Privacy Policy

01Introduction

gameTheory Solutions Pte Ltd (“we”, “us”, “our”) is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our products and services.

Products Covered

This policy applies to all gameTheory products:

All products share a common platform layer (Axon) for authentication, AI processing, and analytics. This policy covers data practices across all products collectively, with product-specific details noted where relevant.

02Information We Collect

2.1 Account & Profile Information

When you create an account, we collect:

Product-specific profile fields:

• Crucible: Seniority level (new-manager, mid-level, senior)
• Rosie: None beyond shared fields

2.2 Organization & Team Data

If you belong to an organization:

• Organization name, logo, industry
• Your membership role (member or org_admin)
• Organization profile text and default constraints (Synapse)

Users without an organization are “freelancers” — this is a first-class status, not an error.

2.3 User Content

We store content you create within our products. This varies by product:

Rosie

• Captures: Notes from multiple sources (text, email, calendar, health data, monitoring alerts)
• Triage results: GTD classification (inbox, next action, project, waiting, someday, reference) with AI reasoning
• Conversations: Chat messages with Rosie (text, audio transcripts, files)
• Threads: Processing lifecycle records linking captures to actions
• Email contacts: Cached contacts from connected Gmail account
• Voice recordings: Audio captured via Notetaker (temporary — cleared after transcription)
• Transcripts: Speech-to-text output from voice recordings

Matrix

• Course content: Programs, courses, modules, assets (slides, documents, videos, images)
• Enrollment data: Learner enrollments, attendance records
• Submissions: Assignment submissions (files, links, text)
• Session data: Scheduled Zoom meetings, session artifacts (recordings, transcripts, notes)
• Course completions: Instructor-awarded completion records
• Voice recordings: Audio captured via Notetaker (temporary — cleared after transcription)
• Transcripts: Speech-to-text output

Crucible

• Session transcripts: Full conversation transcripts from AI coaching sessions
• Coaching debriefs: AI-generated performance feedback
• Coaching nudges: In-session coaching with emotion/signal metadata
• Multi-conversation cases: Handoff summaries between case conversations
• Company interviews: Full interview transcripts with AI interviewer
• Company profiles: Structured intelligence extracted from interviews
• Generated scenarios: AI-generated training scenarios
• Performance data: Competency scores/levels, assessment answers, reflection text
• Voice recordings: Audio captured via Notetaker (temporary — cleared after transcription)
• Transcripts: Speech-to-text output

Synapse

• Sessions: Session title, topic, context, configuration, tags
• Rounds: Human direction/input per iteration, technique selection, AI-generated summaries
• Agent conversations: AI-generated text per agent role, user messages within agent conversation
• Artifacts: Ideas, lenses, conditions, questions (knowledge graph nodes) with user notes
• Constraints: User-defined design boundaries
• Conclusions: AI-generated session summaries
• Document uploads: PDF, text, Markdown, JSON, DOCX, CSV, HTML, RTF (max 50 MB per file)
• Voice recordings: Audio captured via Notetaker (temporary — cleared after transcription)
• Transcripts: Speech-to-text output

2.4 OAuth Connections & Encrypted Credentials

When you connect external accounts:

2.5 BYOK API Keys (Bring Your Own Key)

If you supply your own LLM API key:

• Provider name (e.g., anthropic, openai, gemini, groq, huggingface, openrouter)
• Encrypted API key (AES-256-GCM ciphertext)
• Non-reversible key hint for UI display (e.g., sk-...abc)

Master encryption key is stored in environment variables, never in the database.

2.6 Analytics & Usage Data

We operate privacy-first, first-party analytics. No third-party analytics services are used.

What we collect:

• Page paths visited
• Referring URLs
• Device type and browser (parsed, not raw User-Agent)
• Country-level location (no precise geolocation)
• Product-specific events

What we do NOT collect:

• Raw IP addresses (only a hashed prefix is used for visitor identification)
• Raw User-Agent strings
• Cookie-based tracking identifiers
• Third-party tracking pixels or beacons

Privacy-preserving visitor identification: Visitor IDs are computed using HMAC-SHA256 of the IP/24 prefix (first 3 octets) combined with a daily-rotating salt. Raw IP addresses are never stored, the hash cannot be reversed, and the salt rotates daily preventing long-term tracking.

2.7 Operational Logs

For system reliability and debugging:

• LLM usage logs: Token counts per model, session IDs (no user content)
• LLM failure logs: Error messages, models tried, recovery info (may contain up to 2KB of truncated LLM output)

03How We Use Your Information

04AI Processing & Large Language Models

All gameTheory products use AI extensively. This section explains how your data is processed by large language models.

4.1 LLM Providers

We route AI requests through a self-hosted LiteLLM proxy to the following providers:

4.2 What Data Is Sent to LLMs

Data NOT sent to LLMs:

• User email addresses
• User bio or LinkedIn URL
• User avatar images
• OAuth tokens or API keys
• Raw audio (sent to Deepgram for transcription, not to LLMs)

4.3 BYOK (Bring Your Own Key)

If you supply your own API key, your AI requests are routed to your own provider account. We do not have access to your key (it is encrypted and decrypted only in memory during request routing).

