Privacy Policy
Last updated: July 30, 2026
This Privacy Policy explains how Tarunk Engine(“we,” “us,” or “our”) collects, uses, stores, and protects your personal data when you visit our website and use our game engine services. We are committed to protecting your privacy in compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
1. Data Controller
Tarunk Engine is the data controller responsible for your personal data. If you have any questions about this policy or wish to exercise your rights, contact us at:
2. Data We Collect
We collect only the data necessary to provide and improve our services. We do not sell your personal data to third parties.
A. Information You Provide
- Account Information: When you register, we collect your email address and display name. You may optionally provide additional profile information.
- Support Communications: If you contact us for support, we collect your email, message content, and any files you share with us.
- Waitlist Sign-up: When you join our waitlist, we collect your email address and any optional notes you provide.
B. Information Collected Automatically
- Usage Data: With your consent (via our cookie banner), we collect page views, feature usage (studio opens, imports, exports), and session information to improve our service.
- Device & Browser Data: We collect anonymized information about your browser type, operating system, screen resolution, and general geographic region (country level only).
- Session Identifiers:A unique session ID is stored in your browser’s session storage to group analytics events within a single visit. This ID is deleted when you close your browser tab.
C. Cookies & Local Storage
- Essential Cookies: We use Supabase Auth cookies to manage your login session. These are strictly necessary for the service to function and are set automatically.
- Consent Preference:A localStorage entry (“tarunk-cookie-consent”) stores whether you have accepted or declined analytics cookies.
- Analytics Cookies:Only set if you click “Accept” on the cookie banner. These enable us to track page views and feature usage (see Section 4).
3. How We Use Your Data
We use your personal data only for the following purposes:
- Service Delivery: To create and manage your account, authenticate your access, and provide the engine, studio, and related services.
- License Management: To issue, verify, and manage engine license keys.
- Communication: To send service updates, security notices, and (only with your consent) marketing communications about new features and releases.
- Improvement: To analyze usage patterns (with your consent) so we can improve performance, fix bugs, and prioritize features.
- Security: To detect and prevent abuse, unauthorized access, and license violations.
4. Legal Basis for Processing (GDPR)
Under the GDPR, we process your personal data on the following legal bases:
- Contractual Necessity (Art. 6(1)(b)): Processing your account data and license keys is necessary to perform our contract with you — providing the game engine services.
- Legitimate Interest (Art. 6(1)(f)): We process usage data and security logs to improve our service and protect our platform. You have the right to object to this processing.
- Consent (Art. 6(1)(a)): Analytics tracking, cookies (other than essential), and marketing emails are processed only with your explicit, freely given consent. You may withdraw consent at any time by clearing your cookie preferences.
- Legal Obligation (Art. 6(1)(c)): We may process data to comply with applicable laws, such as retaining records for tax or regulatory purposes.
5. Third-Party Services
We use the following third-party services to operate our platform. Each service has been selected for its GDPR compliance and data protection measures:
Supabase
Authentication, database, and storage. Supabase stores your account credentials, profile data, license keys, and analytics events. Data is hosted in the United States (US East). Supabase is SOC 2 compliant and adheres to the Standard Contractual Clauses (SCCs) for EU data transfers.
Vercel
Hosting and infrastructure. The Tarunk Engine website and API are hosted on Vercel’s global edge network. Vercel stores server logs (IP addresses, request paths, timestamps) for up to 30 days. Vercel is GDPR compliant and processes data under SCCs.
GitHub
Source code repository and issue tracking. The Tarunk Engine source code is hosted on GitHub. Your interactions with our public repositories (issues, discussions) are governed by GitHub’s privacy policy.
We do not use advertising networks, trackers, or social media pixels. We do not share your personal data with third parties for their own marketing purposes.
6. Data Retention
We retain your personal data only as long as necessary to provide our services and comply with legal obligations:
- Account Data: Retained until you delete your account. After deletion, we may retain anonymized aggregates and records required by law (e.g., billing records for tax purposes) for up to 7 years.
- Analytics Events: Retained for 24 months. After this period, events are permanently deleted. Consent preferences are stored locally in your browser and are not collected by us.
- Server Logs (Vercel): Retained for 30 days, after which IP addresses and request metadata are purged.
- License Records: Retained for the duration of the license agreement plus 7 years for legal compliance.
7. Your Rights Under GDPR
If you are located in the European Economic Area (EEA), Switzerland, or the United Kingdom, you have the following rights under the GDPR. You may exercise these rights by contacting us at privacy@tarunkengine.com. We will respond within 30 days.
Right of Access (Art. 15)
You may request a copy of the personal data we hold about you.
Right to Rectification (Art. 16)
You may request correction of inaccurate or incomplete data.
Right to Erasure (Art. 17)
You may request deletion of your personal data ("right to be forgotten").
Right to Restrict Processing (Art. 18)
You may request that we limit how we use your data.
Right to Data Portability (Art. 20)
You may request a machine-readable copy of your data to transfer to another service.
Right to Object (Art. 21)
You may object to processing based on legitimate interest, including analytics tracking.
Right to Withdraw Consent (Art. 7(3))
You may withdraw your consent for analytics at any time by clearing your cookie preferences. Withdrawal does not affect the lawfulness of processing before withdrawal.
Right to Lodge a Complaint (Art. 77)
You have the right to complain to your local data protection supervisory authority.
8. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:
- Encryption in Transit: All communications with our servers are encrypted using TLS 1.3.
- Encryption at Rest: Data stored in Supabase is encrypted at rest using AES-256.
- Authentication: Access to our infrastructure is protected by strong passwords, multi-factor authentication, and IP allow-listing.
- Access Control: Only authorized personnel with a legitimate business need have access to production data. Access is logged and audited.
- License Keys: Engine license keys are stored as hashed values and validated via server-side HMAC verification.
9. International Data Transfers
Your personal data is processed primarily in the United States, where our hosting providers (Supabase, Vercel) are located. For users in the European Economic Area, we ensure appropriate safeguards are in place through:
- Standard Contractual Clauses (SCCs): Both Supabase and Vercel have adopted the European Commission’s SCCs as the legal mechanism for transferring personal data from the EEA to the US.
- We rely on the UK Addendum to the SCCs for transfers from the United Kingdom.
10. Children’s Privacy
Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child under 16 has provided us with personal data, we will promptly delete it. If you believe a child has provided us with their data, please contact us immediately.
11. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by:
- Posting the updated policy on this page with a new "Last updated" date.
- Sending an email notification to registered users (if the change is significant).
We encourage you to review this policy periodically. Your continued use of our services after changes become effective constitutes your acceptance of the updated policy.
12. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Email: privacy@tarunkengine.com
We will acknowledge your request within 5 business days and respond fully within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.