Privacy Policy

# Creadev Privacy Policy

**Last updated:** October 19, 2026 · **Effective date:** October 19, 2026 · **Version:** 2.1

This Privacy Policy explains how **Creadev Technologies Inc.** ("Creadev", "we", "us") collects, uses, shares and protects personal information when you use:

- the Creadev desktop application, distributed through Steam, itch.io and creadev.net;
- games and worlds published with Creadev;
- the website creadev.net;
- our related online services (together, the "Services").

It also explains your choices and rights. Please read it together with our Terms of Use.

**Contents:**
1. Who we are and how to contact us
2. Summary
3. Information we collect
4. How we use information and our legal bases
5. Your choices: usage analytics and crash reports
6. What is public
7. How we share information
8. International transfers
9. How long we keep information
10. Storage, backups and data loss
11. If Creadev is discontinued, sold or merged
12. How we protect information
13. Children and teens
14. Your rights
15. Region-specific information
16. Changes to this policy

---

## 1. Who we are and how to contact us

- **Controller:** Creadev Technologies Inc., Unit 1607 – 6288 No. 3 Road, Richmond, BC V6Y 0J4, Canada.
- **Privacy Officer:** Privacy Officer, Creadev Technologies Inc., privacy@creadev.net.
- **Child safety:** safety@creadev.net.
- **General enquiries:** info@creadev.net.

## 2. Summary

- **What we collect and why:** what we need to run your account, save and publish your creations, process purchases, and keep the app stable and secure. We also collect information on how the app is used, but **only if you allow it**.
- **No selling or ads:** **we do not sell your personal information**, and we do not use it for targeted advertising.
- **Usage analytics is off until you choose.** You can change your choice at any time in **Settings → Privacy**. If you are 13–15, analytics can't be turned on.
- **Crash reports** help us fix crashes and errors. They are on by default, personal details are removed from them, and you can turn them off in **Settings → Privacy**.
- **Storage is not guaranteed:** your projects are stored only online, with third-party cloud providers. We don't guarantee that they will always be available or that they can be recovered (section 10).
- **Creadev is not for children under 13.**

## 3. Information we collect

### 3.1 Information you give us

- **Account information:**
  - your email address, username and password;
  - your **age range** (13–15, 16–17 or 18+), which we ask when you sign up.
  - Passwords are handled by our authentication provider (Google Firebase Authentication). We never see them in readable form.
- **Steam sign-in:** when you create or link your account through Steam, we receive your Steam account ID from Valve. We never receive your Steam password.
- **Your creations ("User Content"):**
  - projects, levels, scenes and their settings, names, descriptions and thumbnails;
  - files you upload (images, videos, PDFs, 3D models, fonts, audio);
  - product pages you publish (text, screenshots, categories, prices);
  - team and collaboration invitations.
- **Store activity:** products you view, buy, gift, wishlist, rate or report.
- **Communications:** messages you send us, support requests, and reports about content or users.

### 3.2 Information collected automatically

- **Account and app settings:** language, display and graphics settings, sign-in status, and your privacy choices (including when you made them and for which policy version).
- **Device and technical information:** app version, operating system, graphics card, processor, memory, screen resolution and graphics settings. We use it for compatibility, for crash reports and, with your permission, for analytics.
- **Crash and error reports** (section 5.2).
- **Usage analytics, only with your permission** (section 5.1).
- **A random installation identifier**, stored on your device. It is used for analytics only after you allow analytics.
- **Network information:** when your device connects to our services, our providers receive your IP address so they can respond and protect the Services. We don't use it to build profiles of you.
- **Website:** creadev.net uses cookies and similar technologies that are needed for the site to work and for signing in. If we use non-essential cookies, we will ask for your consent where the law requires it.

### 3.3 Information from third parties

- **Valve (Steam):** your Steam account ID and, for purchases made through Steam, confirmation of the transaction. Valve processes Steam payments; we don't receive your payment details.
- **itch.io:** if you download Creadev from itch.io, itch.io processes your download and any payment under its own privacy policy. We don't receive your payment details.
- **Stripe:** for purchases and subscriptions on our website, confirmation of payment and subscription status. We never receive or store your full card number.

