Privacy Policy

1. Introduction

Exekite ("Exekite", "we", "us", or "our") respects your privacy and is committed to protecting your personal information. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website at exekite.com, our platform, applications, and related services (collectively, the "Service").

By using the Service, you agree to the collection and use of information as described in this Privacy Policy. If you do not agree, please do not use the Service.

2. Information We Collect

2.1 Information You Provide

We collect information you voluntarily provide when using the Service:

• Account information: Name, email address, and password when you create an account
• Payment information: Billing address and payment method details, processed securely through our third-party payment processor (we do not store full credit card numbers)
• Profile information: Display name, avatar, and other optional profile details
• Game content: Text descriptions, creative direction, feedback, and other inputs you provide when creating games
• Communications: Messages you send to us through the contact form, email, or support channels
• Waitlist information: Email address and selected plan tier when joining our waitlist
• Onboarding and feedback answers: What you told us you came to do, and optional reasons you gave for not subscribing, kept while your account exists and erased with it

2.2 Information Collected Automatically

When you access the Service, we automatically collect certain technical information:

• Device information: Browser type and version, operating system, device type, and screen resolution
• Usage data: Pages visited, features used, time spent on pages, click patterns, and referring URLs
• Account-linked daily usage: Which days you were signed in to the studio, hub or exekite.com, with the first and last time seen that day, and for the studio a daily count of pages opened and time spent — never which pages, and never clicks
• Log data: IP address, access timestamps, error logs, and request metadata
• Location data: Approximate geographic location derived from your IP address (country/region level only)

2.3 Cookies and Tracking Technologies

We use cookies and similar technologies to:

• Essential cookies: Maintain your session and authenticate your account (required for the Service to function)
• Analytics cookies: Understand how users interact with the Service to improve functionality and user experience
• Preference cookies: Remember your settings and preferences
• Marketing cookies: Measure the effectiveness of our marketing campaigns and deliver relevant content

You can manage cookie preferences through your browser settings. Disabling certain cookies may affect the functionality of the Service.

2.4 Connected Assistants (MCP)

If you connect an assistant to Exekite, you sign in to Exekite and choose the permissions and games the connection may access. We store the connection's client identifier, granted permissions, project selection, authorization status, and authentication records to enforce that choice. We receive the requests the assistant sends to Exekite tools, including any instructions, game source, files, or asset inputs included in those requests. Connecting does not automatically send us your entire conversation with the assistant.

Tool responses can return permitted project information, source files, operation results, errors, gameplay images, and requested download or preview links to the connected assistant. We retain operation records and saved work so interrupted operations can be tracked and recovered. Your assistant provider handles the requests and responses it receives under its own privacy policy; disconnecting Exekite does not erase copies already held by that provider.

Cloudflare provides the infrastructure that stores project and operation data and runs Exekite's hosted tools. Optional asset-generation requests send the relevant prompts and media inputs to fal.ai and the selected generation service. These requests are separate from supplying and testing your assistant's own game code. Exekite does not invoke another model author to rewrite code supplied through this connector.

You can revoke a connection in Studio. Revocation prevents further authenticated tool access through that connection; it does not undo completed edits, remove your projects, or guarantee that a request already accepted by an external generation provider can be stopped. Existing operations are reconciled to determine their outcome and any charge. Already-issued upload, download, and private preview links can remain usable until their expiry after a connection is revoked. Public sharing is a separate action: anyone with a public play link can access the shared game. Private preview links expire within one hour, and upload links expire after fifteen minutes; these access limits are not promises that all related operation records are erased at expiry.

Connector drafts and operation records are retained for tracking and recovery while your account is active. Section 6 describes the account and project deletion controls. Account deletion through Studio also starts erasure of connector uploads, saved drafts, result media, and private previews; delayed writes and interrupted deletion can require later storage cleanup retries. Financial and security records may remain where needed for the purposes described in this policy. Export anything you want to keep before deleting your account.

