Privacy Policy

Last updated: April 11, 2026

The short version: We collect what we need to run the service. We anonymize interactions to improve the AI. We never sell your data. You can delete your account and data at any time.

1. What We Collect

When you use Monster Gaming, we collect:

Account information: Name, email, company (optional), engine preference
Usage data: API requests, token counts, timestamps, response latencies
Interaction data: Prompts and responses sent through the API (anonymized for training)
Payment data: Processed by Stripe. We never see or store your full card number.

2. What We Do NOT Collect

Your game source code (unless you send it via the API)
Personal browsing history
Location data beyond country (derived from IP for rate limiting)
Data from other applications on your device

3. How We Use Your Data

Service delivery: Authenticate requests, enforce rate limits, route to AI providers
Training improvement: Anonymized interaction data improves the AI for the game development community. You consent to this at signup. You can opt out via the portal data sharing settings.
Billing: Track usage for metered billing on paid plans
Communication: Service updates, security notices, billing alerts. No marketing spam.

4. Data Sharing

We share data only with:

AI providers: Your prompts are forwarded to upstream AI providers (Anthropic, Google, etc.) to generate responses. These providers have their own privacy policies.
Stripe: Payment processing only
Cloudflare: CDN and DDoS protection

We do not sell data to advertisers, data brokers, or any third party.

5. Data Retention

Account data: Retained while your account is active + 30 days after deletion
Usage logs: Retained for 90 days, then aggregated and anonymized
Training data: Anonymized interaction data is retained indefinitely to improve models
Billing records: Retained for 7 years per tax requirements

6. Your Rights

Access: View your data through the developer portal
Export: Download your usage history and account data
Delete: Request account deletion — we'll remove all personal data within 30 days
Opt out: Disable training data sharing through portal settings (may limit some features)

7. Security

API keys are hashed with SHA-256 before storage. All traffic is encrypted via TLS 1.3. We use Cloudflare's edge network for DDoS protection and rate limiting. Access to production systems is restricted to authorized personnel.

8. Cookies and Similar Technologies

We use a small number of first-party cookies for essential site function. We do not use third-party advertising, tracking, or analytics cookies on monstergaming.ai today. If that changes we will update this policy and refresh consent.

mg_locale — remembers your selected language (1-year expiry). Strictly necessary; not subject to consent.
mg_consent — records that you have seen and dismissed the cookie notice (1-year expiry).
Stripe Checkout — when you click Subscribe, Stripe sets its own session cookies on checkout.stripe.com. Governed by Stripe's privacy policy.

If you are located in the EU, EEA, UK, or Switzerland, you have the following rights regarding your personal data:

Right of access — request a copy of the personal data we hold about you
Right to rectification — correct inaccurate or incomplete data
Right to erasure ("right to be forgotten") — request deletion of your data
Right to restriction — limit how we process your data
Right to data portability — receive your data in a structured, machine-readable format
Right to object — object to processing based on legitimate interests, including profiling
Right to withdraw consent — at any time, where processing is based on consent (e.g. training-data sharing)
Right to lodge a complaint with your national supervisory authority

Lawful bases. We process your data under: (a) contract — to provide the service you signed up for; (b) legitimate interests — operating, securing, and improving the service; (c) consent — for optional training-data sharing, which you can withdraw in the developer portal at any time; (d) legal obligation — billing and tax records.

International transfers. Monster Gaming is operated from the United States. When EU/UK personal data is transferred to the US or to upstream AI providers, we rely on the EU Standard Contractual Clauses and the UK International Data Transfer Addendum.

Contact / requests. Email privacy@monstergaming.ai with the subject "GDPR Request". We respond within 30 days. We have not appointed a separate EU representative; while pre-revenue and below the Article 27 thresholds, the controller is reachable directly at the address above.

10. California Residents (CCPA / CPRA)

If you are a California resident, the California Consumer Privacy Act, as amended by the CPRA, gives you the following rights:

Right to know what categories and specific pieces of personal information we have collected, used, disclosed, or sold/shared
Right to delete personal information we have collected from you
Right to correct inaccurate personal information
Right to opt out of the sale or sharing of personal information
Right to limit use of sensitive personal information
Right to non-discrimination for exercising any of these rights

Categories of personal information collected (in the past 12 months): identifiers (name, email, IP), commercial information (subscription tier, billing history), internet/network activity (API request logs), and inferences drawn from usage. We do not collect biometric, geolocation beyond country, or government identifiers.

Sale or sharing of personal information. Monster Gaming does not sell or share your personal information as those terms are defined under the CCPA/CPRA, including for cross-context behavioral advertising. We have not done so in the past 12 months and have no plans to do so.

Sensitive personal information. We do not use or disclose sensitive personal information for purposes beyond those permitted by Cal. Civ. Code § 1798.121.

How to exercise your rights. Email privacy@monstergaming.ai with the subject "California Privacy Request" and tell us which right you are exercising. We will verify your identity using information already associated with your account and respond within 45 days. You may use an authorized agent; we will require written authorization. We do not charge a fee or discriminate against users who exercise these rights.

Do Not Sell or Share My Personal Information. Because we do not sell or share personal information, there is nothing to opt out of. If this changes, an opt-out link will be available here and in the site footer, and we will honor Global Privacy Control (GPC) signals.

11. Children

Monster Gaming is not intended for users under 16. We do not knowingly collect data from children.

12. Changes

We'll notify you of material changes via email at least 30 days in advance.

Contact

Privacy questions? Email privacy@monstergaming.ai