Privacy policy
Last updated: November 3, 2026 · version 2026-11-03
This policy explains what data Escape Game Generator (the escapegamegenerator.com website and the app) collects, why, who it is shared with and what your rights are, wherever you live. It covers in particular the EU General Data Protection Regulation (GDPR), the UK GDPR, the California Consumer Privacy Act (CCPA/CPRA), Brazil’s LGPD and equivalent laws in other countries. The French version is the reference version.
1. Data controller
Grangus Corp, 6 rue d’Armaillé, 75017 Paris, France (SIREN 982 489 775). Contact for any question about your data: contact@escapegamegenerator.com.
2. Data we collect
| Data | When | Why | Legal basis (GDPR) |
|---|---|---|---|
| Username, email, password (stored hashed, never in plain text), date of birth | Account creation | Create and secure the account, check the minimum age, adapt stories to age | Performance of contract |
| Google ID, Google account email and name | Sign in with Google | Sign you in without a password | Performance of contract |
| Email news choice and its date, date and version of the accepted terms | Sign-up, unsubscribe | Respect and prove your consent | Legal obligation, consent |
| Games played (story, time, hints, score), votes, stories you create and their texts | Using the app | Run the game, leaderboards and creator rewards, improve stories | Performance of contract, legitimate interest |
| Gems, premium status, onboarding answers, last activity (to the hour) | Using the app | Manage your account, measure usage in aggregate | Performance of contract, legitimate interest |
| IP address, technical request data | Every request | Security, abuse prevention, troubleshooting | Legitimate interest |
The app may use the camera (to scan a QR code), the microphone (to measure how loud a sound is for a puzzle) and motion sensors, only during the puzzle concerned and with your permission. This data stays on your phone: no image, sound or measurement is sent to our servers.
We do not sell your data and do not share it for targeted advertising. The website uses no advertising cookies and no analytics trackers.
3. Recipients and processors
Your data is only accessible to the Escape Game Generator team and to the providers needed to run the service, bound by contract:
- Railway (USA): hosting of the website, the app and the data.
- Resend (USA): sending emails (welcome, account, news if you accept them).
- Google (USA): Sign in with Google; generation of story images and music; website fonts (Google Fonts, which receives your IP address).
- Anthropic (USA) and Moonshot AI (China): AI writing of the stories. They receive the creation instructions (genre, idea, format) and story texts, never your email or password. Do not write personal information in your story ideas.
If we ever show ads through a partner, this policy will be updated and your consent will be requested where the law requires it.
4. International transfers
Some providers are located outside the European Union (USA, China). These transfers rely on the European Commission’s standard contractual clauses or, for the USA, on the Data Privacy Framework when the provider is certified. You can ask us for a copy of these safeguards.
5. Retention
- Account and game data: as long as the account exists; deleted within 30 days of your request. An account with no activity for 3 years may be deleted, after notifying you by email.
- Proof of email consent: 3 years after the last contact.
- Technical request data: 30 days at most.
- Published stories: they remain playable after account deletion, signed with your username, unless you ask for their removal.
6. Your rights
Depending on your country, you can access, correct and delete your data, get a portable copy, restrict or object to processing, and withdraw your consent at any time (the “Stop receiving our news” link in every email). Write to contact@escapegamegenerator.com from your account’s address: we answer within one month at most (45 days in California).
European Union, United Kingdom: you can lodge a complaint with your data protection authority (in France the CNIL, in the UK the ICO).
California (CCPA/CPRA): you have the right to know which categories of data we collect (section 2), to delete and correct them, and not to be discriminated against for exercising these rights. We do not sell or “share” (as defined by the CCPA) personal information, and do not use sensitive data beyond what the service requires.
Brazil (LGPD) and other countries: you have the equivalent rights under your local law, exercised the same way.
7. Children
The service is not allowed under 13, and your date of birth is asked at sign-up. If you are under your country’s age of digital consent (for example 16 in some EU countries), a parent’s agreement is required to accept email news. If you believe a child under 13 has given us data, write to us and we will delete it.
8. Security
Encrypted connections (HTTPS), salted password hashing, admin access restricted and verified through Google. No system is flawless: we will notify you of any data breach affecting you, as the law requires.
9. Changes
We may update this policy. For any significant change, you will be notified by email or in the app before it takes effect.