Privacy Policy

Effective October 13, 2026

This policy explains what Naat Ventures, Inc. ("we") collects when you use Free Cell Worlds at freecellworlds.com. Naat Ventures, Inc. is the data controller for this information.

What we collect

• Without an account: game settings and progress stay in your browser's local storage. We don't run ad trackers or profiling analytics.
• With an account: your email address, name and profile picture (if you sign in with Google), a hashed password (if you use email sign-in), and your synced settings, stats, current deal, Voyage run and tutorial progress. Your account is identified by a random ID, not your email address.
• Account security: a short-lived count of failed sign-in attempts for your email, and a Cloudflare Turnstile check when you sign up, sign in with a password, or reset a password.
• Custom themes: the prompts you write, the generated images and music, and our automated moderation results for each prompt.
• Purchases: Stripe handles payment. We receive the purchase amount, pack, date and a Stripe reference. We never see or store your card number.
• Support: messages you send us and any job details attached to them.
• Technical: IP address and browser info in short-lived security logs and error reports, used for rate limiting, fraud prevention and fixing bugs.

How we use it

To run the Game, sync your progress between your devices, create and store your themes, process payments, prevent abuse and fraud, answer support requests, and send account emails (verification, password reset, "your theme is ready"). We don't sell your personal information or use it for advertising.

Service providers

Cloudflare (hosting, database, file storage, email routing, and Turnstile human verification), Stripe (payments and receipts), Google (sign-in and AI generation), Resend (account emails) and Sentry (error reports). They process data only to provide their services to us.

When you choose a password, we check it against Have I Been Pwned’s list of passwords exposed in data breaches. Only the first five characters of a hash of the password leave our servers, never the password itself.

Cookies

We use essential cookies only, to keep you signed in and protect against abuse.

Retention

We keep account data until you delete your account. Email sign-ups that are never confirmed are deleted after 24 hours. Sign-in sessions end after 60 days without use. Unchosen design options are deleted after a job finishes or expires. Security logs are kept for a short period. Purchase records are kept as long as tax and accounting law requires.

Your choices and rights

You can download your data or delete your account from the account menu (Sign in, then Account), or email us. Deleting your account removes your profile, synced progress, themes and unused tokens; we confirm the request by email first. Progress saved in your browser stays on your device until you clear it. California residents have the right to know, delete and correct personal information, and we don't sell or share it for cross-context advertising.

Your rights in the EEA, UK and Switzerland (GDPR)

We use your information on these legal bases:

• Contract: to provide your account, sync your progress, create your themes and process your purchases.
• Legitimate interests: to keep accounts secure (rate limits, human verification, breached-password checks), prevent fraud and abuse, and fix bugs.
• Legal obligation: to keep purchase records for tax and accounting law.

You have the right to access, correct, delete or download your personal data, to restrict or object to how we use it, and to complain to your local data protection authority (in the UK, the Information Commissioner's Office). For any of these, email gdpr@freecellworlds.com. We may ask you to confirm the request from your account email, and we respond within one month.

We are based in the United States and so are our service providers' main systems, so your data is processed in the US. Where the law requires, these transfers rely on the European Commission's Standard Contractual Clauses or the provider's certification under the EU-U.S. Data Privacy Framework.

Children

Accounts are for ages 13 and up. We don't knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, contact us and we'll delete it.

Changes and contact

We'll post updates here and notify account holders of material changes. Contact: support@freecellworlds.com (privacy and data requests: gdpr@freecellworlds.com), Naat Ventures, Inc., 2790 SW Hume St, Portland, OR 97219.