Privacy Policy
Last updated: August 6, 2026
This Privacy Policy explains how Tarunk Engine(“we,” “us,” or “our”) collects, uses, stores, and protects your personal data when you visit our website and use our game engine services. We are committed to protecting your privacy in compliance with the General Data Protection Regulation (GDPR) and other applicable data protection laws.
1. Data Controller
Tarunk Engine is the data controller responsible for your personal data. If you have any questions about this policy or wish to exercise your rights, contact us at:
2. Data We Collect
We collect only the data necessary to provide and improve our services. We do not sell your personal data to third parties.
A. Information You Provide
- Account Information: When you register, we collect your email address and display name. You may optionally provide additional profile information.
- Support Communications: If you contact us for support, we collect your email, message content, and any files you share with us.
- Waitlist Sign-up: When you join our waitlist, we collect your email address and any optional notes you provide.
- Copyright & Violation Reports: When you file a copyright infringement (DMCA) notice, a counter-notification, or report content in the Assets Store, we collect the information described in Section 7.
- Marketplace & Payments: When you use the Assets Store, we collect the data needed to operate it: your wallet balance and top-up records, purchase history, assets you list for sale (title, description, price, files), affiliate earnings and payout requests, and your referral code. When you subscribe to the Supporter plan, payment is processed by Polar.sh (see Section 5) and we receive only the subscription status needed to grant your tier.
B. Information Collected Automatically
- Usage Data: With your consent (via our cookie banner), we collect page views, feature usage (studio opens, imports, exports), and session information to improve our service.
- Device & Browser Data: We collect anonymized information about your browser type, operating system, screen resolution, and general geographic region (country level only).
- Session Identifiers:A unique session ID is stored in your browser’s session storage to group analytics events within a single visit. This ID is deleted when you close your browser tab.
C. Cookies & Local Storage
- Essential Cookies: We use Supabase Auth cookies to manage your login session. These are strictly necessary for the service to function and are set automatically.
- Consent Preference:A localStorage entry (“tarunk-cookie-consent”) stores whether you have accepted or declined analytics cookies.
- Analytics Cookies:Only set if you click “Accept” on the cookie banner. These enable us to track page views and feature usage (see Section 4).
3. How We Use Your Data
We use your personal data only for the following purposes:
- Service Delivery: To create and manage your account, authenticate your access, and provide the engine, studio, and related services.
- License Management: To issue, verify, and manage engine license keys.
- Communication: To send service updates, security notices, and (only with your consent) marketing communications about new features and releases.
- Improvement: To analyze usage patterns (with your consent) so we can improve performance, fix bugs, and prioritize features.
- Security: To detect and prevent abuse, unauthorized access, and license violations.
4. Legal Basis for Processing (GDPR)
Under the GDPR, we process your personal data on the following legal bases:
- Contractual Necessity (Art. 6(1)(b)): Processing your account data and license keys is necessary to perform our contract with you — providing the game engine services.
- Legitimate Interest (Art. 6(1)(f)): We process usage data and security logs to improve our service and protect our platform. You have the right to object to this processing.
- Consent (Art. 6(1)(a)): Analytics tracking, cookies (other than essential), and marketing emails are processed only with your explicit, freely given consent. You may withdraw consent at any time by clearing your cookie preferences.
- Legal Obligation (Art. 6(1)(c)): We may process data to comply with applicable laws, such as retaining records for tax or regulatory purposes.
5. Third-Party Services
We use the following third-party services to operate our platform. Each service has been selected for its GDPR compliance and data protection measures:
Supabase
Authentication, database, and storage. Supabase stores your account credentials, profile data, license keys, and analytics events. Data is hosted in the United States (US East). Supabase is SOC 2 compliant and adheres to the Standard Contractual Clauses (SCCs) for EU data transfers.
Vercel
Hosting and infrastructure. The Tarunk Engine website and API are hosted on Vercel’s global edge network. Vercel stores server logs (IP addresses, request paths, timestamps) for up to 30 days. Vercel is GDPR compliant and processes data under SCCs.
GitHub
Source code repository and issue tracking. The Tarunk Engine source code is hosted on GitHub. Your interactions with our public repositories (issues, discussions) are governed by GitHub’s privacy policy.
Polar.sh
Payment processing for the Supporter subscription plan ($5/month). Polar.sh acts as the merchant of record and processes your payment information (including payment card details, which we never see or store). When you start a checkout, we send Polar your email address and an internal account identifier to attribute the subscription to your account; Polar sends us subscription lifecycle webhooks (active, canceled, past due) so we can grant or revoke your Supporter tier. Polar processes data under its privacy policy and GDPR-compliant data processing terms.
We do not use advertising networks, trackers, or social media pixels. We do not share your personal data with third parties for their own marketing purposes.
6. Data Retention
We retain your personal data only as long as necessary to provide our services and comply with legal obligations:
- Account Data: Retained until you delete your account. When you close your account, your uploaded asset files (including previews) are permanently removed from our storage, and marketplace records tied to you (purchases, wallet, affiliate) are deleted. After deletion, we may retain anonymized aggregates and records required by law (e.g., billing records for tax purposes) for up to 7 years.
