Privacy Policy

This policy explains what data mechremix ("we", "us") collects when you use the Service at mechremix.com, how we use it, and your rights over it. It applies to signed-in and anonymous visitors.

Account data — email address (required to sign in), role (user or admin), credit balance, and the history of credits granted or spent.

Content you create — source-game inputs you submit, generation prompts and results (concepts, ads, spark reports, visual assets), and feedback you leave on generated versions. Stored so you can see, refine, and share them.

Usage data — job queue entries (timing, status, errors), anonymised request logs (route, response code, latency), and aggregate metrics used to keep the Service healthy. We use Perchlens for lightweight page-view analytics (route, referrer, aggregate device class); no behavioural profiles, no advertising SDKs, no cross-site tracking.

Newsletter signups — if you submit the newsletter form, we store your email, source (e.g., footer), timestamp, and minimal request metadata (user-agent, IP) so we can debug abuse.

To operate the Service:

• authenticate you and enforce capabilities;
• run generation pipelines and return outputs;
• meter credits and prevent abuse;
• support you when you reach out.

To improve it:

• aggregate, anonymised metrics to find slow routes and broken pipelines (no raw content, no per-user profiling);
• opt-in review of a small sample of generations to improve prompt templates — we'll never use your content to train third-party AI models without explicit consent.

We use the following third-party processors. Each receives only what's needed:

• Supabase — hosts our database and handles email / OAuth authentication.
• Vercel — hosts the web application and serves static assets.
• Anthropic — runs the text models behind concept + ad + spark + GDD generation. Inputs may be retained by Anthropic for abuse monitoring per their policy.
• Google Gemini — runs vision tagging, critic passes, and image generation (nano-banana, Imagen).
• OpenRouter — optional routing layer for the same providers; used transparently.
• Perchlens — page-view analytics. Receives the URL, referrer, and aggregate device info per request; no personal identifiers, no cross-site pixels.

We don't sell your data. We don't share it with advertisers. We don't share with other parties except as required by law or to operate the Service above.

We set a session cookie (via Supabase) to keep you signed in. We use browser localStorage for UI preferences (theme, last-viewed version, command-palette state). No advertising or analytics cookies.

You can export, correct, or delete your account data at any time by emailing support@mechremix.com. Under GDPR / CCPA you have the right to access, correct, delete, port, and restrict processing of your data; we'll honour these requests within 30 days. To unsubscribe from the newsletter, use the unsubscribe link in any newsletter email, or email us.

Account + content data is retained while your account is active and for 90 days after deletion (to recover from accidental deletions or account-takeover cleanup). Job-queue rows are pruned after 180 days. Newsletter emails are kept until you unsubscribe. Request logs are retained for 30 days.

Our processors operate globally; your data may be transferred to and processed in the United States and other countries. We rely on Standard Contractual Clauses and each provider's adequacy decisions where applicable.

The Service is not intended for users under 16. We don't knowingly collect data from children. If you believe a minor has used the Service, email us and we'll delete the account.

Data is encrypted in transit (HTTPS) and at rest in Supabase. Authentication uses server-only session cookies with rotation; service-role access is strictly server-side and never exposed to the browser. We're a small team and treat every incident seriously — if we learn of a breach affecting your data, we'll notify you.

Material changes to this policy will be announced on the Service and, if you're subscribed, via email. Minor edits (typos, link fixes, clarifications) happen silently but the "Last updated" date always reflects the latest change.

Privacy questions, access / deletion requests, or "what happened to my data": support@mechremix.com.