Privacy Policy

This policy covers the Orbitle family of services operated by Orbitle Games: orbitlegames.com (including your account hub), Orbitle Games AI, Orbitle AI and the Orbitle game. Short version: we collect what the Services need to run, we don't sell your data, and you can ask for a copy or deletion at any time.

1 · What we collect

• Account — email, username, password hash (or your Google account ID if you sign in with Google). Authentication is provided by Supabase.
• Profile & character — your avatar design (colours, hair, accessories) and achievements.
• Creations — games you build, the prompts you write to build them, generated assets, and publishing metadata (including your recorded agreement to the publishing terms).
• Economy— Gold and credit balances and their transaction ledgers, purchases (via Stripe — we store amounts and Stripe's payment reference, never your card number), creator earnings, and payout requests including your Stripe Connect account reference (identity and bank details are collected by Stripe directly and never stored by us).
• Usage — plays, and home-screen interaction events (which game tiles were shown and clicked) that power discovery ranking; standard server logs (IP, user-agent) kept briefly for security and abuse prevention.
• API keys — Orbitle AI keys are stored only as one-way hashes.

2 · How we use it

To run the Services: authenticate you, sync your character and balances across Orbitle titles, generate the games and assets you ask for, rank and rotate the arcade, process purchases, pay creators, prevent fraud and abuse, and meet legal obligations. Prompts and game content are screened at publish time for the content standards in the Terms. We don't sell personal data, and we don't use third-party advertising trackers.

3 · Who processes it for us

• Supabase — database & authentication
• Stripe — payments and creator payouts via Stripe Connect (PCI-compliant; sees your card, identity and bank details so we don't)
• Cloudflare — hosting & delivery of the web apps
• Railway — hosting of the asset-generation service
• Anthropic — AI game generation and content screening (receives your prompts and game text to do so)
• Google / ElevenLabs — AI image, video and audio generation for assets you request

Each processor receives only what its job needs. Data may be processed in countries other than yours (primarily the US and Australia) with appropriate safeguards.

4 · Cookies

We use first-party, mostly httpOnly cookies for one thing: keeping you signed in (session tokens, and a short-lived cookie during Google sign-in). No advertising or cross-site tracking cookies.

5 · Retention

Account, creation and economy data live for the life of your account (financial ledgers as long as tax/accounting law requires). Discovery interaction events are aggregated within weeks and pruned. Server logs are kept for a short security window. Deleting your account removes personal data except what payment and tax law obliges us to keep.

6 · Your rights

Wherever you live, we honour the basics: ask us for a copy of your data, correction, or deletion, and we'll act within 30 days (subject to identity verification and legal retention duties). If you're in the EU/UK, this is your GDPR access/rectification/ erasure/portability set; in Australia, the Privacy Act APPs apply. Complaints can also go to your local privacy regulator (in Australia, the OAIC).

7 · Children

The Services are for ages 13+. We don't knowingly collect data from children under 13; if you believe a child holds an account, contact us and we'll remove it.

8 · Changes & contact

Material changes to this policy are announced on the site with a new effective date. Privacy questions, data requests, deletions: howtocook75@gmail.com.