Information We Collect
Account Information
When you register, we collect your email address, display name, and authentication credentials. If you sign in via GitHub, we receive your GitHub profile information as permitted by your GitHub settings.
Usage Data
We collect information about how you use the Service, including generation requests (prompts and metadata, not full outputs), project activity, engine connection events, and feature usage patterns.
Payment Information
Payment processing is handled by Stripe. We do not store your credit card number. We receive and store your Stripe customer ID, subscription status, and billing history.
Technical Data
Browser type, device information, IP address, and log data for security and performance monitoring.
API Keys & BYOK Data
Your Claude API key is encrypted at rest using AES-256 encryption in our Supabase database. Your API key is only decrypted server-side during generation requests you initiate. We never log, proxy, or intercept the content of your API calls. API key validation occurs via a secure edge function and the result (valid / invalid) is stored - never the key itself in plaintext.
How We Use Your Information
We use collected information to:
- Provide, maintain, and improve the Service
- Process subscriptions and NOVA generation payments
- Enforce tier-based usage limits (generation counts, cloud engine time, MCP connections)
- Send transactional emails (confirmations, password resets, billing receipts)
- Monitor and prevent abuse or unauthorized access
- Improve AI prompt quality via aggregated, anonymized usage analytics
Data Storage & Security
Your data is stored in Supabase (hosted on AWS) with row-level security (RLS) policies ensuring you can only access your own data. All connections use TLS encryption in transit. Cloud engine sessions are ephemeral - session data is saved to Supabase Storage but cloud containers are destroyed after session end. We use Vercel for frontend hosting with automatic HTTPS.
Generated Code & Content
AI-generated code outputs belong to you. We do not claim ownership of code generated using your API key. Prompts and generation metadata may be retained for your generation history feature and are deleted according to your tier's retention period (session-only for Free, 90 days for Pro, 365 days for Premium). NOVA video/VFX outputs are stored in Supabase Storage and are accessible to you; they may be deleted after 90 days of account inactivity.
Training corpus and shared fix memory (opt-in)
Two separate switches in Settings, both off by default. Training: when on, your future code generations can be used to train a small open-source model for MCPity-specific tasks. Share my fixes with other creators: when on, a fix that cleared a build or playtest error for you can join the shared fix memory, and your failures count anonymously in what other repos see. What joins is only the few lines the fix changed, with a few unchanged lines around them so it can be matched, never your file, your project name or your account. No one else is shown a fix until three different people needed the same one, a fix that adds network calls, dynamic code or stored data is never shared, and the copy of your code a fix is compared against is deleted as soon as the result is known (or after three days). We keep a private record of which shared fixes were yours, only so the switch can show you how many you shared and how many times they helped someone else. Anonymous players of published games never contribute. Using fixes others shared needs no opt-in and costs nothing. With either switch on, your games also add to anonymous player totals that help other creators plan: where players quit and which reactions they tapped (boring, too hard, confusing), counted across five or more creators and never shown for one game. A player's own words, your game's name and anyone's account are never part of them, and plays on your private playtest links are left out.
MCP Bridge & Engine Connections
When you connect a game engine (Unity, Unreal, Blender) via the MCP Bridge, connection metadata (engine type, plugin version, connection status) is logged. Scene context data exchanged over the bridge is processed in real-time and not permanently stored unless you explicitly save it (e.g., viewport snapshots, scene exports). WebSocket connections are authenticated via plugin auth tokens tied to your account.
Third-Party Services
We use the following third-party services:
Supabase
Database, auth, storage, real-time
Stripe
Payment processing & subscriptions
Vercel
Frontend hosting & edge functions
RunPod
GPU for cloud engine & NOVA
Anthropic
Claude AI via your BYOK key
Resend
Transactional email delivery
Each third-party service is bound by its own privacy policy. We share only the minimum data required for each service to function.
Your Rights
You have the right to:
- Access your personal data stored in our systems
- Correct inaccurate information via the Settings page
- Delete your account and associated data
- Export your scripts, projects, and generation history
- Revoke your API key at any time via the Settings page
To exercise these rights, contact us at hi@mcpity.com or use the in-app Settings page.
Data Retention
Account data is retained while your account is active. Upon account deletion, personal data is removed within 30 days. Anonymized aggregate usage data may be retained indefinitely for service improvement.
Generation History Retention by Tier
Free
Current session
Pro
90 days
Max
365 days
Children's Privacy
The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we discover we have inadvertently collected such data, we will delete it promptly.
Changes to This Policy
We may update this Privacy Policy from time to time. Material changes will be communicated via email or in-app notification at least 14 days before taking effect. The "Last updated" date at the top of this page reflects the most recent revision.
Contact
For privacy-related questions or requests, contact us at hi@mcpity.com.
© 2026 MCPity. All rights reserved.