RUM to capture anonymized performance data and JavaScript errors. We do not use this for behavioral analytics.
This Privacy Policy is published in English. Translations, where provided, are for convenience. The English text controls in case of conflict.