Privacy policy

Teleplay turns a description of a game into a game you can play in your browser, at https://www.teleplay.ai. This page says what we keep to do that, why, who else handles it, what anyone can see, and what you can ask of us. Teleplay is run by its founding team in Turkey ("we"), who decide how your information is used (the "controller"). We plan to set up a company to run Teleplay, and will give its name here once it is set up. Write to us at info@teleplay.ai.

What we keep

• Your account: your email address and the username you choose. Supabase, which runs our sign-in, keeps your password in hashed form; we never store it ourselves. It also records when the account was made and when it last signed in.
• The games you build: what you type to describe a game, the plan made from it, the game itself, your conversation with the studio and the changes you ask for there, with a note for each of how it was understood, what came of it and what it cost, which account built which game, when each new game and chat edit was started, to count the day's limits, and what building it cost us.
• How each game is built: once build records are switched on, separately from visitor analytics, the steps of building or changing a game, as the section on them below says.
• How you use the site: once visitor analytics is switched on, and only as its section below says: which parts of the site you open, roughly how long you are active, the games you load and how each play ends, the link that brought you here, and your browser, type of device and country.
• Promo codes: if you redeem a promo code, we record which code your account used and how much of it is left, and delete that with your account.
• Feedback: if you send us feedback, your answers, with your account's username and email. If you ask us to keep you posted, the address you give for that.
• The team's records: what the team does in its own tools, with who did it, when, and to which account or game; and if the team gives your account extra new games, how many and until when.
• Logs: for each request our server handles, its logs record your IP address, information about your browser, the address requested and any error, to keep the service secure and detect attacks. To limit password reset emails, sign-ins, sign-ups, password checks, privacy choices and visitor analytics' records, it also counts requests per network address, in memory only, for up to an hour.

In your browser

The site sets these cookies, all of them its own. Scripts on the page cannot read any of them.

There are no advertising cookies, and no tracking scripts or analytics from other companies. The site also keeps a few things in your browser's own storage, which stay on your device: the descriptions you have typed before, your saved progress and best scores in games, unsent studio messages, the description you are about to build while you sign in (in that tab, until the build starts), which finished build you have already been told about, and display settings such as the theme, the library's layout, the sidebar and sound. While visitor analytics may record, it also keeps there which visit this browser is on, with your account's ID if you are signed in, and which of its tabs sends the records; declining removes them.

Visitor analytics

Once it is switched on, Teleplay records how its pages and games are used, to see what works and improve Teleplay. It records which parts of the site you open (the studio, the library, Discover, a game's page and so on, never a page's full address); roughly how long you are active; your sign-ins and sign-outs; the games you load, when each is ready and when you start playing, roughly how long you play, and whether a play ends in a win, a loss or your leaving; the link that brought you here, on your first visit and your latest (the site it came from, without its page, and the campaign tags in the link, such as utm_source); and your browser and its version, operating system, type of device and country. It never records what you type or click, the contents of forms, your network address or anything that identifies your device itself, and it builds no advertising profile. It is kept in our own database (Supabase, below); no other company's analytics or advertising tools are used.

• If you are in the European Union, Iceland, Liechtenstein, Norway, the United Kingdom, Gibraltar, Jersey, Guernsey, the Isle of Man, Switzerland or Turkey, or we can't tell where you are, nothing is recorded unless you accept when we ask.
• Anywhere else, it records unless you decline.
• Wherever you are, if your browser sends Do Not Track or Global Privacy Control, nothing is recorded and no visitor cookie is set.
• You can change your answer at any time under Privacy choices, in the site's menu. Once you decline, nothing more is recorded from that browser, and its visitor cookie and what visitor analytics kept in your browser are deleted. Your answer is kept in the teleplay-consent cookie for 180 days; after that we ask again where we ask first, and elsewhere visits are recorded again until you decline again.
• If you are signed in, what is recorded is linked to your account, and so are this browser's earlier visits and the link it first came from. If your account is deleted, the records lose that link.
• To know whether to ask, our server looks up which country your network address is in, in a database it keeps itself: the IP to Country Lite database by DB-IP, used unchanged under the Creative Commons Attribution 4.0 licence (IP Geolocation by DB-IP). Your address is used for that lookup alone, in memory, and is not stored or logged; only the country is kept, with the records above, and only when they are recorded.
• The records are deleted after 90 days (a browser's own, 90 days after its last visit). Daily totals made from them, with no account, browser or game in them, are kept for 13 months. What was recorded before you declined stays until then, unless you ask us to delete it sooner.

