Privacy Policy

1. Introduction

PocketByte ("we", "us", "our") operates the PocketByte mobile application and the website at pocketbyte.io. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our services, including the PocketByte app for ChatGPT and the PocketByte connector for Claude and other AI assistants (section 7).

The controller responsible for data processing is Florian Holtorf – PocketByte, Op'n Dörp 2, 24217 Barsbek, Germany (operator of PocketByte, see Imprint), email contact@pocketbyte.io, contact form pocketbyte.io/contact.

2. Information We Collect

We may collect the following types of information:

• Account information: Email address, username, display name, profile picture
• User content: Games you create and publish, comments, ratings, feedback
• Gameplay videos ("reels"): Screen recordings of gameplay that you choose to record, edit, and publish, including any captions, text overlays, audio tracks, and thumbnails you add
• Usage data: Game play statistics, feature usage, session duration
• Device information: Device type, operating system, app version, device language/locale
• Purchase data: Credit purchase history (payment processing is handled by Apple/Google)
• Reports & feedback: Content reports, app feedback, bug reports you submit
• Contact messages: What you send us through the contact form or by email (section 15)
• Support links: If you add support links to your profile, the provider handles, your optional support message and your confirmation; if you tap someone's support link, a pseudonymous click record (section 6a)

Gameplay videos are created and uploaded only when you actively record and publish them. Because a recording captures whatever is shown on screen, please make sure it does not contain personal data (yours or anyone else's), private messages, or third-party content you are not allowed to share. You confirm this before publishing.

3. How We Use Your Information

We use collected information to:

• Provide, maintain, and improve our services
• Process transactions and manage your credit balance
• Display your published games and creator profile to other users
• Send important service-related communications
• Investigate reports and enforce our Terms of Service
• Analyze usage patterns to improve the user experience
• Prevent fraud and ensure platform security

4. Data Sharing

We do not sell your personal data. We may share information with:

• Service providers: Cloud hosting (Supabase), AI model providers (Anthropic, OpenAI, Replicate — see section 6), push notifications (Google Firebase Cloud Messaging) — only the minimum data necessary to provide the service
• Advertising partners: Google and Meta, only if you agree to ad measurement in the app (see section 5); Google AdMob when you choose to watch a rewarded video (see section 5a)
• Legal requirements: When required by law, regulation, or legal process
• Safety: To protect the rights, safety, or property of our users or the public

Your published games and public profile are visible to all users of the Platform.

5. Ad Measurement (Google & Meta)

We advertise PocketByte on Google (Google Ads) and Meta (Instagram, Facebook). To measure which ads lead to installs and to optimize our campaigns, the app contains Google Analytics for Firebase (Google Ireland Limited) and the Meta SDK (Meta Platforms Ireland Limited). Both are switched off by default and only become active after you agree in the app ("Ad measurement"). You can withdraw your consent at any time in the app under Settings → Ad measurement.

• What is sent: app events (app start and install, sign-up, created games, paywall views, checkout starts, purchases with price and currency, created matches and challenges), device and app information (device model, operating system, app version, language, IP address) and device identifiers (app instance ID; on Android the advertising ID; on iOS the advertising identifier only if you also allow tracking in the iOS prompt)
• What is not sent: the content of your games, your prompts and messages, your email address or your name
• Legal basis: your consent (Art. 6(1)(a) GDPR, § 25(1) TDDDG)
• Transfers: Google and Meta may process data in the USA, based on the EU–U.S. Data Privacy Framework and standard contractual clauses. For some purposes they act as independent controllers; see the privacy policies of Google and Meta
• Retention: event data in Google Analytics is kept for 2 months; Meta keeps event data according to its own policy

If you decline, neither SDK sends events. Apple and Google may still report aggregated install counts for ad campaigns from their app stores; these do not identify you.

5a. Rewarded Video Ads (Google AdMob)

In the app you can choose to watch a short video ad in exchange for a reward (for example experience points for your companion). Ads are only loaded when you tap such an offer; there are no ads during play and none on the website. The ads are delivered by Google AdMob (Google Ireland Limited).

• Consent: in the EEA, the UK and Switzerland we ask for your choice with Google's consent form (a certified consent management platform) before the first ad request. You can change your choice at any time in the app under Settings → Privacy options for ads.
• What Google processes: device and app information, IP address and the approximate location derived from it, advertising identifiers (on iOS only if you allow tracking), ad interactions and diagnostic data. Without consent to personalised ads, Google shows non-personalised ads based on limited data.
• Reward confirmation: to credit your reward, Google sends us a signed confirmation containing your PocketByte user ID and the reward; we store it to prevent double rewards and abuse.
• Legal basis: your consent for storing and reading information on your device and for personalised ads (Art. 6(1)(a) GDPR, § 25(1) TDDDG); for the reward confirmation, performance of the service you request (Art. 6(1)(b) GDPR).
• Transfers: Google may process data in the USA based on the EU–U.S. Data Privacy Framework and standard contractual clauses; see the Google advertising privacy information

6. AI Processing & Content Moderation

When you use PocketByte's own AI features, the inputs needed for the request are sent to third-party AI providers that act as our processors. We send only the minimum information needed and do not send your email address, name or payment data.

