This policy describes how O'Side Systems, LLC ("we", "us") collects, uses, discloses, retains and deletes personal information when you use Wyrd Builder (the "Service"). It is written to describe what the Service actually does today, not what it might do later; where a practice does not apply to us, this policy says so rather than reserving the right by default.
Controller: O'Side Systems, LLC, 5830 E 2nd St, Ste 7000 #14564, Casper, WY 82609, United States. Contact: [email protected]
1. Information We Collect
Information you provide.
- Account information — your email address, and optionally a display name, supplied when you request alpha access or accept an invitation. Passwords are handled by our authentication provider and are never stored by us in readable form.
- Organization information — the organization name, slug, and membership roles you or your administrator configure.
- Your Content — the game specifications, rulebooks, board designs, component definitions, manuscripts and other material you create or upload. This is the substance of the Service. You own it; see Section 7 of the Terms of Service.
- Support and feedback — the text of any feedback you submit through the in-product feedback control, together with the screen you submitted it from, your browser viewport size, the build identifier of the running release, and, if an error occurred in the preceding minutes, a short non-identifying signature of that error. This exists so a bug report can be tied to a specific deploy.
Information collected automatically.
- Technical and connection data — IP address, browser and device type, and request metadata, processed by our hosting and authentication providers in the ordinary course of serving requests and maintaining security logs.
- Anti-abuse signals — when you submit the public signup form, hCaptcha receives browser and device signals and your IP address in order to distinguish humans from automated submissions.
What we do not collect. We do not collect special-category data (racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, health data, or data concerning sex life or sexual orientation). We do not knowingly collect personal information from children under 16. We do not operate an advertising network, and we do not buy or sell personal information.
2. Legal Basis for Processing (GDPR)
Where the GDPR applies, we rely on the following bases:
- Performance of a contract — to create and maintain your account, host Your Content, and provide the Service you asked for.
- Legitimate interests — to keep the Service secure, prevent abuse, diagnose faults, and improve the product, balanced against your rights and freedoms.
- Consent — for any optional cookie category you accept (see Section 9) and for optional product-update email, which you can withdraw at any time.
- Legal obligation — where we must retain or disclose information to comply with applicable law.
3. How We Use Your Information
We use the information described above to operate your account and organization; to store, version, validate and simulate Your Content as you direct; to send transactional messages such as invitations, verification and account notices; to protect the Service against abuse; to diagnose faults and improve the product; and to comply with our legal obligations.
We do not use Your Content to train machine-learning models, and we do not sell personal information.
4. AI Processing and Third-Party AI Providers
Several Wyrd Builder features are LLM-assisted: rulebook ingestion, spec extraction and review, validation commentary, and manuscript evaluation. When you invoke one of these features, the material you submit — which may include substantial portions of Your Content — is transmitted to Anthropic for processing, along with the prompt and technical metadata, and the model's output is returned to you and stored against your project.
This transmission happens only when you invoke such a feature. Anthropic acts as our processor for that request and is bound by its own terms and transfer commitments.
5. Data Sharing and Disclosure
We share personal information only with the processors listed below, and only for the purposes described. This list is versioned in our source code as processor-inventory-v2026-08-22, so it cannot silently drift from what the Service actually does.
| Processor | Role | What it receives | Purpose |
|---|---|---|---|
| Supabase | Processor | Account identifiers, email addresses, organization membership, product content and metadata | Authentication, hosted Postgres, storage |
| Anthropic | Processor | Submitted prompts, uploaded or pasted creative material, model outputs, technical metadata | LLM-assisted extraction, review and writing workflows you initiate |
| DigitalOcean | Processor | IP address, request metadata, all data in transit to the application | Application hosting and delivery (US region) |
| Resend | Processor | Email addresses, message metadata, delivery events | Transactional email — invitations, verification, account notices |
| hCaptcha | Processor | Browser/device signals, IP address, challenge outcome | Bot and abuse prevention on public signup |
We may also disclose information where required by law, court order, or valid legal process; to protect our rights, property or safety, or those of our users; or in connection with a merger, acquisition or sale of assets, in which case we will give notice before your information becomes subject to a different policy.
