GameArtForge - Privacy Policy

1. Introduction

GameArtForge ("we", "our", or "us") operates gameartforge.com. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you visit our website and use our services. Please read this policy carefully.

2. Information We Collect

2.1 Account Information

When you register for an account, we collect:

• Email address
• Display name (optional, can be a nickname)
• Avatar image (if you upload one)
• Authentication credentials (managed securely by Supabase Auth)

2.2 Subscription and Payment Information

When you subscribe to Pro membership, payment is processed by our Merchant of Record, Creem. We receive and store:

• Subscription status and plan type
• Creem customer ID and subscription ID
• Subscription period start and end dates

We do not store your credit card number, billing address, or other payment details. All payment processing is handled securely by Creem.

2.3 Usage Data

We automatically collect limited technical information when you use the site, including:

• IP address (anonymized where possible)
• Browser type and version
• Pages visited and time spent
• Referring website addresses

This data is collected via Cloudflare analytics and server logs to help us improve the service and maintain security.

3. How We Use Your Information

We use the collected information to:

• Create and manage your user account
• Provide and maintain access to Pro content based on your subscription status
• Process subscription payments and renewals via Creem
• Send important service-related notifications (e.g., subscription expiry)
• Respond to your support requests sent to gaf@gameartforge.com
• Monitor and improve website performance, features, and user experience
• Detect, prevent, and address technical issues, fraud, or security breaches

4. Third-Party Service Providers

We rely on the following trusted third-party services to operate GameArtForge:

• Supabase — Authentication, database, and server-side functions. Data stored on Supabase's secure infrastructure (Singapore region). Privacy Policy
• Creem — Payment processing and Merchant of Record. Handles all payment card data and global tax compliance. Privacy Policy
• Cloudflare — CDN, DNS, and security services. Provides DDoS protection and web traffic routing. Privacy Policy

These providers receive only the information necessary to perform their specific functions and are bound by their own privacy obligations.

5. Cookies and Local Storage

We use browser local storage (not traditional tracking cookies) for essential functionality:

• Authentication session — To keep you logged in during your visit
• Language preference — To remember your chosen language (English / 中文)

We do not use third-party advertising cookies or cross-site tracking technologies. You can clear local storage data at any time through your browser settings.

6. Data Retention

We retain your personal information for as long as your account is active. If you request account deletion, we will delete your personal data within 30 days, except where we are legally required to retain certain records (e.g., transaction records for tax and compliance purposes, which are retained by Creem as Merchant of Record).

7. Data Security

We implement industry-standard security measures including:

• HTTPS encryption for all data in transit
• Row Level Security (RLS) on all database tables to prevent unauthorized access
• Secure authentication via Supabase with industry-standard password hashing
• Restricted access to user data on a need-to-know basis

However, no method of transmission over the Internet is 100% secure. We strive to protect your data but cannot guarantee absolute security.

8. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access — Request a copy of the personal data we hold about you
• Correction — Request correction of inaccurate or incomplete data
• Deletion — Request deletion of your personal data
• Data Portability — Request a machine-readable copy of your data
• Objection — Object to certain types of processing

To exercise any of these rights, contact us at gaf@gameartforge.com. We will respond within 30 days.

9. International Data Transfers

Your data may be processed in countries other than your country of residence, including Singapore (where our Supabase database is hosted). These countries may have different data protection laws. We take steps to ensure appropriate safeguards are in place through our service providers' compliance with relevant regulations.

10. Children's Privacy

GameArtForge is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe we have inadvertently collected such information, please contact us and we will promptly delete it.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will revise the "Last updated" date at the top of this page. We encourage you to review this page periodically. Continued use of the service after changes constitutes acceptance of the updated policy.