• Anthropic (Claude models): game generation and changes (your prompts, game descriptions, game code and change requests), the automated content review at publishing, and companion chat messages
• OpenAI (GPT and image models such as gpt-image-2.5, Whisper): game generation and changes as a fallback or when such a model is selected; images for game covers, game assets, sprite animations and profile pictures (your prompt and, where you choose one, a reference image such as your current avatar or an uploaded picture); transcription of voice input you record
• Replicate: background removal for game assets (model by Bria) and short animated clips from game images (Seedance video models by ByteDance), using the image and prompt you provide

These providers process the data on our behalf under data processing agreements and, according to their API terms, do not use it to train their models. They may keep inputs for a limited period for abuse monitoring. Processing takes place in the USA; transfers are based on the European Commission's standard contractual clauses (Art. 46(2)(c) GDPR) and, where the provider is certified, the EU–U.S. Data Privacy Framework. Legal basis: performance of the service you request (Art. 6(1)(b) GDPR). Generated results (games, images, videos) are stored in your account like other User Content.

To keep the community safe, content you publish (including games, captions, comments, and gameplay videos) may be reviewed using a combination of automated systems (including AI-based moderation) and human review. This helps us detect and act on content that violates our Terms of Service, such as illegal, harmful, or infringing material.

6a. Creator Support Links

Creators can add links to external tip and payment pages (PayPal.me, Ko-fi, Buy Me a Coffee, Stripe Payment Links) to their profile and games so that players can support them.

• No payments through PocketByte: a support link opens the provider's page outside PocketByte. PocketByte is not a party to any payment, does not receive or process payment data and does not receive any share of the payment. Whatever you enter there is processed by the provider under its own terms and privacy policy.
• Data of creators: the provider handle you enter (we build the link from it), your optional support message, your display settings and the time you confirmed that you are 18 or older or that a parent or guardian manages the account at the provider. Handles, links and the message are public on your profile and games.
• Click statistics: when you tap a support link we record the creator, provider, where the link was tapped (e.g. profile, game page, feed), platform, date and a pseudonymous viewer key — a one-way hash of your user ID or, if you are not signed in, of a random device or browser ID. Each viewer is counted at most once per creator and day. Creators only see aggregated numbers, never who tapped. Click records are deleted automatically after 180 days.
• Reports: signed-in users can report support links (e.g. scam, impersonation). We store the reporter's user ID, the reason and optional details, notify our moderators and automatically hide all links of a creator once several different users have reported them, until a moderator has reviewed them. Report records are kept as long as needed to handle the report and prevent abuse (section 11).
• Legal basis: for creators' links, performance of the service (Art. 6(1)(b) GDPR); for click statistics, reports and auto-hiding, our legitimate interest in offering creators aggregated statistics and in protecting users from fraud and abuse (Art. 6(1)(f) GDPR). You can object to the click statistics at any time by contacting us.

7. PocketByte in ChatGPT, Claude and Other AI Assistants

You can use PocketByte from AI assistants: the PocketByte app in ChatGPT (server endpoint pocketbyte.io/api/mcp-chatgpt) and the PocketByte connector for Claude and other assistants that support the Model Context Protocol (MCP) (endpoint pocketbyte.io/api/mcp). In both cases the assistant's own AI model writes the game; PocketByte tests, stores, shows and, on request, publishes it. PocketByte is not affiliated with or endorsed by OpenAI or Anthropic.

• What our tools receive:only the inputs the assistant sends to a PocketByte tool for your request — for example a game's title, description, genre and code, a change description, the assistant's model name (shown as "Built with …"), search keywords, game ids, and (Claude connector only) image or 3D model files you ask it to upload. We do not request or receive your chat history, other conversations, your location or your contacts.
• Anonymous previews (ChatGPT, without sign-in): if you have not connected a PocketByte account, a game you create is stored as a private preview (code, title, description, versions, automatic test results) for 24 hours and then deleted automatically. A preview is bound to a one-way hash (SHA-256) of the anonymous user identifier ChatGPT sends with each request, so only you can open, edit or save it; we never receive your name or email for previews. Previews are never listed or published and can only be played through an expiring signed link.
• Abuse prevention and rate limits: to limit abuse we store a one-way hash of the requesting IP address with each preview (deleted with the preview after 24 hours) and keep short-lived, in-memory request counters keyed by hashed identifiers. We do not use these identifiers for tracking, profiling or advertising.
• Account linking (OAuth):to save, list or publish games, you connect your PocketByte account. You sign in on pocketbyte.io (OAuth 2.1 with PKCE, operated with our authentication provider Supabase), and the assistant receives an access token for your PocketByte account. We never see your ChatGPT or Claude password, and OpenAI or Anthropic never see your PocketByte password. With this token the tools can read your basic profile (account id, username or display name, email address — used to show which account is connected), list and read your games, create and edit private draft games and new versions, upload assets (Claude connector), and publish a game when you ask for it. They cannot delete your games, change your account settings, make purchases or access payment data. You can disconnect PocketByte at any time in the assistant's settings, and revoke an assistant's access (including its refresh tokens) on pocketbyte.io/oauth/grants.
• Testing and content review: each saved game is run automatically in a headless browser on our servers (phone smoke test). When you publish, the game code, title and description are additionally checked by an automated content review that uses an AI model provider (Anthropic). Published games are public like any other PocketByte game.
• What the assistant receives back:tool results (for example a game's title and status, test results, search results or your games list) are returned to the assistant and processed by OpenAI or Anthropic under their own privacy policies.
• No sale, no ads: we do not sell data from these integrations, do not show ads in them, and do not share them with advertising partners (section 5 applies only to the mobile app).
• Retention: anonymous previews and their hashed identifiers 24 hours; games saved to your account are kept like other account content until you delete them or your account (section 11).
• Legal basis: performance of the service you request (Art. 6(1)(b) GDPR) and our legitimate interest in preventing abuse and keeping the service secure (Art. 6(1)(f) GDPR).

