Privacy Policy

1. Who is responsible

Gilded Games, at 434 Alamos Rd, Corrales, NM 87048, operates The Gilded Spade and Clubhouse II. Contact support@gildedspades.com for privacy questions or requests, including if you cannot sign in. Members can also use Contact & Support. This policy describes the game, clubhouse, chat, AI features, profiles, and purchases. Third-party sign-in and payment services also have their own privacy notices.

2. Information we collect

• Account and sign-in: account identifiers, email, selected sign-in provider and related identifiers, alias, profile and avatar choices, session records, and passkey credential information when that method is used. Passkeys do not give us your device’s fingerprint or face scan.
• Gameplay and social features: tables joined, bids, plays, results, ratings, statistics, chip balances and ledger entries, friendships, messages, reports, moderation decisions, and appeals.
• AI and portrait features: prompts, conversation history and relevant game context supplied to AI features, uploaded reference photos, customization notes, generated portraits, and generation job records.
• Purchases and support: order references, purchased quantities, price and currency, payment status and processor references, support messages, and information you provide to resolve a request. Card entry is handled by Stripe; our checkout integration does not receive your full payment-card number or security code.
• Technical and usage information: browser requests and associated technical logs, session and visitor identifiers, page paths, features visited, engagement duration, referring website host, and campaign tags. Our first-party analytics may associate these events with your member account when signed in.
• Agreement records: member account, accepted terms version, and acceptance date and time. A terms acknowledgment is not independent verification of age or parental permission.

3. How we use information

We use information to authenticate accounts; operate tables and settle chips; provide profiles, friends and messages; fulfill purchases; generate requested AI responses and portraits; investigate cheating, abuse and errors; respond to support and privacy requests; measure usage and improve reliability; preserve security; and comply with legal obligations. Automated moderation may affect game outcomes or account access; you can request review through support.

Where a legal basis is required, processing may be necessary to perform our agreement, meet legal obligations, pursue legitimate interests in a secure and functioning service where those interests are not overridden by your rights, or act on consent where required. We do not treat acceptance of game terms as blanket consent to every use of personal information.

4. Who receives information

Other players can see information the feature makes public, such as your alias, avatar, displayed statistics, and messages sent to them or a shared room. Private-table participation does not prevent other participants from copying what they see.

We use providers for hosting and storage, authentication, payments, AI generation and moderation, and operational support. The inspected service integrations include Cloudflare for hosting and storage, Stripe for web payments, OpenAI for AI features, and the sign-in provider you select. AI requests can include submitted messages, reference images, and relevant game or conversation context. Provider processing and retention depend on the service and applicable account settings; do not assume content disappears from every provider when a game or generation ends.

We may disclose information to comply with valid legal requests, protect users and the Service, investigate fraud or abuse, or establish or defend legal claims. A business transfer may involve relevant records, subject to applicable legal safeguards and notice requirements.

[CONFIRM BEFORE RELEASE: any other recipients, advertising integrations, sale or sharing of personal information under applicable privacy laws, and the corresponding opt-out mechanisms. No “we never sell/share data” promise is made in this draft.]

5. Cookies and browser storage

Sign-in uses session cookies. Browser storage also holds feature preferences and first-party analytics visitor and session identifiers. Analytics records include page and feature activity, engagement time, referrer host, and campaign tags. These identifiers are pseudonymous, not a guarantee of anonymity, and signed-in events can be linked to your account.

You can clear or restrict cookies and browser storage in your browser settings; doing so can sign you out or reset preferences. Clearing stored identifiers alone does not stop future analytics events. [CONFIRM BEFORE RELEASE: regional consent requirements and any required analytics or privacy opt-out controls. This draft does not claim an opt-out control is already implemented.]

6. Retention and security

Retention should be limited to what is reasonably needed for the relevant purpose, including operating your account, purchase and accounting records, security, fraud prevention, resolving disputes, and legal obligations. Deleting or closing an account does not necessarily erase records we must lawfully retain. [CONFIRM BEFORE RELEASE: category-specific retention periods or criteria, backup deletion practices, and the operational process for deletion requests.]

The portrait workflow deletes its temporary reference object after completion and in specified failure cleanup paths. Generated portraits and related session or job records are separate, and service-provider copies may follow different retention rules. You can delete generated portraits using the studio’s available controls; contact support about other stored information.

We use access controls and other safeguards to protect information, but no internet service can guarantee absolute security. Keep your credentials secure and never send passwords or full card details in chat or support messages.

7. Your choices and requests

You can change available profile settings, manage portraits through the studio, and request account closure through support. Depending on your location, you may have rights to access, correct, delete, or obtain a copy of personal information; object to or restrict certain processing; withdraw consent for consent-based processing; or appeal a denied request. Rights and lawful exceptions vary. Contact support@gildedspades.com to exercise applicable rights without signing in.

We may verify your identity and an authorized representative’s authority using information proportionate to the request. Withdrawal of consent does not invalidate earlier lawful processing. You may also complain to your applicable privacy regulator. [CONFIRM BEFORE RELEASE: regions served, required state-specific notices and appeal instructions, and international-transfer safeguards if applicable.]

8. Teens and children

The Service is for users 13 and older, subject to any higher local minimum. Minors need parent or guardian permission to play and authorization for each purchase. The Service is not intended for children under 13. If you believe we hold information from a child under 13, contact support@gildedspades.com so we can investigate, restrict the account as appropriate, and address the information under applicable law.

Parents and guardians may contact us about their child’s account or an unauthorized purchase. We may verify the relationship before disclosing information or making changes. Do not submit unnecessary identity documents or sensitive information in ordinary game chat.

9. Changes

We will identify updates by date and provide additional notice or obtain consent where required. We will not use a policy change as a substitute for legally required consent to materially different processing.