The short version: we collect what we need to run Habiv, count plays fairly and show creators how their games are doing. Creators only see totals, never who you are. We don't sell personal data, we don't show ads, and we don't use third-party tracking cookies.
Who we are
Habiv is run by Habiv, the controller of the personal data described here. Contact us about privacy at support@habiv.com.
What we collect
Your account
Your email address and password (stored as a hash by our authentication provider). If you sign in with Google or GitHub, we receive your email address, name, profile picture and an account ID from that provider.
Your public profile
Your @handle, display name, avatar, bio, pronouns, up to three links, follower counts, and previous handles (so that old links redirect).
What you publish and do
Games you upload (files, title, tagline, description, tags, controls, cover art), the model, tool, prompt and changelog you add to a version, and your comments, likes, saves, follows, reports and blocks.
Play and usage data
When you open or play a game, we record:
- a random anonymous player ID, kept in a cookie (see our Cookie Policy), and a session ID for the current tab;
- events such as page views, plays, run start and end, duration, score, level reached, outcome, likes and shares;
- the website that sent you (host name only) and campaign tags in the link (UTM parameters);
- your device type, operating system and browser, worked out from your browser's user agent;
- your country, worked out from your IP address by our hosting provider. Our analytics store the country, not the IP address.
If you are signed in, this data is linked to your account. When you sign in, earlier anonymous plays from the same browser are linked too, so your scores follow you.
Connected apps
The names of apps and AI agents you connect, the scopes you approve, when each token was last used, and a hash of each token (never the token itself).
Technical logs
Like any website, our hosting and infrastructure providers process IP addresses and request logs to deliver pages and keep the service secure. We also use Vercel Web Analytics, which counts page views in aggregate without cookies.
Messages to us
Anything you send us by email, such as support requests, reports and appeals.
How we use it
- To run Habiv: accounts and sign-in, publishing, playing, saving, following, comments, notifications and leaderboards.
- To show creators how their games are doing: totals such as plays, unique players, completion, retention, countries, devices and referrers. Creators never see which person did what, except for things you do publicly, like comments and leaderboard entries.
- To rank and recommend games, for example Trending and Most played.
- To keep Habiv safe and fair: scanning uploads, stopping cheating, spam and abuse, rate limiting, and moderation.
- To talk to you: sign-in and password emails, replies to your messages, and important notices about the service or these policies.
- To improve Habiv, and to meet legal obligations.
We don't sell personal data, share it for advertising, or use it to make decisions that have legal or similarly significant effects on you.
What is public
Your profile, your published games and their details (including prompt, model and tool), your comments, who you follow and who follows you, and your leaderboard entries (handle and score). Only you can see your likes and your saved list.
Games you play
Each game runs in a sandboxed frame on a separate domain, so it can't read your Habiv session or cookies. Game saves are stored in your browser. Games are made by creators; tell us if one behaves in a way you don't expect.
Legal bases (EEA and UK)
- Contract: providing the account and features you ask for.
- Legitimate interests: play counts, creator analytics, security, anti-cheat, moderation and improving Habiv. These are balanced against your rights, and you can object.
- Consent: where the law requires it. You can withdraw consent at any time.
- Legal obligation: where we must keep or disclose data.
Who we share it with
These service providers process data for us, under contracts that limit its use to providing their service:
- Supabase: database, authentication and file storage.
- Vercel: website hosting, scheduled jobs and aggregate web analytics.
- Cloudflare: serving game files from the separate game domain.
- GitHub: automated jobs that check and convert uploaded games, and sign-in with GitHub if you choose it.
- Google: sign-in with Google, if you choose it.
We may also disclose data if the law requires it, to protect people's safety or our rights, or as part of a merger, acquisition or sale of the service. If that happens, this policy continues to apply to your data.
How long we keep it
- Raw play events: about 14 days, after which only daily totals remain.
- Runs, scores and aggregate stats: for as long as the game is on Habiv, so that leaderboards and totals stay correct.
- Account, profile and content: until you delete them or your account.
- Backups and logs: deleted on the providers' normal cycles.
Your rights and choices
You can edit your profile in Settings and delete games from My games. Depending on where you live, you can also ask to access, correct, export or delete your data, restrict or object to how we use it, and withdraw consent. To do this, email support@habiv.com from the address on your account. We reply within 30 days. Deleting your account removes your profile, games and comments. Anonymous totals that can no longer identify you may remain.
If you are in the EEA or UK, you can also complain to your data protection authority. California residents: we don't sell or “share” personal information as those terms are defined in the CCPA, and we don't discriminate against anyone for using their rights.
Children
Habiv is not for children under 13, and we don't knowingly collect their personal data. If you think a child has given us data, email support@habiv.com and we will delete it.
International transfers
Our providers may process data outside your country, including in the United States. Where the law requires it, transfers are covered by safeguards such as the European Commission's Standard Contractual Clauses.
Security
We use encryption in transit, row-level access rules in our database, hashed tokens and sandboxed game execution. No system is perfectly secure, so please use a strong, unique password.
Changes
If we make material changes to this policy, we'll post them here and give notice before they take effect. The date at the top shows the last update.