## 4. How we use information and our legal bases

The legal bases below apply where EU or UK law requires one (GDPR Article 6). Other regions are covered in section 15.

| Purpose | Information | Legal basis (EEA/UK) |
|---|---|---|
| Create and run your account; sign-in, including Steam sign-in | Account information, Steam ID | Contract |
| Save, sync and publish your creations; teams and collaboration | User Content | Contract |
| Store, purchases, coins, gifts, subscriptions and promo codes | Store activity, payment confirmations | Contract; legal obligation (tax and accounting records) |
| Keep the app stable: crash, error and freeze reports | Crash reports, technical information | Legitimate interests (a working, secure product). You can object or opt out (section 5.2) |
| Performance measurements (frame-rate samples, hardware summary) | Technical information | Consent (the same choice as usage analytics) |
| Usage analytics: which features are used and where people get stuck | Analytics events (section 5.1) | Consent, which you can withdraw at any time |
| Security, fraud, cheating and abuse prevention; enforcing our Terms; moderation and child safety | Account, User Content, reports, technical information, IP address | Legitimate interests; legal obligation |
| Service messages (security, changes to terms or to the Services, account notices, discontinuation notices) | Email | Contract; legitimate interests |
| Marketing emails, if we send them | Email | Consent, or soft opt-in where allowed. You can unsubscribe at any time |
| Comply with the law, respond to lawful requests, and establish or defend legal claims | As needed | Legal obligation; legitimate interests |

We do not make decisions about you based solely on automated processing that have legal or similarly significant effects.

## 5. Your choices: usage analytics and crash reports

### 5.1 Usage analytics (PostHog)

- **We ask first.** We ask once, when you sign up or after you log in if you haven't answered yet. **Allow** and **Don't allow** are equal choices, and refusing never limits what you can do in Creadev.
- **Until you choose, nothing is sent.** Events stay on your device. If you choose **Don't allow**, they are deleted.
- **What is collected if you allow it:**
  - the screens you open and the buttons you use;
  - product events such as creating or opening a project or level, choosing a starting point, placing or deleting objects, saving, testing in Play mode, and publishing;
  - use of creation tools: whether an action succeeded and how long it took, **not the content you created**;
  - store activity, including **the words you type in the store search box**;
  - technical information (section 3.2) and the approximate country of your connection. **Your IP address is not stored in analytics.**
- **What is never collected through analytics:**
  - the names or content of your projects, levels or files;
  - text you type into creation tools;
  - file names or paths;
  - your email address;
  - your account ID or Steam ID in readable form.
- **How you are identified:**
  - before you log in, by a random identifier created on your device;
  - after you log in, by a one-way, scrambled form of your account ID. This lets us count your use across devices without knowing who you are.
- **Age rules:** if you are 13–15, analytics is always off and is not offered. If you are 16–17, it is off unless you turn it on.
- **Change your mind** at any time in **Settings → Privacy → Share usage data**.
- **Delete your usage data:** while logged in, use **Settings → Privacy → Delete my usage data**. This turns sharing off and asks us to delete the usage data linked to your account. We complete deletion within **30 days**.
- **Retention:** **24 months** from collection, unless you ask us to delete it sooner.
- **Processor:** PostHog Inc., on servers in the **European Union (Frankfurt, Germany)**.

### 5.2 Crash reports (Sentry)

- **On by default.** Crash reports are sent unless you turn them off, because they help us keep Creadev stable and secure for everyone.
- **When a report is sent:** when Creadev crashes, freezes, or shows an error message with an error code.
- **What a report contains:**
  - technical details: app version, operating system, hardware, and where in the program the problem happened;
  - a **crash dump**, which is a snapshot of the program's memory at the moment of the crash. It can incidentally contain whatever the app was working on at that moment;
  - Creadev's log file for that session. Personal details are removed **before** it is written: your Windows user name and folders, email addresses, account IDs and sign-in tokens are replaced with placeholders.
- **What we don't send:** your name, email or account, screenshots, or your IP address.
- **Turn it off** at any time in **Settings → Privacy → Send crash reports**. This stops all further crash reports from your device.
- **Performance measurements** (frame-rate samples and a hardware summary) are sent only if you allowed usage analytics.
- **Retention:** crash reports are deleted after **90 days**.
- **Processor:** Functional Software, Inc. (Sentry), on servers in the **United States**.
- **Deletion requests:** crash reports aren't linked to your account, so we can't find "your" reports. They are deleted automatically after 90 days.

## 6. What is public

When you **publish** a game, world or product page, the following becomes visible to other users and to anyone with the link:

- your creator name or username;
- the content you published, including its title, description, screenshots and price.

Ratings and similar public interactions may also be visible. **Your unpublished projects stay private** to you and to the team members you invite. Don't put personal information in published content that you don't want others to see.

## 7. How we share information

We share personal information only:

- **with service providers**, who process it for us under contract (table below);
- **with your team members**, for projects you share with them;
- **publicly**, when you publish (section 6);
- **when the law requires it, or to protect rights and safety.** This includes:
  - responding to lawful requests from authorities;
  - preventing fraud, hacking and abuse;
  - enforcing our Terms;
  - reporting child sexual exploitation to the appropriate authorities, such as NCMEC in the United States;
- **in a business transfer** (section 11).