How games are built

Build records are switched on separately from visitor analytics. Once they are, each step of building or changing a game is recorded: which AI model and provider did it, when it started and how long it took, whether it was retried or failed and with what error, the tokens it used and what it cost; an error message can include part of what you typed. They are recorded against the game, which links them to the account that built it. We need them to run Teleplay, find what fails and keep its costs in hand, so they are part of providing the service: your answer about visitor analytics neither starts nor stops them. They are deleted after 90 days; daily totals made from them, with no account or game in them, are kept for 13 months.

Why we use it

• To run your account, and to build, show and keep your games, including sending what you type to the AI services below and showing ready games on Discover. That is the service you asked for.
• To keep Teleplay working, safe and affordable: the limits (3 new games and 3 chat edits per account in any 24 hours), the daily budget, error records, the records of how games are built, and stopping abuse.
• To see how Teleplay is used and improve it: visitor analytics, only where and when it may record.
• To read your feedback and improve Teleplay, and to write to you if you asked us to keep you posted.
• To improve Teleplay from what you ask in the studio: the team reads the requests made in the studio chat, and what came of each, to see what people ask for that Teleplay can't do yet and decide what to add next. We don't use them to train AI models.
• To keep the team's own tools secure and accountable: the record of what the team does in them.
• To meet legal obligations, and to establish or defend legal claims.

We don't use your information for advertising, we don't sell it, and we don't make decisions about you by automated means alone that have legal or similarly significant effects on you.

Who else handles it

These companies process information for us, only to provide their service to Teleplay:

• Supabase: accounts and sign-in, the database of games, studio conversations, feedback, visitor analytics and the other records above, the storage the game files are served from (through its content delivery network), and the account emails it sends. Kept in the region of our project, in the United States (us-west-2, Oregon); Supabase also processes information in the United States and Singapore. Transfers rely on the Standard Contractual Clauses in its data processing agreement. Supabase's privacy policy.
• Anthropic (Claude): what you type, the plan made from it, and the changes you ask for in the studio, to design and build the game. Once the team switches on its assistant's use of Teleplay's records, the assistant, Ask AHMO, also sends it the answers to the team's questions about them, which can include account email addresses, usernames, account and game IDs, excerpts of what was typed to make games, error messages, and where an account first came from (the site and the campaign tags of the link that brought it); until then, Ask AHMO sends Anthropic nothing. Anthropic stores it in the United States and may process it in other countries; it does not train its models on it, and deletes it within 30 days unless it must keep it longer to enforce its usage policy or by law. Transfers rely on the Standard Contractual Clauses in its data processing agreement. Anthropic's privacy policy.
• Microsoft (Azure OpenAI): pictures are drawn with Microsoft's Azure OpenAI service, in Microsoft Foundry, with OpenAI directly as a fallback (below). We send Microsoft descriptions of the pictures a game needs, written from what you type and the plan made from it; the changes you ask for to a picture in the studio; and, so that a game's pictures match, a picture already drawn for it. No account details go with them. Our Azure resource is in the United States (East US 2). Because it uses a global deployment, Microsoft may process a request in any region where the model runs. Anything Microsoft stores, including data it keeps for abuse monitoring, stays in the United States. Microsoft processes requests on our instructions, to provide its service; they are not available to OpenAI or to Microsoft's other customers, and Microsoft doesn't use them to train models or to improve its products or anyone else's. The model keeps nothing it is sent. If Microsoft's systems flag a request as possible misuse, it may be checked by automated means and, where needed, kept for review by authorized Microsoft employees. Transfers rely on the Standard Contractual Clauses in Microsoft's data protection addendum, with the UK Addendum for the United Kingdom. Microsoft's data, privacy and security page for Azure OpenAI.
• OpenAI: as a fallback, when Microsoft's service refuses us access, has no model to draw with, or is out of quota, the same goes to OpenAI directly: descriptions of the pictures a game needs, written from what you type and the plan made from it, the changes you ask for to a picture in the studio, and a picture already drawn for the game, to draw them. No account details go with them. OpenAI processes them in the United States and other countries; it does not train its models on them, and keeps them for up to 30 days to monitor abuse. Transfers rely on the Standard Contractual Clauses in its data processing agreement. OpenAI's privacy policy.
• TypeSafe (Jev): TypeSafe AI, Inc., in San Francisco. Once it is switched on: what you type, the plan made from it, and the changes you ask for in the studio with the game's description, with descriptions of a game's pictures and music written from them, to help decide how a game is built or changed, for example what kind of game it is. No account details go with them. TypeSafe processes them only to provide its service, on our instructions, and deletes them once it has produced its response; it does not train or fine-tune AI models on them. As a separate controller, it may use technical and billing information about our use of its service to improve its products. Its service is hosted in the United States. Transfers rely on the Standard Contractual Clauses in its data processing agreement, with the UK Addendum for the United Kingdom. TypeSafe's privacy policy.
• ElevenLabs: Eleven Labs, Inc. Once a server sets the money it may spend (it spends nothing until then): short descriptions of the music and the sound effects a game needs, written from the game's plan (which is written from what you type), for example "a cartoon jump for a fox in a forest", to make them. No account details go with them. The sounds it makes are kept in our library, with their descriptions, and other games may use them. ElevenLabs's privacy policy.
• Railway: hosts the site and its server, a copy of the game files, and the server's logs, in the United States (Railway's US West region); Railway is largely operated in the United States. Railway is certified under the EU-U.S. Data Privacy Framework, its UK Extension and the Swiss-U.S. Data Privacy Framework. Railway's privacy policy.
• Cloudflare R2: stores the sprite library, the collection of artwork that games are made from, in Eastern North America (Cloudflare's ENAM location). Cloudflare is certified under the EU-U.S. Data Privacy Framework and its UK and Swiss counterparts, and its data processing agreement also has the Standard Contractual Clauses. Cloudflare's privacy policy.
• Cloudflare Turnstile: checks that a person, not a program, is signing up, signing in, asking for a password reset or typing a current password. It runs in the sign-in window and on the password page, in a frame from Cloudflare, and sees your IP address and information about your browser and device, which Cloudflare uses for this check and to keep its service secure. It sets no cookie on this site. Cloudflare is certified under the EU-U.S. Data Privacy Framework and its UK and Swiss counterparts. Turnstile's privacy addendum.
• Resend: delivers the account emails Supabase sends, such as the sign-up confirmation and the password reset: your email address and the email itself. Resend stores them in the United States. It is certified under the EU-U.S. Data Privacy Framework and its UK Extension, and its data processing agreement also has the Standard Contractual Clauses. Resend's privacy policy.