- Analytics Events:Retained for 24 months. After this period, events are permanently deleted. Consent preferences are stored locally in your browser and are not collected by us. Country of origin (country code only, e.g. “ID”) is derived server-side from the network edge (Vercel) — raw IP addresses are never stored in analytics events. A one-way hashed form of your IP address (irreversible, never the raw IP) is stored with each event solely to rate-limit the analytics endpoint.
- Server Logs (Vercel): Retained for 30 days, after which IP addresses and request metadata are purged.
- License Records: Retained for the duration of the license agreement plus 7 years for legal compliance.
- Copyright & Violation Reports: Retained for the duration of the review and any resulting legal proceedings, and generally up to 7 years after resolution for legal compliance (see Section 7).
7. Copyright Reports & DMCA Notices
Our Terms of Service (Section 10) describe how to submit a copyright infringement (DMCA) takedown notice, a counter-notification, or a report under Indonesian law (UU ITE). This section explains what personal data we process in connection with those reports and how we handle it.
A. Information You Provide in a Report
- Contact Information: Your name, mailing address, telephone number, and email address (required elements of a valid DMCA notice under 17 U.S.C. § 512(c)(3)).
- Identified Material: A description of the copyrighted work you claim is infringed and identification of the allegedly infringing material with enough detail to locate it (for example, the asset title and URL in the Assets Store).
- Statements & Signature: Your good-faith belief statement, your statement under penalty of perjury, and your physical or electronic signature, as required for a valid notice.
- In-app Reports:When you use the “Report” feature in the Assets Store, we collect your account identifier and the reason you provide.
B. Information Collected Automatically
- Technical Data: When you submit a report through our website, our servers record your IP address, the request timestamp, and related request metadata (see Vercel server logs, Section 6).
How We Use This Data. We use report data solely to receive, validate, and act on copyright and violation notices; to communicate with the parties involved; to comply with our legal obligations; and to establish or defend against legal claims.
Legal Basis (GDPR). We process report data on the following legal bases: legal obligation (Art. 6(1)(c)) where we must act on valid takedown notices, and legitimate interest (Art. 6(1)(f)) to protect our platform and the rights of rightsholders.
Disclosure. Consistent with the DMCA counter-notification process, we may share the contents of a takedown notice with the alleged infringer so they can respond. We may also disclose report data to law enforcement or courts where required by law (including under UU ITE).
Retention. Report data is retained for as long as necessary to resolve the matter and any resulting legal proceedings, and generally up to 7 years after resolution for legal compliance (see Section 6).
8. Your Rights Under GDPR
If you are located in the European Economic Area (EEA), Switzerland, or the United Kingdom, you have the following rights under the GDPR. You may exercise these rights by contacting us at privacy@tarunkengine.com. We will respond within 30 days.
Right of Access (Art. 15)
You may request a copy of the personal data we hold about you.
Right to Rectification (Art. 16)
You may request correction of inaccurate or incomplete data.
Right to Erasure (Art. 17)
You may request deletion of your personal data ("right to be forgotten").
Right to Restrict Processing (Art. 18)
You may request that we limit how we use your data.
Right to Data Portability (Art. 20)
You may request a machine-readable copy of your data to transfer to another service.
Right to Object (Art. 21)
You may object to processing based on legitimate interest, including analytics tracking.
Right to Withdraw Consent (Art. 7(3))
You may withdraw your consent for analytics at any time by clearing your cookie preferences. Withdrawal does not affect the lawfulness of processing before withdrawal.
Right to Lodge a Complaint (Art. 77)
You have the right to complain to your local data protection supervisory authority.
9. Data Security
We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction:
- Encryption in Transit: All communications with our servers are encrypted using TLS 1.3.
- Encryption at Rest: Data stored in Supabase is encrypted at rest using AES-256.
- Authentication: Access to our infrastructure is protected by strong passwords, multi-factor authentication, and IP allow-listing.
- Access Control: Only authorized personnel with a legitimate business need have access to production data. Access is logged and audited.
- License Keys: Engine license keys are stored as hashed values and validated via server-side HMAC verification.
10. International Data Transfers
Your personal data is processed primarily in the United States, where our hosting providers (Supabase, Vercel) are located. For users in the European Economic Area, we ensure appropriate safeguards are in place through:
- Standard Contractual Clauses (SCCs): Both Supabase and Vercel have adopted the European Commission’s SCCs as the legal mechanism for transferring personal data from the EEA to the US.
- We rely on the UK Addendum to the SCCs for transfers from the United Kingdom.
11. Children’s Privacy
Our services are not directed to individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child under 16 has provided us with personal data, we will promptly delete it. If you believe a child has provided us with their data, please contact us immediately.
12. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in our practices or legal requirements. We will notify you of material changes by:
- Posting the updated policy on this page with a new "Last updated" date.
- Sending an email notification to registered users (if the change is significant).
We encourage you to review this policy periodically. Your continued use of our services after changes become effective constitutes your acceptance of the updated policy.
13. Contact Us
If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:
Email: privacy@tarunkengine.com
We will acknowledge your request within 5 business days and respond fully within 30 days. If you are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.