**We do not sell personal information, and we do not "share" it for cross-context behavioural advertising.**

| Provider | What they do | Data | Location |
|---|---|---|---|
| Google LLC / Google Cloud (Firebase Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Run) | Accounts, database, file storage, server functions | Account, User Content, store activity, settings | United States |
| Valve Corporation (Steam) | Distribution, Steam sign-in, Steam purchases, multiplayer matchmaking (when available) | Steam ID, transactions | United States |
| itch.io | Distribution of the non-Steam version, and payments made on itch.io | Data you give itch.io directly | United States |
| Stripe, Inc. | Purchases and subscriptions on our website | Payment and subscription data | United States |
| PostHog Inc. | Usage analytics, only with your consent | Analytics events, pseudonymous ID | European Union (Germany) |
| Functional Software, Inc. (Sentry) | Crash and error reports | Crash reports, technical data | United States |
| Amazon Web Services, Inc. (AWS) | Hosting and computing infrastructure for parts of the Services | Data processed by those parts of the Services | United States |
| Video link resolution service | Plays YouTube videos you add to a world | The video link, and your IP address when the video is requested | Outside Canada |
| Email delivery providers | Account and service emails | Email address, message content | United States |

## 8. International transfers

We are based in Canada. Our providers operate in the **United States**, the **European Union** and other countries, so your information may be processed outside your country, where privacy laws may differ.

When we transfer personal information from the EEA, the UK or Switzerland, we rely on:

- an **adequacy decision**, including the EU decision for Canada, and the EU-US Data Privacy Framework where the provider is certified; or
- the **Standard Contractual Clauses** (with the UK Addendum) and the safeguards they require.

For Brazil, we use the safeguards recognised by the ANPD. For Quebec, we assess the protection before information is transferred outside Quebec. Contact us for a copy of the relevant safeguards.

## 9. How long we keep information

| Information | How long |
|---|---|
| Account and User Content | While your account exists. Deleted within 30 days after you delete your account, except published content that others already acquired (where the Terms licence continues) and anything we must keep by law. Copies in our providers' backups, if any, are overwritten in the normal course, usually within a further 30 days. |
| Usage analytics | **24 months** from collection, or earlier if you ask us to delete it |
| Crash reports | **90 days** |
| Purchase and tax records | As long as tax law requires (typically 6–7 years) |
| Content reports, moderation and security records | 1 year; longer where needed for legal claims, investigations of fraud or hacking, or reporting illegal content |
| Support emails | 2 years after the conversation ends |
| Data on your device (settings, offline analytics queue, logs) | Until you delete it or uninstall. The unsent analytics queue is capped at 5,000 events or 7 days. |

## 10. Storage, backups and data loss

- **Where your content lives:** your account data and User Content are stored on third-party cloud infrastructure (Google Cloud, Firebase and Amazon Web Services), which we don't own or control. Your projects are stored only online; Creadev doesn't keep a copy on your device.
- **No guarantee:** we take reasonable measures to protect it. However, **we do not guarantee that your data or content will always be available, will not be lost or corrupted, or can be recovered.** We don't promise to keep backups, and where backups exist, we don't guarantee that they can be restored.
- **Not a backup service:** Creadev is not a backup or archival service, and you may not be able to export or back up your projects yourself. Keep copies of the original files you upload, and use export or download features where they are available.
- **Liability:** the Terms of Use (sections 12, 15 and 16) describe the limits of our responsibility for data loss.

## 11. If Creadev is discontinued, sold or merged

- **Discontinuation:** if we permanently discontinue the Services, we will try to give at least 30 days' notice in the app, on creadev.net or by email (as described in the Terms of Use). Where reasonably possible, you will be able to export or download your User Content during that period. **After the shutdown date, we will delete or anonymise personal information and User Content**, except records we must keep by law (for example tax records) or need to establish or defend legal claims, which we keep only as long as necessary.
- **Sale, merger or reorganisation:** if Creadev is involved in a merger, acquisition, financing, reorganisation, bankruptcy or sale of all or part of its assets, personal information may be transferred to the new owner or successor. They will be required to protect it as described in this policy. If they want to use it in materially different ways, they must give you notice and, where the law requires, ask for your consent.

## 12. How we protect information

Our safeguards include:

- **Connections and access:** encrypted connections (HTTPS) to our services, and access to data restricted by authentication and security rules.
- **Remember me:** if you choose it, your password is stored with the **Windows Credential Manager**, not in a file.
- **Data minimisation:** crash logs are scrubbed before they leave your device, and analytics uses pseudonymous identifiers.
- **Internal controls:** access to personal information is limited to people who need it to do their work.

