Privacy and your data

Updated 31 October 2026. OpenWorld is operated by Nir Feinstein. For access, correction or removal requests, use the contact form or email fainir2006@gmail.com.

What the studio saves

An account stores your email, username, a password hash and account metadata. Saved sessions contain prompts, assistant messages, version descriptions and generated game files. Public sharing, publishing and suggestions happen only when you choose them. Sharing makes that game and its public description available to anyone with the link; it does not expose your private chat or version history. Public copies may be downloaded by other people.

You can explore the base game without an account. Guest editing uses a random private capability stored on this browser. Keep this device data to reopen guest edits; the operator cannot automatically prove ownership if it is lost. There is no account-recovery email service in this release; contact the operator for a reviewed ownership request.

AI and service providers

You choose either a limited included Claude text edit or optional bring-your-own-key mode, then explicitly send a game-edit request. OpenWorld forwards the prompt, relevant game source, chat context and any attached image to Anthropic to produce the change. Only bring-your-own-key mode includes your key for that call; raw keys are not saved in the server database or application logs. Anthropic's service terms and retention also apply. No payment is collected by OpenWorld.

Railway hosts the application, account database and saved games. Existing Three.js assets are loaded through jsDelivr or unpkg; the game sandbox allows only the documented asset hosts. These providers receive the ordinary network information needed to serve requests. The contact form stores your submitted name, email and message for the operator; it does not send marketing email.

Included Claude beta

Included text edits send the prompt, relevant game code and recent chat through the shared Betterloop Claude budget gateway, then Anthropic using the operator's funded account. Private user keys are not used as a fallback. Server-derived hashes of the account or private guest capability and network address enforce persistent rolling allowances without sending raw account IDs, guest proofs or IPs to the gateway. The local request ledger keeps hashed identities, a payload hash, status and private session/version references for safe retries and duplicate prevention; it contains no raw key, prompt or model reply and has no automatic expiry. These operational references can remain after account closure.

The gateway retains request/identity hashes, model, usage, cost/reservation and status metadata as permanent budget/idempotency records. It does not store raw prompts in its database or logs. Successful response text is encrypted for duplicate-result recovery. The gateway returns a cached result for up to one hour, then removes old ciphertext opportunistically; this is not a guarantee of immediate erasure from every backup or operator-held copy. An uncertain model result holds its reservation until independently reviewed and never triggers an automatic replacement call. Existing private chats and game versions are still stored by OpenWorld as described above. Anthropic's separate processing/retention terms apply. Included availability can pause when shared limits are reached.

Contact and email notifications

New form submissions save your name, reply email and message in the private operator inbox, separately from any account. An email notification is queued through the existing Betterloop contact relay and Resend to the operator's Gmail inbox, with your email as Reply-To. No automatic confirmation or marketing message is sent to you. A saved form is not proof of email delivery. Failed notifications retry within bounded limits; uncertain or old attempts stop for operator review. Existing historical inbox messages are not emailed retrospectively.

OpenWorld also saves delivery state, attempt times and a reference for retry and review. The relay saves references, delivery/idempotency metadata, payload/envelope hashes and rate-limit hashes of reply email and network address; its database does not store the full name, reply address, message or raw IP. Delivery metadata has no automatic expiry. Old rate-limit rows are removed opportunistically on later requests, not on an exact deletion schedule. Full messages remain with Resend and the operator inbox under separate retention. Request correction or removal through the operator; deleting an OpenWorld account does not automatically erase those separately submitted messages or provider/inbox copies. Draft form fields stay in the current document until you navigate away; they are not put in browser storage or optional analytics.

This browser

The studio saves its sign-in token, account display information, guest capability, current session/version, recent chat, panel preferences and your API key in local storage. This keeps them across visits on this device. The isolated game cannot read the studio's storage; game cosmetic preferences are temporary and reset on reload. Use Your account → Forget saved API key to remove the stored key; close or reload other studio tabs to clear an in-memory copy. Signing out clears studio account credentials and the saved key on this device.

Google Analytics, Mixpanel and Betterloop are optional and stay off until you allow them using Analytics choices. Only configured providers load. Google receives sanitized public page context and fixed events, with advertising personalization and Google Signals disabled. Mixpanel receives fixed events and a random browser identifier created after consent, with IP geolocation disabled. Betterloop records structural interactions, browser errors and performance with text capture disabled. No prompts, chat content, keys, account data, query strings, fragments or version IDs are sent. Account, admin, contact, private-version and game pages are excluded. There is no session replay. Do Not Track and Global Privacy Control keep optional analytics off. Withdraw at any time to stop new measurements, discard queued Betterloop events and clear accessible analytics identifiers. This cannot recall previously sent data or requests already in flight. Provider retention settings apply. Analytics choices Optional website analytics is off. Server request addresses are used briefly in memory for abuse limits, without being stored in the account export. Hosting providers may maintain their own operational logs.

Export and account removal

Your account can download your profile, saved chats, version information and owned game files. The export excludes password hashes, sign-in tokens, guest proofs and API credentials. Contact the operator if the export exceeds the 512 MB safety limit.

Closing an account requires the current password and typing DELETE. It removes the account, its saved chats, active game files, public shares and stars. Other accounts are preserved. Copies another person downloaded cannot be recalled. If you submitted a contribution and the operator approved it, its HTML may already have been copied into the shared base game. Account closure removes your saved version and its links, without silently reverting that shared game for everybody; contact the operator about removal of that separate public copy. Contact messages were submitted separately and are not linked to an unverified signup email; request their removal through the operator, who may check ownership before acting.

Server recovery keeps the latest seven snapshots, normally made every12hours. The existing independent encrypted Mac mirror also keeps up to seven copies; the Mac must be awake and authorized for new copies. Older snapshots can contain removed data until they rotate, and copies can persist longer if backups stop. Account-ID-only deletion evidence is retained separately and in new snapshots. The documented restore command requires surviving current deletion evidence and applies it before a restored service may run, so older backups cannot reactivate removed accounts. The operator must use the latest surviving evidence when restoring an older copy.

Retention and choices

Account/game data stays while your account is useful or until you remove it. Contact messages stay while relevant to the request; ask for correction or removal at any time. The minimal removed-account IDs are retained to prevent restoration of deleted records. No automatic marketing sequence or sale of account data is part of this product.