Privacy policy
Privacy policy.
This policy describes the information Anime Lab handles when you play, create an account, save game history, or, if paid plans are enabled later, subscribe.
Draft dated October 17, 2026 · Operator location: New York, United States
1. Scope and controller
Anime Lab (“we,” “us,” or “our”) operates the game and is responsible for the personal information described here. This policy covers the website, accounts, character builds, villain fight history, generated life simulations, and billing account records. Third-party services such as Stripe, Google, and our transactional email provider also have their own privacy notices. This draft reflects the current application code; hosting, logging, support, and analytics arrangements must be checked before launch.
2. Information we collect
| Category | Examples and source |
|---|---|
| Account | Username, display name, email address, a random account ID, authentication provider, and a salted password hash if you register with a password. We use your email to send a one-time confirmation link before activating a new password account. We do not store your plain-text password. For Google sign-in, we store Google's account identifier after verifying the sign-in response; the current application does not store your Google email or profile picture. |
| Game and content | Saved character names, selected character cards and attributes, villain campaign progress and outcomes, life simulation prompts, choices, and generated story history tied to your account. You may also enter names or other free text into the game; avoid entering sensitive information about yourself or others. |
| Subscription | Only if paid plans are enabled and you subscribe: Stripe customer and subscription identifiers, plan and payment status, billing event identifiers, and timestamps. Payment-card data is entered on Stripe's pages; we do not receive full card numbers. |
| Technical | Session and sign-in tokens or token hashes, browser request data such as IP address and user agent that may be visible to the server or hosting provider, and temporary per-IP rate-limit counters used to prevent abuse. The game stores some unfinished draft state in browser session storage. |
We do not intentionally request precise location, government IDs, health details, or sensitive payment credentials. We do not currently include advertising trackers or a separate product analytics service in the application code. A hosting provider may keep ordinary access or security logs; its configuration must be verified before this policy goes live.
3. How we use information
- Create and authenticate accounts, keep sessions active, and show your saved characters and history.
- Run the game, process choices, generate life simulations, and, if paid plans are enabled later, deliver subscription-only features.
- If paid plans are enabled, start Stripe Checkout, recognize subscription status, enable the billing portal, and reconcile payment events.
- Maintain security, enforce usage limits, troubleshoot failures, and prevent abuse or unauthorized access.
- Respond to legal requests, support inquiries, and applicable obligations, and communicate material service or policy changes when we have a way to contact you.
Where privacy law requires a legal basis, these activities may be based on providing the service you requested, legitimate interests in security and operation, compliance with law, or consent where required. The applicable basis depends on your jurisdiction and the activity. We do not use game history to make decisions with legal or similarly significant effects.
5. Cookies and browser storage
A secure session cookie is used to keep you signed in; the application's configured maximum age is 30 days. A short-lived OAuth state cookie protects the Google sign-in flow. These cookies are used for service functionality. Browser sessionStorage may hold an unfinished character draft, a chosen character reference, or display state for the current browser tab; it generally clears when that tab session ends, although browser restore behavior can vary. The current application does not set optional advertising cookies. You can clear cookies and site data in your browser, but doing so may sign you out or discard an unfinished draft.
6. Retention
Account and saved game records remain while the account exists unless removed through an applicable request or service shutdown. Active session cookies expire under the configured 30-day maximum; server-held session and sign-in records may be removed on logout or routine maintenance. Stripe and local billing event records may be retained for accounting, fraud prevention, dispute handling, or legal obligations. Temporary rate-limit counters reset as the application runs. Hosting logs, if enabled, follow the host's configuration and must be confirmed before launch. We will not claim a fixed deletion period for every category until operational retention and backup procedures exist.
7. Your choices and privacy requests
You can update your display name on the account page, sign out, and, if you have an existing subscription, cancel it through the Stripe billing portal. You can delete individual saved life or fight records, or a whole saved character and its associated history, from the account archive. There is currently no self-service export, account deletion, or password reset feature. Depending on your location, you may be entitled to request access, correction, deletion, a copy of your data, or an appeal, subject to legal exceptions. Send a request to the contact listed below and include your username and enough information to verify ownership without sending a password or card number. We will assess and respond under applicable law. If account deletion is approved, some billing or security records may need to remain for legal reasons.
8. Security and international processing
The application hashes passwords using a salted key-derivation method, stores a hash of each session token rather than the raw token, and uses an HttpOnly cookie with SameSite=Lax. No online service can guarantee absolute security. Operators must secure hosting, secrets, backups, and database access; this policy does not represent that those operational controls have been independently audited. Information may be processed in the United States or other locations where providers operate. Additional safeguards or notices may be required for users in other jurisdictions.
9. Children
Anime Lab is not directed to children under 13 and does not knowingly collect their personal information. Under-13 users must not create an account or use the Service. If you believe a child under 13 has provided information, contact us so we can investigate and take steps required by law. Users aged 13–17 should have parental or guardian permission; paid subscriptions require an adult purchaser. Before launch, the operator must evaluate whether the game's subject matter, visual design, audience, and marketing make it child-directed under applicable law. A statement here does not replace that assessment.
10. Changes and contact
We may update this policy as the Service or law changes. Material changes will be posted with a new date and, where required, additional notice or consent. Operator: Anime Lab (placeholder; verified legal name required), New York, United States. Privacy and data requests: [WORKING CONTACT EMAIL REQUIRED BEFORE LAUNCH].