No system is perfectly secure, and we can't guarantee the security of information sent over the internet or stored by third-party providers. If a breach affects your personal information, we will notify you and the authorities as the law requires.

## 13. Children and teens

- **Under 13:** Creadev is not intended for children under 13, and children under 13 may not create an account. We ask your age range when you create an account.
- **Higher minimum ages:** some laws set a higher age for using online services or for consenting to how personal information is used, for example **14 in Quebec** and up to **16 in some countries of the European Economic Area**. If you are below that age where you live, you may use Creadev only with your parent's or guardian's consent.
- **If we learn a child under 13 gave us information:** we do not knowingly collect personal information from children under 13. If we learn that we have, we delete it and close the account.
- **Parents and guardians** who believe their child under 13 has given us personal information can contact **privacy@creadev.net**, and we will delete it.
- **Protections for ages 13–17:**
  - usage analytics is off by default, and can't be turned on for ages 13–15;
  - Creadev has **no text or voice chat** between users;
  - we never use personal information for targeted advertising.
- **Child safety:** we have zero tolerance for child sexual abuse or exploitation. Report concerns in the app or to safety@creadev.net. Our Child Safety Standards are published on creadev.net.

## 14. Your rights

Depending on where you live, you may have the right to:

- **access** your personal information and receive a **copy** of it (portability);
- **correct** it;
- **delete** it;
- **restrict** or **object to** some processing, including processing based on legitimate interests;
- **withdraw consent** at any time (for example, for usage analytics);
- **not be discriminated against** for using your rights;
- **lodge a complaint** with a data-protection authority.

**How to use them:**

- **In the app:** Settings → Privacy (analytics choice, crash reports, delete usage data).
- **On the website:** your Account page on creadev.net → **Delete account** deletes your account and its data.
- **By email:** privacy@creadev.net. We may need to verify your identity before acting on a request.

**Response time:**

- **within one month** for EEA and UK requests (which may be extended as the law allows);
- **45 days** under US state laws;
- **30 days** under Canadian law.

**Agents:** you can use an authorised agent where the law allows.

## 15. Region-specific information

**European Economic Area, United Kingdom and Switzerland**

- **Controller:** Creadev Technologies Inc. (section 1).
- **Complaints:** you can complain to your local supervisory authority, or in the UK to the Information Commissioner's Office.
- **Age of digital consent:** where your country sets it above 13, you need your parent's or guardian's consent to use Creadev (section 13). Usage analytics stays off unless you are old enough to consent.

**Canada (PIPEDA and provincial laws), including Quebec**

- **Privacy Officer:** our Privacy Officer is responsible for our compliance and can be reached at privacy@creadev.net or at the address in section 1.
- **Complaints:** you can complain to the Office of the Privacy Commissioner of Canada or your provincial commissioner, such as the Office of the Information and Privacy Commissioner for British Columbia or Quebec's Commission d'accès à l'information.
- **Quebec residents** have the right to be informed of the use of technologies that identify, locate or profile them; analytics is off unless you allow it. Users under 14 in Quebec need a parent's or guardian's consent.

**United States (including California, Colorado, Connecticut, Virginia, Texas and other states with privacy laws)**

- **Categories we collected in the last 12 months:**
  - identifiers (email, username, account ID, Steam ID, device identifier, IP address);
  - commercial information (purchases);
  - internet or other electronic network activity (analytics, with consent);
  - approximate geolocation (country);
  - user content;
  - inferences: none.
- **Sources, purposes and recipients:** sources are in section 3, purposes in section 4 and recipients in section 7.
- **No sale or sharing:** we do not sell personal information or share it for cross-context behavioural advertising, including that of consumers under 16.
- **Sensitive personal information:** we use it only as the law permits. Your account password is used only to sign you in.
- **Appeals:** if we decline a request, you can appeal by replying to our response.

**Brazil (LGPD)**

- **Legal bases:** the same as in section 4.
- **Your rights:** you have the rights under Article 18 of the LGPD and can exercise them through privacy@creadev.net. Our contact for data-protection matters (Encarregado) is our Privacy Officer.
- **Complaints:** you can complain to the ANPD.

**Other countries:** where your local law gives you additional rights, we honour them. Contact us.

## 16. Changes to this policy

We may update this policy. When we make important changes, we notify you in the app, on creadev.net or by email before they take effect. If a change affects a choice you made, such as usage analytics, we **ask you again**. The version, last-updated date and effective date are shown at the top.

**Language:**