Privacy Policy

Effective date: October 10, 2026

This Privacy Policy explains how Craft A World collects, uses, stores, shares, and protects information when you use our website, platform, forms, analytics systems, and related services.

Craft A World is operated by Effective Product Management, Petah Tikva, Israel, which is the controller responsible for the processing described in this Privacy Policy unless another controller is specifically identified.

For privacy questions or requests, use the privacy and legal contact form. If you are signed in, you may also use the in-app feedback/contact button.

1. Information We Collect

Craft A World is designed to collect as little identifiable information as reasonably possible.

We may collect the following categories of information:

Account Information

If account registration is available, we may collect information required to create and manage your account, such as your email address, login credentials, and related account metadata.

Feedback and Contact Forms

If you submit a feedback form, contact form, or similar contact form, we collect the information you choose to provide and the diagnostic information identified by that workflow.

We do not require you to provide identifiable information unless it is necessary for us to respond to you. If you choose to provide your name, email address, company name, or other contact details, we may use that information to reply to your inquiry, ask follow-up questions, or tell you that a reported issue has been resolved.

Generation failure support

If you choose to send a generation-failure report, Effective Product Management uses it to investigate the failure, reproduce the problem, respond to you and resolve the reported issue. Sending a report is optional. If you cancel, no support case is created and you can continue using Craft A World.

The report includes a snapshot of the map template, its generation seed when available, the displayed error, the application version and an internal case reference. It is linked to your Craft A World Account. Available diagnostics are limited to the reported generation request and may include the failure stage, predefined failure categories, attempt/retry counts, timings and bounded diagnostic observations. Coarse browser, operating-system and device categories are included only when available and identified before sending.

We capture the usable email address and optional name on your Account when the case is submitted. We may use that contact information to ask necessary follow-up questions and send a resolution notice. Human support messages and information you choose to provide in replies form part of the support correspondence. Please avoid including passwords, sensitive personal information or information about other people in a template or support message.

Access is restricted to our authorized support operator. Automatic case notifications contain a minimal case reference and an authenticated Admin link. They do not contain your template, seed, displayed error, diagnostic contents or Account contact snapshot. Deliberate follow-up/resolution messages use your contact address and contain the support message itself.

Support-case contents and correspondence are kept separate from Plausible and per-case product analytics. Support reporting uses limited daily totals for submission, first resolution and first closure, without case, Account, contact, template, seed, error or browser dimensions.

Product Analytics

Our servers collect limited information about how the authenticated Craft A World product is used and how well its product flows perform. This may include:

Which product features are used.
Whether an activity started, progressed, completed, failed, was cancelled, or timed out.
General categories of difficulties or errors, without the content involved.
Generation reliability, repeated attempts, and performance measurements.
Measurements such as how long an activity takes or the general size of its output.
Repeat or unique usage where needed to understand product adoption.

We collect these records only for production customer activity. Internal administration, testing, monitoring, development, and other non-customer activity is excluded from customer product metrics.

Some records use a pseudonymous product-analytics identifier so that we can measure repeat or unique usage without storing the Craft A World account identifier in these records. We treat this as pseudonymous personal data, not as anonymous data. We may also link records belonging to the same product activity without directly identifying the account.

Product analytics is designed not to include the content you create or submit. We do not intentionally include names, email addresses, direct or encoded account or application-record identifiers, IP addresses or hashes, User-Agent data, device fingerprints, cookies, URLs, queries, referrers, file names, free text, prompts, AI responses, credentials, templates, maps, dungeon content, support correspondence, logs, stack traces, raw errors, or validation messages in product-analytics events.

Product analytics is separate from Plausible public-website analytics, identifiable support cases, operational and security logs, billing and quota records, and AI-provider and AI-usage records. We do not intentionally join product-analytics identity with those systems to build cross-system profiles.

Plausible Analytics

We use Plausible Analytics, operated by Plausible Insights OÜ, Estonia, as our processor for limited analytics about visits to the public Craft A World website.

Plausible Analytics is limited to our public home, documentation, contact, terms of use, privacy policy, sign-in, and sign-up pages.

It is not enabled within the signed-in product, account management, support, administration, or on other pages and service endpoints.

We use these analytics only to understand aggregate website traffic, the relative popularity of public pages, external referral sources, broad geographic patterns, browser, operating-system and device categories, and how the public website can be improved.

We do not intentionally send Plausible Analytics:

Names.
Email addresses.
Account identifiers.
User or customer identifiers.
Template content.
Map content.
Support-case information.
Free-text input.
Custom properties.
Product events.

For measured pages, we share only the public page address with Plausible. Additional URL details, such as search parameters and fragments, are removed before sharing. We do not collect campaign-tracking parameters.