What is public

• A game is public once it is built and ready to play. Anyone, signed in or not, can find it on Discover, see its title and cover, and play it on its own page. A game that is still being built, one whose build failed, one held back after a check, and one the team has taken off Discover are shown only to the person who made it, in their own library, and to the team.
• Anyone playing a game can tune it for themselves while they play, its speed or its lives for example. Those changes stay in their own browser tab: they are not sent to us or saved, and nobody else sees them, the game's maker included. Only the person who made a game, and the team, can change the game itself.
• What you typed to make a game, the plan made from it, and who built it are not shown to other visitors. The team's admin pages show them, to run the site.
• Artwork drawn for a game joins the sprite library, and other people's games can use it.
• Your username and email are not shown to other visitors.

So don't put anything personal into a description of a game.

How long we keep it

• Your account and your games are kept until they are deleted. There is no delete button yet: write to info@teleplay.ai and we will delete your account and your games, and answer within one month.
• What you write in the studio is kept with your account and your game: the conversation, with its notes, until your account is deleted, and each change you asked for, in the game's history of versions, until the game is deleted.
• When you started each new game and chat edit is kept with your account, and deleted with it.
• Feedback is kept until you ask us to delete it.
• Visitor analytics' records, the records of how games are built, and error records are deleted after 90 days. Daily totals made from them, with no account, browser or game in them, are kept for 13 months.
• What the automatic checks and repairs of each game cost, with the game and the time, is kept as our record of what we spent. It holds nothing else about you.
• Records of a game held back for the team's review, which include what was typed to make it, the team's decision on it, and how many times its checks were retried, are kept beyond 90 days, since the review works from them. They are deleted with the game.
• The team's records of what it does in its own tools are kept for 12 months.
• Your answer about visitor analytics is kept in your browser for 180 days.
• The server's logs are kept for 30 days. Railway, which hosts the server, keeps them under its own policies, and may keep them longer.
• Deleting is done by an automatic job that runs once a day, so something can be deleted a few days after its period ends.
• The team can also hide a game, or remove its files, if it breaks the terms of use.

Your rights

Wherever you live, you can ask us for a copy of what we hold about you, to correct it, or to delete it, by writing to info@teleplay.ai from the address of your account. We may ask you to confirm that the account is yours. We answer within one month, and we won't treat you differently for asking.