8. Music & Audio

You can add audio to gameplay videos from our in-app library. This library uses tracks from third-party sources such as Freesound that are made available under their respective licenses. When you select a track, we store a reference to it and its attribution together with your video. You must not upload or add copyrighted music that you do not have the rights to (for example, commercial tracks from streaming platforms).

9. Our Own YouTube Channels (YouTube API Services)

We use the YouTube API Services provided by Google only to manage our own YouTube channels. For this we use two internal tools. They are used only by our own team, are not offered to the public and do not process any data of PocketByte users or website visitors:

• SMA Publisher: a self-hosted instance of the open-source software Postiz at postiz.whispergames.ai that publishes our own videos to our channels.
• PocketByte Live Battles publishing script: uploads our own trailers and Shorts and schedules our live broadcasts on our Live Battles channels (PocketByte - Team Red and PocketByte - Team Blue).

When one of our channels is connected via Google OAuth, the tool receives the channel ID, channel name and profile picture and the permission to upload videos and set their title, description, privacy status and thumbnail, and it reads basic statistics (e.g. views, likes) of our own uploaded videos. Only the OAuth tokens and this basic channel data are stored, on our server in Germany and on our team's own devices; they are not shared with third parties.

Live chat during Live Battles:during a Live Battle (pocketbyte.io/live) our server reads the public live chat of our own broadcasts through the YouTube API (read-only access) so that viewers can vote by typing short codes such as R1 or B2. For each message we process the message text and the author's YouTube channel ID, only to count one vote per viewer and round and to show the combined result. Votes are kept in memory for the duration of the event; we do not store chat messages or channel IDs after the event, do not link them to a PocketByte account and give no rewards for YouTube interactions such as likes, subscriptions or comments. Legal basis: our legitimate interest in running the interactive event (Art. 6(1)(f) GDPR). Chat messages themselves are published on YouTube under YouTube's terms.

By using the YouTube API Services, the YouTube Terms of Service and the Google Privacy Policy apply. Access can be revoked at any time in the Google security settings. After revocation, or on request to contact@pocketbyte.io, we delete the stored tokens and channel data within 7 days.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. This includes encrypted data transmission, secure database access controls, and regular security reviews.

11. Data Retention

We retain your data for as long as your account is active or as needed to provide services. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law. Published games may be anonymized rather than deleted.

Gameplay videos you publish are stored until you delete them or your account. When you delete a video or your account, the video file and its thumbnail are removed from public access. We may retain copies of reported content and related records for a limited period where necessary to handle reports, prevent abuse, or comply with legal obligations.

12. Your Rights (GDPR)

If you are located in the European Economic Area, you have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict certain processing activities
• Request a portable copy of your data
• Withdraw consent at any time where processing is consent-based

To exercise these rights, contact us at contact@pocketbyte.io.

13. Children's Privacy

The Service is not intended for children under 13. We do not knowingly collect personal data from children under 13. If we learn we have collected such data, we will delete it promptly.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes through the app or via email. Your continued use after changes constitutes acceptance of the updated policy.

15. Contact

If you have any questions about this Privacy Policy, please contact us at: contact@pocketbyte.io or through our contact form.

Contact form and emails: when you write to us, we process your email address, your name if you enter it, the topic, subject and message, the page language and the time of sending, only to answer your request. Contact form messages are stored in our database (Supabase, section 4), and we receive an internal push notification about each new message. To prevent spam, the form uses a hidden field and short-lived in-memory request counters; we do not store your IP address with the message. Legal basis: steps at your request or the performance of our contract with you (Art. 6(1)(b) GDPR) where your message concerns your account or our services, otherwise our legitimate interest in answering enquiries (Art. 6(1)(f) GDPR). We delete contact messages when they are no longer needed, at the latest 12 months after your request has been resolved, unless statutory retention obligations require us to keep them longer.