Like a normal web request, a request to Plausible includes an IP address and User-Agent. Plausible processes those values transiently to derive information such as approximate country, region or city, browser, operating system and device category, and to generate a daily visitor value used for aggregate visitor counting.

Plausible states that it does not store the raw IP address or full User-Agent string and does not use analytics cookies, browser local storage, cross-site tracking identifiers, or a persistent visitor identifier.

The daily visitor value is not designed to identify a visitor across different days.

2. How We Use Information

We use collected information to:

Operate the website and platform.
Provide account-based access.
Generate and store maps and templates.
Improve product functionality.
Understand product usage and product-flow outcomes.
Measure product reliability and performance.
Identify predefined categories of product friction or technical failure.
Respond to feedback or contact requests.
Improve performance, reliability, and user experience.
Develop future features, including SDK-related capabilities.

Product Analytics

We use product analytics to understand whether important product capabilities and flows are used, whether operations reach their expected outcomes, where predefined categories of friction or failure occur, and how product operations perform over time. We use aggregate patterns from this information to make product and engineering decisions and improve Craft A World.

We do not use product analytics for advertising, behavioral advertising, retargeting, cross-site tracking, marketing profiling, sale of personal information, session replay, or automated decisions about individual users.

Legal Basis for Server-Side Product Analytics

Where the GDPR or UK GDPR applies, we rely on our legitimate interests in operating, understanding, maintaining, and improving Craft A World for the limited server-side product analytics described in this Privacy Policy.

In assessing those interests, we take into account the limited purposes of the analytics, data minimization, purpose-specific pseudonymization where repeat or unique usage needs to be measured, exclusion of user-created content and direct identifiers, separation from unrelated data systems, defined retention and deletion periods, and applicable privacy rights.

For Plausible Analytics specifically, our purpose is limited to aggregate measurement of the public website as described in Section 1.

We do not use Plausible Analytics visitor data for:

Advertising.
Behavioral advertising.
Profiling individual visitors.
Retargeting.
Selling personal information.
Cross-site tracking.
Automated decisions about individual visitors.

Legal Basis for Public-Website Analytics

Where the GDPR or UK GDPR applies and the limited analytics processing described above constitutes processing of personal data, we rely on our legitimate interests in understanding the aggregate use and reach of our public website and improving that website.

In assessing that interest, we take into account the limited set of measured public pages, exclusion of authenticated and product routes, data minimization, absence of persistent visitor identifiers, limited purpose, and the fact that the analytics are not used for advertising, profiling, retargeting or automated decisions.

Our Plausible configuration does not set an analytics cookie or use browser local storage for analytics. On that basis, our current implementation does not request prior consent or display an Accept/Reject analytics banner solely for Plausible Analytics.

This does not limit any transparency, objection, consent, or other requirement that may apply under the law of a particular jurisdiction.

Requested support and its legal basis

Where GDPR or UK GDPR applies, our basis for the limited support processing is our legitimate interest in investigating and resolving a problem you choose to report and maintaining a reliable service. We consider your reasonable expectations, the limited purpose, restricted access, minimized diagnostics, specific retention schedule and ability to request deletion or object. We do not use the report for advertising, marketing profiling or unrelated contact.

Where informed voluntary agreement is required for this support request, choosing Send report after the disclosure is your agreement to the described support processing. You can choose Cancel instead. You may withdraw that agreement through our privacy contact channel; withdrawal does not make earlier lawful processing unlawful and legal exceptions may require limited retention. The public-site analytics choice does not determine this requested support work.

3. Pre-Alpha Data Risk

Craft A World is currently in pre-alpha.

Because of this, data may be lost, corrupted, accidentally deleted, or made unusable due to technical problems or changes to the service.

You should not rely on Craft A World as a permanent storage system during the pre-alpha period.

4. Data Retention

We may retain account information, generated maps, templates, form submissions, feedback, and related platform information for as long as reasonably needed to operate, improve, debug, secure, and develop the platform, subject to applicable law and any more specific retention commitments.

Feedback and contact-form submissions may currently be retained indefinitely unless deletion is requested and deletion is legally and technically appropriate.

Generation failure support retention

We keep a case while support is active. After 90 days without activity or review, open, investigating or resolved cases require an operator review. A case waiting for your reply closes after 90 days. We remove ordinary closed case contents and our governed correspondence copies no later than 90 days after closure.

Account deletion or a verified support-deletion request suppresses further support contact and permanently closes the related cases. We remove the active case contents and governed copies within 30 days, or sooner when an applicable rights deadline requires it. A documented legal exception may require keeping only the necessary information for an active dispute, security/fraud investigation or statutory obligation. Such holds are reviewed at least every 90 days.

