Privacy Policy

This policy explains what level.new collects, why we collect it, and what you can do about it. We try to keep it short and plain. If anything here doesn’t make sense, email privacy@level.new.

The short version. We collect the data we need to run the platform — your account, your apps, the prompts you send the agent, and basic usage telemetry. We don’t sell it. We don’t use creator content to train third‑party models. You can export or delete your data at any time.

Account information

When you sign up we store your email, display name, and (if you connect Google) your Google account identifier. If you upload an avatar or set a creator handle, we store that too.

App content

We store the apps you build — source files, generated assets, covers and icons, and the conversation history between you and the agent. This content lives in Supabase Storage and Postgres and is retained for as long as your account is active.

User activity

When someone plays a game at level.new/<slug> we record gameplay sessions, scores, and presence data so leaderboards and multiplayer work. Users can play anonymously; we don’t require an account to play.

Usage telemetry

We capture product analytics events — page views, button clicks, studio engagement, and agent run metadata — via PostHog. We do notcapture per‑message agent chat content or in‑game user events.

Payment information

Stripe handles all card details directly. We store a customer reference, your plan, and your invoice history — never raw card numbers.

Device and log data

Like every web service, we record IP addresses, user agents, and request timestamps in short‑lived logs for security, rate‑limiting, and debugging.

• To run the studio, the agent, and the games you publish.
• To bill you for subscriptions and credit bundles.
• To understand which features get used and which break — so we can improve them.
• To send transactional email (sign‑in links, receipts, build notifications).
• To keep the platform safe: detect abuse, enforce reserved slugs, and respond to takedown reports.

We use a small number of trusted subprocessors to operate level.new. Each one only sees the data it needs to do its job.

We don’t sell personal information, and we don’t share creator app content with model providers for training. Agent requests routed through the Vercel AI Gateway run under zero‑data‑retention terms with the underlying model providers.

Everything on level.new lives on a single domain, so we only use first‑party cookies — the Supabase Auth session cookie that keeps you signed in, and a PostHog analytics cookie. We don’t embed third‑party ad networks or cross‑site trackers.

• Access & export. You can download your apps and account data from your account settings.
• Delete. Deleting your account removes your profile, apps, and associated bundles within 30 days. Some billing records are retained where law requires it.
• Opt out of analytics. Turn off product analytics in account settings; we’ll still need the cookies that keep you signed in.
• Marketing email. Every marketing email has an unsubscribe link. Transactional email (sign‑in, receipts) can’t be turned off while your account is active.

level.new isn’t directed at children under 13, and we don’t knowingly collect personal information from them. If you believe a child has given us personal information, email privacy@level.newand we’ll delete it.

We’ll update this page when our practices change. If the change is material we’ll notify you by email or in the studio before it takes effect.

Questions, requests, or data subject inquiries: email privacy@level.new. We’re operated by Northbrook PBC.