Privacy Policy
Effective: August 20, 2026
This policy explains what data AIXX collects, why, and what you can do about it. AIXX is an independently developed and operated game platform. For anything in this policy, write to support@aixx.app.
AIXX is the data controller for the data described here.
What I collect
Account data. Email address, username, and a password hash (I never store your password itself). If you sign in from a new device, I record a device label so I can tell you about it.
Gameplay data. Match results, scores, ranking data, and match replays. A replay is a small file containing the random seed and the button inputs from a match — enough to reproduce the match frame by frame. It does not contain audio, video, or anything you typed.
Content you create. Maps you build and share, comments you write, community posts, and your profile.
AI feature inputs. When you use an AI feature — generating a map from a description, or generating a match recap — the text you provide is sent to a third-party AI provider to produce the result. Don't put personal or sensitive information into these prompts.
Voice input. If you speak to an AI feature instead of typing, the recording is sent to a third-party provider to be transcribed into text, and the text is then handled like any other AI input. The recording is not kept after transcription.
Community posts and comments. Everything you post is checked by an automated system before it is published. Your text is sent to a third-party AI provider, which decides whether it can be published and, if not, suggests a rewrite. Published posts may also be translated automatically into other languages, and are periodically re-checked after publication. There is no human moderator reading your posts — this is automated end to end.
Technical data. IP address, browser or app version, and error logs. Used for security, abuse prevention, and debugging.
Local storage. Settings, your last session, and locally saved maps are stored in your browser or app. These stay on your device.
Cookies. One cookie, set only if you pick a language yourself from the language menu. It stores that language code — de, for example — for a year, so the site opens in the language you chose instead of the one your browser asks for. It contains no identifier, and nothing on this site uses cookies for analytics or advertising. Clear it in your browser at any time; without it, the site simply follows your browser's language setting.
Payment data. I never see or store your card details. Payments are processed by Creem, who acts as the merchant of record and is the seller of record for your purchase. I receive only a transaction record and your purchase history.
Why I collect it, and on what basis
| Data | Purpose | Legal basis (GDPR) |
|---|---|---|
| Account data | Run your account, sign-in, security notices | Contract |
| Gameplay data, replays | Matchmaking, spectating, rankings, anti-cheat | Contract; legitimate interest in fair play |
| Content you create | Publish it where you chose to publish it | Contract |
| AI inputs | Produce the result you asked for | Contract |
| Technical data | Security, abuse prevention, debugging | Legitimate interest |
| Language cookie | Open the site in the language you picked | Legitimate interest in a preference you set yourself |
| Purchase records | Deliver what you bought, support, accounting | Contract; legal obligation |
Who else sees your data
I keep this list short on purpose.
| Who | What they get | Why |
|---|---|---|
| Creem (Armitage Labs OÜ, Estonia) | Payment and billing data | Merchant of record, tax handling |
| Email provider | Your email address and message content | Verification codes, password resets, security notices |
| AI provider(s) | The prompt text you submit to an AI feature; the text of posts and comments you write | To generate the result; to moderate and translate community content |
| Hosting provider | Technical data in the ordinary course of serving the app | To run the service |
I don't sell your data. I don't share it for advertising.
Where your data goes
Servers are located outside the EU. Where personal data of EEA or UK users is transferred, I rely on the appropriate safeguards offered by the providers involved, including standard contractual clauses where applicable.
How long I keep it
- Account data — while your account exists, then deleted within 30 days of account deletion.
- Replays and match records — up to 12 months, then deleted or anonymized.
- Content you published — until you delete it, or your account is deleted.
- Purchase records — as long as tax and accounting law requires.
- Logs — up to 90 days.
Your rights
You can ask me to: give you a copy of your data, correct it, delete it, restrict how I use it, or object to processing based on legitimate interest. You can also withdraw consent where consent is the basis.
Write to support@aixx.app. I'll respond within 30 days. If you're in the EEA or UK and you're not satisfied, you can complain to your local data protection authority.
Deleting your account removes your account data and unpublishes your content. Matches you played in may remain visible to other participants in their own match history, because those records belong to them too.
Children
AIXX is not for children under 13. If you're in the EEA and under 16, you need a parent or guardian's consent to use AIXX. If I learn that a child under 13 has an account, I'll delete it.
Security
Passwords are hashed with scrypt. Session tokens are stored hashed, never in plain text. Traffic is encrypted in transit. No system is perfectly secure, but I don't store what I don't need — which is why there are no card numbers here to lose.
Changes
If this policy changes in a way that matters, I'll tell you by email or in the app before it takes effect. The date at the top always reflects the current version.
Contact
AIXX · support@aixx.app · https://aixx.app