Restricted reproduction copies of your template and generated test maps are removed when closure/deletion is known, and expire no later than 30 days after import. Offline copies are cleaned when their restricted workspace next runs; expired copies cannot be used. We do not claim physical erasure from an offline machine before that cleanup occurs.

Non-identifying completion receipts and daily milestone totals are retained for 12 months. They contain no reverse lookup to your Account or case. Our backups age out through the documented recovery process, and due deletion is reapplied before restored data returns to active use. Email providers may retain delivery, recovery or backup copies under their own published policies and legal duties; our active-copy deletion does not guarantee simultaneous physical erasure from all provider systems. See the providers and rights sections below.

Product Analytics

Raw product-analytics events are retained for no more than 13 months.

Applicable subject-linked product analytics are removed from active product- analytics systems within 30 days following a valid account-deletion request, verified privacy-deletion request, or successful objection where deletion is required.

Copies of information removed from active systems may remain temporarily in disaster-recovery backups until those backups are overwritten or expire under our documented backup-retention process. During that period, the information is kept out of active use and is not used for product analytics. Before a restored backup is returned to active use, applicable deletion requirements are reapplied.

We do not currently create a separately retained, subject-linked product- analytics aggregate with a longer retention period.

Plausible Analytics visitor analytics are retained for no longer than three years.

If Craft A World stops using Plausible Analytics, we will delete the Craft A World site from the Plausible service and delete the retained analytics associated with that site.

Before deletion, Craft A World may retain a separately approved export containing aggregate analytics if there is a documented business or legal reason to retain it. Any such export will be subject to its own approved purpose, access controls, and retention decision.

We do not rely on an indefinite-retention period for Plausible Analytics.

5. Sharing of Information and Analytics Processors

We do not sell personal information.

We may share limited information with service providers that help us operate Craft A World, such as hosting providers, infrastructure services, database providers, authentication providers, analytics providers, or contact-form tools. These providers may process information only as needed to provide the services for which they have been engaged, subject to applicable contractual and legal requirements.

Support providers

Support case storage uses Hetzner Online GmbH infrastructure in Germany. Our disaster-recovery copies are held in Germany and Israel. Mailtrap, operated by Railsware Products Studio LLC in the United States, delivers support emails and processes their contents, recipient addresses and delivery information. Google provides the Gmail mailbox used for operator support correspondence. These email providers may process information outside your country, including in the United States.

Mailtrap's Privacy Policy and Data Processing Addendum describe its email processing and deletion arrangements. Google describes Gmail-related processing in its Privacy Policy and data retention guidance. Provider copies may be subject to recovery delays or legally required retention. Copies held by recipients of an email are controlled by those recipients.

For international transfers, applicable mechanisms may include adequacy decisions, participation in the relevant Data Privacy Framework, or contractual safeguards. Ask us through the privacy contact channel for information about the mechanism applicable to your support data. We do not promise that email data stays only in the EEA or that a consumer Gmail mailbox has a Google Workspace DPA.

Product Analytics

Product-analytics information is processed and stored by our hosting provider, Hetzner Online GmbH in Germany. Disaster-recovery backup copies are stored in Germany and Israel under the backup process described in Section 4.

Access to the product-analytics system and its backups is restricted to the controller's authorized operator. Product-analytics information is not intentionally sent to Plausible Analytics, AI providers, support systems, or other unrelated systems to combine identities or build cross-system profiles.

For public-website visitor analytics, Plausible Insights OÜ acts as our analytics processor.

According to Plausible's current service documentation, the subprocessors that handle website visitor analytics data are:

Hetzner, Germany - server infrastructure and hosting.
Bunny, Slovenia - website delivery and protection.
UpCloud, Finland - data hosting and storage.

Plausible states that these are the current subprocessors that touch website visitor analytics data and that such visitor data is processed and stored within the European Union.

We may also disclose information if required by law or legal process, or where reasonably necessary for security, fraud prevention, or protection of the rights, safety, and integrity of Craft A World, our users, or third parties.

6. Cookies and Similar Technologies

Craft A World may use cookies or similar technologies where they are necessary for authentication, account sessions, security, abuse prevention, or other essential platform functionality.

These essential cookies are separate from public-website analytics.

Plausible Analytics does not use an analytics cookie or browser local storage for the visitor analytics described in this Privacy Policy.

Accordingly, Craft A World's current Plausible implementation does not display an Accept/Reject analytics-cookie banner solely for Plausible Analytics.

Disabling essential authentication or security cookies through your browser may prevent some authenticated or protected Craft A World functionality from working correctly.

7. Data Security

We use reasonable technical and organizational measures to protect information.

However, no system is completely secure. Because Craft A World is in pre-alpha, the platform may contain bugs, incomplete security controls, or operational weaknesses.