4.4 AI-Generated Content

Watermarking: LLM outputs are watermarked using invisible zero-width Unicode characters containing session ID and timestamp. This does not affect readability but allows provenance tracking.

4.5 Voice Processing

Audio recordings are cleared from our database after transcription completes. Only transcripts are persisted.

05Third-Party Service Providers

5.1 Infrastructure

5.2 AI & Voice Services

5.3 OAuth Providers (User-Initiated)

5.4 Product-Specific Integrations

5.5 Services We Do NOT Use

• No third-party analytics: No PostHog, Mixpanel, Google Analytics, Segment, Amplitude, Plausible
• No advertising or tracking: No ad networks, no tracking pixels, no remarketing
• No payment processors: No Stripe, Paddle, PayPal
• No monitoring/APM: No Sentry, Datadog, LogRocket, New Relic
• No email marketing: No SendGrid, Resend, Postmark, Mailgun (beyond Supabase's built-in SMTP for auth emails)

06Cross-Product Data Sharing

All gameTheory products share a common platform layer (Axon). The following data is shared across products.

6.1 Shared Data (All Products)

6.2 Product-Specific Data (NOT Shared)

Each product's content remains private to that product:

6.3 Cross-Product Event Dispatch

Products can send events to each other via a persistent outbox pattern:

07Data Storage & Security

7.1 Storage Locations

7.2 Encryption Details

7.3 Access Control

• Row-Level Security (RLS): All data tables enforce RLS — users can only access their own data
• Owner-only access: User data is scoped to auth.uid() — only the data owner can read/write
• Admin access: Platform admins can read (not modify) user data for operational support
• Service role: Backend processes use a service role with explicit, audited access

7.4 Security Measures

• TLS/HTTPS for all data in transit
• bcrypt password hashing (managed by Supabase Auth)
• JWT session tokens (1-hour expiry, refresh token rotation)
• AES-256-GCM encryption for sensitive credentials
• HMAC-authenticated server-to-server webhooks
• Rate limiting (Upstash Redis in production)

08Cookies & Tracking

8.1 Cookies We Use

8.2 What We Do NOT Use

• No third-party cookies
• No tracking cookies
• No advertising cookies
• No analytics cookies
• No tracking pixels or beacons
• No raw IP address storage (only hashed prefixes for privacy-first analytics)

09Data Retention

9.1 Account Data

9.2 Operational Data

9.3 Data Deletion

You can request deletion of your account and all associated data by contacting us. Upon deletion:

• All user content is cascade-deleted from the database
• OAuth tokens are revoked and deleted
• BYOK API keys are deleted
• Avatar images are removed from storage
• Analytics events retain only the hashed visitor ID (no longer linked to your account)

10Your Rights

Depending on your jurisdiction, you may have the following rights:

To exercise these rights, contact us at the address below.

Data Portability

You can export your data at any time:

• Rosie: Captures, triage results, conversations are accessible via API
• Matrix: Course content, submissions, attendance records are accessible via the application
• Crucible: Session transcripts, debriefs, company profiles are accessible via the application
• Synapse: Sessions, artifacts, constraints, conclusions are accessible via the application

11Children's Privacy

Our products are not directed to children under 16. We do not knowingly collect personal information from children. If you believe we have collected data from a child, please contact us.

12International Data Transfers

Our service providers may process data in jurisdictions outside your country. We ensure appropriate safeguards are in place:

• Supabase: Data stored in Supabase-managed infrastructure (region determined by project settings)
• Vercel: Global edge network (processing occurs at edge locations worldwide)
• LLM providers: Anthropic (US), OpenAI (US), Google (US), Groq (US), Hugging Face (US), OpenRouter (US)
• Deepgram: US-based
• ElevenLabs: US-based

Where transfers occur to countries without adequate data protection laws, we rely on standard contractual clauses or your explicit consent.

13Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by:

• Posting the updated policy on our website
• Updating the “Last updated” date at the top

Your continued use of our products after changes are posted constitutes acceptance of the updated policy.

14Contact

gameTheory Solutions Pte Ltd

For privacy inquiries or to exercise your rights:

• Email: privacy@gametheory.school
• Address: Registered office address

Appendix A: Complete Data Inventory by Product

Rosie — Data Summary

Matrix — Data Summary

Crucible — Data Summary

Synapse — Data Summary

Axon — Shared Platform Services

Appendix B: Sub-Processor List

Appendix C: Technical Security Details

Encryption

Ciphertext Format

All application-level encryption uses versioned ciphertext: v1.<iv>.<ct+tag>

This allows future key rotation without breaking existing encrypted data.

Row-Level Security (RLS)

All data tables enforce PostgreSQL Row-Level Security:

• Users can only access rows where user_id = auth.uid()
• Platform admins have read-only access for operational support
• Service role has explicit, audited access for backend processes

Analytics Privacy

Visitor identification uses HMAC-SHA256:

visitor_id = HMAC-SHA256(IP/24 + daily_salt)

• Only the first 3 octets of the IP address are used (IP/24 prefix)
• Daily salt rotation prevents long-term correlation
• The hash is one-way and cannot be reversed
• No raw IP addresses or User-Agent strings are stored