Privacy policy
This policy explains what personal data RuneCode Studio ("the Service") collects, why we collect it, who else handles it, how long we keep it and what you can do about it. We keep it short and specific on purpose.
1. Who we are
The Service is operated by Wizards ("we", "us"), a game studio in Las Vegas, Nevada, USA (wizards.global). We decide why and how the data described here is used. Contact: fernando@wizards.global.
2. Who this covers
The Service is a business tool for game studios ("publishers") and their staff, and for Wizards staff who review games. This policy covers people who sign in to it and people who open a test link that a publisher shared. It does not cover casino operators' players: the Service handles no real-money play and no player accounts.
3. What we collect
| Data | Why we need it |
|---|---|
Account details: name, email address, and the identifier your sign-in provider gives us. If you sign in with Google we receive only your name, email address and a stable Google account identifier (the openid, email and profile scopes). | To create your account, show who did what, and contact you about the Service. |
| Sign-in security: your second-factor enrolment (an authenticator app), sign-in and step-up confirmations, and session records. We never see or store your Google password. | To protect accounts. Sensitive actions ask you to confirm again. |
| Team and publisher data: the publisher you belong to, your role, invitations, approvals, comments, support tickets and notifications. | To run team access and the review process. |
| Content you upload: game math and front-end files, listing text and images, versions and review submissions. | To test, scan, review and publish your game. You keep your rights in it (see the terms). |
| Activity records: an append-only audit log of important actions (who, what, when). | Security, accountability and the four-eyes review process. |
| Technical data: IP address, browser type, requested page and time, in server and network logs. | To keep the Service secure, stop abuse and fix faults. |
| Test-link visitors: when you open a shared test link we record technical data only. You do not need an account unless the publisher asked for sign-in, and every play uses play money. | To run the test session and prevent abuse. |
We do not ask for payment card, bank or government identity numbers in the Service, and we do not collect precise location.
4. How we use it, and our legal bases
- To provide the Service you asked for (account, teams, uploads, tests, reviews) — performance of a contract.
- To keep it secure and prevent abuse (sign-in checks, logs, rate limits) — our legitimate interests.
- To keep an accurate audit trail of reviews and approvals — our legitimate interests and, for regulated games, legal and certification obligations.
- To reply to you about support and the Service — contract and legitimate interests.
We do not sell personal data, we do not use it for advertising, and we do not use analytics or advertising trackers. No personal data about you is sent to AI models.
5. Who handles it for us
We use a small number of service providers who process data only on our instructions:
- Amazon Web Services — hosting, storage and queues, in the US East (Ohio) region.
- Amazon Cognito — sign-in and second factor.
- Google — only if you choose "Sign in with Google". Google's own privacy policy applies to your Google account.
- Cloudflare — network protection, caching and access control in front of the Service.
Within the Service, your name and email are visible to other members of your publisher and to Wizards staff who review or support it. We disclose data to authorities only when the law requires it.
Google user data. Our use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use it only to sign you in and identify you in the Service.
6. International transfers
Data is stored in the United States and may be handled by our providers in other countries. Where the law requires it we rely on appropriate safeguards, such as standard contractual clauses with our providers.
7. How long we keep it
- Account and team data: while your account or publisher is active, then only as needed for legal, security and audit reasons.
- Sign-in state: short-lived; sessions and sign-in challenges expire automatically.
- Temporary builds and test links: expire automatically after a limited time.
- Server logs: kept for a limited period for security and diagnostics.
- Audit log: kept so reviews stay verifiable. If you ask us to delete your account we erase your name and email from it, and the record of the action itself stays without them.
8. Security
Connections are encrypted. Sessions use a secure, HttpOnly cookie. Accounts support a second factor, and sensitive actions ask you to confirm again. Access to staff functions is limited by role. No system is perfectly secure, and we will tell you and the authorities where the law requires after a breach affecting your data.
9. Cookies
We use only what the Service needs to work: a session cookie (__Host-studio_session) that keeps you signed in, and a short-lived cookie used during sign-in. Both are strictly necessary, secure and HttpOnly. We do not use advertising or analytics cookies, so there is no cookie banner to accept.
10. Your rights
Depending on where you live (for example the EEA, the UK or California) you can ask us to give you a copy of your data, correct it, delete it, restrict or object to some uses, or move it to another service. You can also withdraw a Google sign-in at any time in your Google account settings. Email fernando@wizards.global and we will answer within 30 days. We will not treat you worse for using your rights. You may also complain to your local data-protection authority.
11. Children
The Service is for business users and is not meant for anyone under 18. We do not knowingly collect data from children; if you think we have, tell us and we will delete it.
12. Changes
If we change this policy in a way that matters we will update the date above and, for signed-in users, tell you in the Service. Earlier versions are available on request.
13. Contact
Wizards · Las Vegas, Nevada, USA · fernando@wizards.global