You use the platform at your own risk.

8. User Rights and Requests

Depending on where you are located and the law that applies, you may have rights regarding your personal information, including rights to access information, request correction, request deletion, restrict certain processing, or object to certain processing.

To submit a privacy request, use the privacy and legal contact form. If you are signed in, you may also use the in-app feedback/contact button.

Email is optional on the contact form. If you want a response, or if you are asking us to access, correct, delete, or otherwise act on account-related information, include an email address or enough account-identifying information for us to verify and respond to the request.

We may need to verify your identity proportionately before fulfilling certain requests. Depending on the law that applies, you may also have the right to lodge a complaint with a competent data-protection or privacy authority.

Support information and requests

Depending on applicable law, you may ask to access, correct or delete your support information, restrict processing, object to processing based on legitimate interests, or withdraw voluntary agreement where that is the applicable basis. Use our privacy and legal contact form; signed-in users may also use the in-product contact path. Include enough information for us to verify your identity and identify the case. We do not give another person's records to you merely because an email address matches.

We aim to fulfil valid support requests within 30 days and respond within the applicable legal deadline, including the generally applicable one-calendar-month period for GDPR/UK GDPR requests. We act sooner when that deadline is shorter. Where the law permits an extension or refusal, we explain the reason and your available options within the required period. You may complain to the competent privacy/data-protection authority.

A self-service copy may omit other people's information and separately governed security records. Our operator assesses broader requests and provider-held correspondence through the privacy process. Limited, genuinely non-identifying receipts and totals cannot be retrieved as your individual case history.

Product Analytics

Where applicable law gives you a right to object to server-side product analytics processed on the basis of legitimate interests, you may submit an objection using the privacy contact methods above. We will assess your objection based on your circumstances and take the action required by applicable law.

When an objection is upheld, we stop recording future subject-linked product- analytics events for the affected account and remove applicable existing subject-linked records from active product-analytics systems within 30 days. The backup treatment described in Section 4 continues to apply.

Where a valid account-deletion or verified privacy-deletion request applies to pseudonymously linked product-analytics data, applicable records are removed from active systems within 30 days.

Some analytics records intentionally contain no direct account identifier or other retained information that reasonably lets us associate a particular record with a requesting person. Where we cannot reasonably identify a record as relating to you, we may be unable to retrieve, correct, or delete that specific record as your information. This limitation does not affect rights regarding information that Craft A World can reasonably identify as relating to you.

Plausible Analytics

Plausible Analytics does not retain a raw IP address, full User-Agent string, account identifier, or persistent visitor identifier that allows us to connect historical website analytics events to a named Craft A World user.

As a result, we generally cannot locate a specific historical Plausible Analytics event by using your name, email address, Craft A World account identifier, or current IP address. A request to delete or correct an individual historical Plausible event may therefore not be technically applicable where there is no retained identifier that allows that event to be identified as yours.

This does not affect your rights regarding other personal information that Craft A World can reasonably identify, and we will assess requests and objections in accordance with applicable law.

9. Children

Craft A World is intended for game developers and creators. You must be at least 13 years old, and at least the higher minimum age required by the law that applies to you, to use the service.

If we learn that we have collected personal information from a child without appropriate consent, we will take reasonable steps to delete it.

10. International Use and Analytics Data Location

Craft A World is available worldwide and may be accessed from different countries.

For Plausible Analytics specifically, Plausible states that website visitor analytics data is processed and stored within the European Union. Its current visitor-data infrastructure and subprocessors described in Section 5 are located in Germany, Slovenia, and Finland.

Product-analytics information is processed and stored in Germany by our hosting provider, Hetzner Online GmbH. Disaster-recovery backup copies are stored in Germany and Israel. Effective Product Management operates from Israel.

Other information processed by Craft A World may be processed or stored in countries other than your own depending on the systems and service providers involved. Where required, we apply appropriate safeguards for international transfers of personal information.

11. Changes to This Privacy Policy

This is Privacy Policy Version 1.3, effective October 10, 2026. This version explains generation-failure support reports, support correspondence, the providers used for that work, and the specific support retention and rights procedures. The existing public-website and server-side product-analytics disclosures continue to apply to their separate processing.

We may update this Privacy Policy again as our services, providers, or legal obligations change. For material changes, we provide notice through the website, in the product, by email or another appropriate method. Continued use is not a substitute for affirmative consent where applicable law requires it.

12. Contact and Controller

Data controller: Effective Product Management

Controller location: Petah Tikva, Israel

Privacy contact: privacy and legal contact form

If you are signed in, you may also use the in-app feedback/contact button.

Include contact details if you need us to respond. If your request concerns account information or another data set that requires identity verification, provide enough information for us to reasonably verify and process the request.