Privacy Policy

Last updated: 3 September 2026

This policy says what Formamorph stores about you, why, for how long, and who else handles it. It covers the community server: accounts, published worlds, comments, likes, follows, and feedback. It does not cover your play. The game runs on your device, and nothing about a playthrough reaches us.

Jake James operates Formamorph. Write to privacy@formamorph.ai about anything in this policy.

Who may have an account

You must be at least 18 years old, and of legal age to view adult content where you live. Some published content is adult. The app asks you to confirm this before it shows you community content.

What we store

Your account. Your username, a hash of your password, your email address if you gave one, and your avatar image if you uploaded one. We never store the password itself.

Your email address is used for nothing today. We do not mail it, we do not share it, and no password reset uses it. It is stored only because the sign-up form offers it.

What you publish. Every world you upload, with its description, tags, thumbnail, content file, and update history. Your comments. The listings you like. The accounts you follow. Your contest entries and their placements.

Your feedback. Bug reports and suggestions, your replies in those threads, and your votes. A bug report also carries the diagnostics the app shows you before you send it: the app version, whether you run the browser or the desktop build, and a coarse summary such as Windows · Chrome. Reports you file about other people's content are stored with them.

Your answers and your notices. When you accept or decline a policy, we record which policy it was, which version you saw, when you answered, and which way you answered. When staff send you a notice inside the app, we record it and when you read or dismissed it.

Timestamps. Everything above records when it happened. Your account records when you created it, when it last changed, and when you last opened your notification feed.

Moderation records. When staff act on an account or a listing, the audit log records who acted, on whom, what they removed, and when. It keeps usernames.

The Signal

The server records a Signal when an account signs up, logs in, likes, publishes, comments, or follows. A Signal is a salted hash of your network address, plus a coarse browser family such as Chrome/Windows.

We do not store the address. We combine it with a secret salt and hash it. A Signal can therefore show that two accounts acted from the same place. Nobody can read the address back out of it.

Signals have one purpose: to detect abuse. One person may run several accounts to vote for their own contest entry, or to evade a suspension. Signals make that visible. Nothing else uses them.

A Signal never causes anything to happen by itself. There is no automatic block, hold, or score. A shared connection produces a shared Signal and no consequence. A household, a dorm, and a campus all look like this. A person decides what to do, using the same moderation tools as before.

We delete Signals after 90 days.

Our legal basis is legitimate interest. The community cannot stay usable if vote rings and ban evasion are undetectable in principle. Accepting this policy acknowledges that we told you. It is not consent, and declining does not switch collection off. If you object, delete your account. Your Signals go with it.

We also use your network address to rate limit requests, so no single source can flood the server. That use stores nothing.

Who else handles your data

Hetzner hosts the server in Helsinki, Finland. Your data lives there.

Cloudflare runs the domain's DNS, sits in front of the server as a proxy, and stores the published files. Cloudflare is the proxy, so it handles every request you make, including your network address.

No one else receives your data. We do not sell it, and we do not use it for advertising.

The AI is not ours

Formamorph sends your play to the AI service you choose in Settings. That text never reaches our server. The app talks to the AI directly from your device. It ships pointing at a third-party service, and you can change it to your own machine or to any other provider. What that service does with your text is between you and them.

Your worlds, saves, and settings stay in your own browser or on your own disk. They reach us only when you publish one.

How long we keep things

• Your account and what you published: until you delete it.
• Signals: 90 days.
• Nightly copies of the database: up to 30 days.
• Published files: mirrored to Cloudflare storage for as long as the listing exists.

Deleting something removes it from the live server at once. It can survive in a nightly copy for up to 30 days, and then it is gone from those too.

Deleting your account

Open your profile and choose Delete account. You re-enter your password, so a stolen session cannot erase you.

You choose once whether your published worlds and comments go too. If you keep them, they stay under a fixed [deleted user] name with no profile behind it. Your name is gone even where your work stays. Contest placements keep the listing's name and drop yours.

A seven-day Grace Period follows. Nothing is hidden during it. Logging back in cancels the deletion, and the app tells you that it cancelled. After seven days we erase the account and everything attached to it, Signals included. You do not have to come back to finish it.

Moderation records keep your username afterwards. If staff acted on your account, the audit row that names you survives the deletion. Erasure is not total, and this policy will not pretend otherwise.

A suspended account cannot delete itself. Ask through the in-app Feedback form instead. This stops the subject of a suspension from erasing its evidence.

Your rights

You can read what the server holds about you from inside the app. Your profile, your listings, your comments, and your feedback threads are all yours. Write to privacy@formamorph.ai to ask for a copy, a correction, or anything else in this policy.

If this policy changes in a way that matters, we will ask you to read it again.