3. How We Use Your Information

We use the information we collect for the following purposes:

3.1 Providing the Service

• Creating and managing your account
• Processing your game creation requests and generating AI content
• Building, compiling, and publishing your games
• Processing payments and managing subscriptions
• Providing customer support

3.2 Improving the Service

• Analyzing usage patterns to improve features and user experience
• Training and improving our AI models (see Section 4 for details)
• Identifying and fixing bugs and technical issues
• Conducting internal research and development

3.3 Communication

• Sending transactional emails (account confirmation, password resets, billing receipts)
• Notifying you of Service updates, new features, or changes to terms
• Sending marketing communications (with your consent, and you may opt out at any time)
• Responding to your inquiries and support requests

3.4 Safety and Compliance

• Enforcing our Terms of Service and Acceptable Use policy
• Detecting and preventing fraud, abuse, and security threats
• Complying with legal obligations and responding to lawful requests

4. AI Training and Your Data

Transparency about how we use your data in relation to our AI is important to us.

4.1 How AI Processes Your Input

When you create a game, your text descriptions and feedback are processed by our AI models to generate game code, assets, and builds. This processing is necessary to provide the Service.

4.2 AI Model Training

We may use anonymized and aggregated data derived from how users interact with the Service to improve our AI models. This data does not contain personally identifiable information. We do not use your specific game descriptions, creative ideas, or game content to train AI models that would be used by other users, unless you explicitly opt in to a research program.

4.3 Third-Party AI Providers

We may use third-party AI services to power certain features. Data shared with these providers is governed by data processing agreements that require them to process your data solely on our behalf and in accordance with our instructions. We do not permit third-party AI providers to use your data for their own model training.

5. How We Share Your Information

We do not sell your personal information. We share your information only in the following circumstances:

5.1 Service Providers

We share information with trusted third-party service providers who assist us in operating the Service, including:

• Payment processing: To process your subscription payments securely
• Email delivery: To send transactional and marketing communications
• Cloud infrastructure: To host and deliver the Service
• Analytics: To understand usage patterns and improve the Service
• AI providers: To power AI-assisted game creation features

These providers are contractually obligated to use your information only for the purposes we specify and to maintain appropriate security measures.

5.2 Exported Builds

Exported builds (web, desktop, and mobile — Android and iOS) are generated for you to host and distribute yourself. If you choose to distribute a build through a third-party platform or store, any information that platform requires is shared under its own policies, not ours.

5.3 Legal Requirements

We may disclose your information if required to do so by law, regulation, legal process, or governmental request, or when we believe disclosure is necessary to protect our rights, your safety, or the safety of others, investigate fraud, or respond to a government request.

5.4 Business Transfers

In the event of a merger, acquisition, reorganization, bankruptcy, or sale of all or a portion of our assets, your information may be transferred as part of that transaction. We will notify you via email or prominent notice on the Service before your information becomes subject to a different privacy policy.

6. Data Retention

We retain your personal information for as long as necessary to provide the Service and fulfill the purposes described in this Privacy Policy, unless a longer retention period is required by law.

• Account data: Retained while your account is active. If you delete your account, it is erased immediately and cannot be recovered.
• Game project data: Retained while your account is active. If you delete your account, your projects, their source and their chat history are erased immediately — export anything you want to keep first. If we terminate your account, we make your project data available for export for 30 days.
• Payment records: Retained for 7 years as required by financial regulations
• Usage and analytics data: Retained in anonymized form for up to 24 months
• Account-linked daily usage records (studio, hub, exekite.com): Up to 400 days, erased when you delete your account; aggregate statistics may be kept longer
• Support communications: Retained for 3 years after resolution
• Waitlist data: Retained until you unsubscribe or your account is created

After the retention period, personal data is either deleted or anonymized so that it can no longer be associated with you.