6. International Data Transfers
The Service is hosted in the United States. If you access it from outside the United States, your information will be transferred to, stored in, and processed in the United States and other locations selected by our processors, where data protection law may differ from that of your jurisdiction. Where required, our processors rely on Standard Contractual Clauses or equivalent transfer mechanisms.
7. Data Security
We use industry-standard measures to protect personal information, including encryption in transit, row-level security in the database, scoped access tokens, and role-based access control within organizations. No method of transmission or storage is completely secure, and we cannot guarantee absolute security.
Wyrd Builder is a pre-release alpha service. You should keep your own copies of material you cannot afford to lose.
8. Data Retention
We retain account information for as long as your account is active. Your Content is retained until you delete it or close your account. When you request deletion, we remove personal information within 30 days, except where we are required to retain it by law; backup copies expire on their normal rotation cycle after that. Security and operational logs are retained for a limited period for abuse prevention and fault diagnosis.
9. Cookies and Tracking Technologies
Wyrd Builder uses a small number of cookies. We do not use advertising cookies, and we do not embed third-party trackers.
Strictly necessary — set without consent, because the Service cannot function without them:
- Authentication cookies (
sb-*), set by our authentication provider, keep you signed in and maintain your session. - `wyrd_active_project` remembers which project you last had open so the studio returns you to it. It holds a project identifier and nothing else.
Analytics (optional) — we do not currently set any analytics cookies. The Service ships no analytics, tracking or session-recording tooling of any kind. We present a cookie choice so that if we ever introduce optional analytics, they will be set only for users who have accepted them; declining is honored from the moment you choose, and choosing "Essential Only" is a complete answer that requires nothing further from you.
You can change your choice at any time from the link in the footer, and you can clear or block cookies through your browser — though blocking the strictly necessary cookies will sign you out and prevent the Service from working.
10. Your Privacy Rights
10.1 Everyone
Regardless of where you live, you may request to access the personal information we hold about you; correct it if it is inaccurate; delete it; export Your Content in a machine-readable form; and opt out of non-transactional email.
10.2 GDPR (EEA, UK, Switzerland)
If you are in the EEA, UK or Switzerland, you additionally have the right to restrict processing, to object to processing based on legitimate interests, to data portability, to withdraw consent at any time without affecting the lawfulness of prior processing, and to lodge a complaint with your local supervisory authority.
10.3 CCPA/CPRA (California)
California residents have the right to know what personal information is collected, used and disclosed; to delete it; to correct it; to opt out of sale or sharing; and not to be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined by the CCPA, and we have not done so in the preceding twelve months.
10.4 Other US States
Residents of Virginia, Colorado, Connecticut, Utah, Texas and other states with comprehensive privacy statutes have comparable rights of access, correction, deletion, portability, and opt-out. We honor these requests regardless of your state of residence.
11. Exercising Your Rights
Email [email protected] with your request and the email address associated with your account. We will verify your identity through the address on file and respond within 30 days, or within the shorter period required by applicable law. We do not charge a fee for a reasonable request. If we decline a request, we will tell you why and how to appeal.
12. Children's Privacy
The Service is not directed to children. We do not knowingly collect personal information from anyone under 16. If you believe a child has provided us with personal information, contact [email protected] and we will delete it.
13. Changes to This Policy
We may update this policy from time to time. The version identifier and "last updated" date at the top of this page always reflect the current version. If we make a material change, we will give notice through the Service before the change takes effect. Continued use after the effective date constitutes acceptance.
14. Contact
Questions, requests, or complaints about this policy:
O'Side Systems, LLC5830 E 2nd St, Ste 7000 #14564Casper, WY 82609United States
We have not appointed a Data Protection Officer, as we are not required to do so under Article 37 GDPR. Privacy correspondence is handled at the address above.