If you are in the European Union or the United Kingdom

The legal bases for what we do with your information, under the GDPR and the UK GDPR:

• Running your account, building and showing your games, and sending what you type to the services that build them: a contract with you (Article 6(1)(b)).
• The limits, the budget, error records and stopping abuse; reading feedback, and the requests made in the studio, to improve Teleplay: our legitimate interests in a safe, affordable service that works and gets better (Article 6(1)(f)).
• The records of how games are built, used to build your games, fix what fails, and count the limits and what is spent: a contract with you (Article 6(1)(b)).
• The same records, used to analyse what Teleplay costs and to improve it: our legitimate interests in a service that costs what we can afford and gets better (Article 6(1)(f)). You can object to this at any time by writing to info@teleplay.ai.
• The server's logs (your IP address, information about your browser, the address requested and error details): our legitimate interests in keeping the service secure and detecting attacks (Article 6(1)(f)).
• The record of what the team does in its own tools: our legitimate interest in running Teleplay securely (Article 6(1)(f)).
• Visitor analytics: your consent (Article 6(1)(a)), which you can withdraw at any time under Privacy choices, without affecting what was recorded before.
• Looking up the country of your network address to know whether to ask, and keeping your answer: our legitimate interest in asking where the law requires it, and doing what you chose (Article 6(1)(f)).
• Writing to you when you asked us to keep you posted: your consent (Article 6(1)(a)), which you can withdraw at any time.
• Meeting legal obligations (Article 6(1)(c)), and establishing or defending legal claims (Article 6(1)(f)).

You have the right to access your information, to have it corrected or deleted, to restrict how we use it, to receive it in a portable form, to object to what we do on the basis of our legitimate interests, and to withdraw consent at any time without affecting what was done before. To use any of them, write to info@teleplay.ai. You also have the right to complain to a data protection supervisory authority, in particular where you live or work.

If you are in Switzerland, Gibraltar, Jersey, Guernsey or the Isle of Man, the same applies, with the same rights, under Switzerland's Federal Act on Data Protection and the data protection laws of Gibraltar, Jersey, Guernsey and the Isle of Man.

Teleplay is run from Turkey, and the companies above process information in the United States and elsewhere, so your information is transferred outside the European Union and the United Kingdom. Each transfer to one of those companies relies on the safeguard named for that company above.

We have not yet appointed a representative in the European Union under Article 27 of the GDPR, or in the United Kingdom under Article 27 of the UK GDPR. Until we do, anyone can write to us directly at info@teleplay.ai.

If you are in the United States

We do not sell or share your personal information, as the California Consumer Privacy Act defines those words, and we have not done so in the last 12 months. We don't use it for targeted advertising or for profiling.

In the last 12 months we have collected: identifiers (your email address, username and network address), what you put into Teleplay (descriptions, games, studio messages and feedback), and records of your use of the site (requests and errors). Once visitor analytics is switched on, we also collect your activity on this site (the parts of it you use and the games you play) and your approximate location (your country), unless you decline or your browser sends Global Privacy Control. We collect them from you and your browser, use them for the purposes above, and disclose them only to the companies above, to run Teleplay.

Depending on the state where you live, including California, you may have the right to know what we hold about you, to get a copy of it, to have it corrected or deleted, and to opt out of its sale, sharing or use for targeted advertising (which we don't do). You may use them yourself or through an authorized agent, by writing to info@teleplay.ai. If we decline a request, you can appeal by replying with the word "Appeal", and we will answer within the time your state's law sets. You can also decline visitor analytics at any time under Privacy choices, and we treat Global Privacy Control as declining it.

Children

Teleplay is not for children under 13. In the European Union you must be at least 16 to make an account, unless a parent or guardian agrees for you. If we learn that a child under 13, or under 16 in the European Union without that agreement, has made an account, we delete the account, its games and its information. In Turkey, people under 18 use Teleplay only with a parent's or guardian's permission. Parents and guardians can write to info@teleplay.ai.

Security

The site is served over HTTPS only, sessions are kept in cookies that scripts on the page cannot read, keys to the services above stay on our server, and only the team can see the admin pages. No system is perfectly secure; if something goes wrong that affects you, we will tell you as the law requires.

Changes

We may update this policy. When this policy changes, the new version is posted here with its date, and if a change matters for how we use your information, we tell you in advance by email or on the site.

Contact

Teleplay's founding team, in Turkey. Email: info@teleplay.ai.