7. Data Security

We implement industry-standard technical and organizational security measures to protect your personal information, including:

• Encryption of data in transit (TLS 1.2+) and at rest (AES-256)
• Regular security assessments and penetration testing
• Access controls limiting employee access to personal data on a need-to-know basis
• Secure development practices and code review processes
• Incident response procedures for prompt detection and mitigation of security events

While we take reasonable measures to protect your data, no method of transmission or storage is 100% secure. If you become aware of a security vulnerability, please contact us immediately at security@exekite.com.

8. Your Rights and Choices

Depending on your location, you may have certain rights regarding your personal information:

8.1 All Users

• Access: Request a copy of the personal information we hold about you
• Correction: Update or correct inaccurate personal information
• Deletion: Request deletion of your personal information (subject to legal retention requirements)
• Data export: Download your game projects and personal data in a portable format
• Marketing opt-out: Unsubscribe from marketing emails at any time via the link in any marketing email or through your account settings

8.2 European Economic Area, UK, and Swiss Users (GDPR)

If you are located in the EEA, UK, or Switzerland, you have additional rights under the General Data Protection Regulation:

• Legal basis: We process your data based on: (a) your consent, (b) performance of our contract with you, (c) compliance with legal obligations, or (d) our legitimate interests (improving and securing the Service)
• Restriction: Request that we limit the processing of your personal data in certain circumstances
• Portability: Receive your personal data in a structured, machine-readable format
• Objection: Object to processing based on legitimate interests
• Withdraw consent: Where processing is based on consent, you may withdraw consent at any time
• Supervisory authority: Lodge a complaint with your local data protection authority

8.3 California Users (CCPA/CPRA)

If you are a California resident, you have the following additional rights under the California Consumer Privacy Act and California Privacy Rights Act:

• Right to know: Request details about the categories and specific pieces of personal information we collect, the purposes for collection, and the third parties with whom we share it
• Right to delete: Request deletion of your personal information, subject to certain exceptions
• Right to opt out: We do not sell your personal information. If this changes, we will provide a "Do Not Sell My Personal Information" link
• Right to non-discrimination: We will not discriminate against you for exercising any of these rights
• Shine the Light: Request information about personal data shared with third parties for direct marketing purposes (we do not share personal data for this purpose)

8.4 Exercising Your Rights

To exercise any of these rights, contact us at privacy@exekite.com. We will respond to your request within 30 days (or as required by applicable law). We may ask you to verify your identity before processing your request.

9. International Data Transfers

Your information may be transferred to and processed in countries other than your country of residence. These countries may have data protection laws that are different from the laws of your country.

When we transfer personal data from the EEA, UK, or Switzerland to countries that have not been deemed to provide an adequate level of data protection, we use appropriate safeguards such as:

• Standard contractual clauses approved by the European Commission
• Data processing agreements with appropriate security obligations
• Transfers to countries with adequacy decisions

10. Children's Privacy

The Service is not directed to children under 16. We do not knowingly collect personal information from children under 16. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at privacy@exekite.com, and we will take steps to delete such information.

Users between 16 and 18 may use the Service with parental or guardian consent, as described in our Terms of Service.

11. Third-Party Links and Services

The Service may contain links to third-party websites, services, or content that are not operated by Exekite. This Privacy Policy does not apply to those third-party services. We encourage you to review the privacy policies of any third-party services you access through the Service.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or other factors. We will notify you of material changes by:

• Posting the updated policy on the Service with a revised "Last updated" date
• Sending an email notification to registered users for material changes
• Displaying a prominent notice on the Service

Your continued use of the Service after the effective date of any changes constitutes your acceptance of the updated Privacy Policy.

13. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

• Privacy inquiries: privacy@exekite.com
• Security issues: security@exekite.com
• General inquiries: Contact page
• Data controller: Exepad LLC (doing business as Exekite), 30 N Gould St, Ste N, Sheridan, WY 82801, United States

For GDPR-related inquiries, you may also contact our Data Protection Officer at dpo@exekite.com.