Privacy Policy
Last updated: 25 October 2026
In short: we collect only what we need to run your account and your projects. We don't sell or share your personal information, we don't show ads, and we don't use analytics or tracking cookies.
This policy explains how Chezalab ("we", "us") handles personal information when you visit chezalab.store or use our services. If you have questions, email support@chezalab.store.
What we collect
| Information | When | Why |
|---|---|---|
| Email address | When you sign up or request a sign-in link | To create your account, sign you in, and send early-access updates about your account |
| First name (optional) | If you add it in your dashboard | To greet you by name |
| Password (optional) | If you set one | To let you sign in without an email link. We store only a one-way scrypt hash, never the password itself |
| Projects you create | When you create a project | To save your game ideas (name, starting template and description) and, later, build them for you |
| Messages you send us | When you use the contact or support form | Your name, email, topic and message, so we can reply and help you |
| Opt-out requests | When you use the Do Not Sell or Share form | Your email and the date, so we can keep honouring your choice |
| Account activity | Automatically | Dates you signed up, confirmed your email and last signed in, and which sign-up form you used, so we can run and improve the service |
| IP address and basic request data | Automatically, on each request | To deliver the site, stop abuse (for example, limiting repeated sign-in attempts) and keep the service secure |
We don't collect payment details, precise location, contacts, or any special-category (sensitive) information.
Legal bases (EU, UK and similar laws)
- Contract: to provide your account and projects.
- Legitimate interests: to secure the service, prevent abuse and keep backups.
- Consent: for optional details such as your first name, which you can change at any time.
Who processes your information
We use a small number of service providers who process data on our behalf, under contracts that limit their use of it:
| Provider | What for | Location |
|---|---|---|
| Amazon Web Services | Accounts, projects and the sign-in service | United States (N. Virginia) |
| Cloudflare | Website delivery, DNS and security; bot protection on forms (Turnstile); backup storage | Global network; backups in Western Europe |
| Zoho | Sending sign-in and account emails | Zoho's data centres for our account |
Where information moves between countries, these providers use recognised safeguards such as Standard Contractual Clauses.
We don't sell or share your personal information for advertising or any other purpose. See Do Not Sell or Share My Personal Information.
How long we keep it
- Account and projects: until you delete them or ask us to delete your account.
- Sign-in links: 15 minutes, and they work only once.
- Sessions: up to 30 days, or until you sign out.
- Contact and support messages: 12 months, then deleted automatically.
- Opt-out requests: for as long as we operate, so we can keep honouring them.
- Abuse-prevention counters (which include your IP address): about an hour.
- Service logs: up to 30 days.
- Backups: daily copies are kept for 35 days and monthly copies for up to 13 months. After you delete your account, your data disappears from backups as they expire.
Cookies
We use two cookies, both connected to signing in, and no analytics or advertising cookies. See the Cookie Policy.
Your rights
Depending on where you live, including under the EU and UK GDPR, Kenya's Data Protection Act 2019 and California's CCPA/CPRA, you may have the right to:
- access the personal information we hold about you, and get a copy in a portable format;
- correct it;
- delete it, including deleting your account;
- object to or restrict certain processing;
- opt out of the sale or sharing of personal information (we don't do either);
- not be treated differently for exercising these rights.
To make a request, contact support and choose "Privacy or data request", or email support@chezalab.store from the address on your account. To opt out of sale or sharing, use the opt-out form. We'll respond within 30 days. You can also complain to your local data-protection authority.
Bot protection
Our sign-up, contact, support and opt-out forms use Cloudflare Turnstile to block automated abuse. When you interact with one of these forms, Turnstile checks signals from your browser (such as how the page is being used) to tell people from bots. It loads only on pages with forms, isn't used for advertising, and doesn't set tracking cookies.
Security
All traffic is encrypted with HTTPS. Sign-in links and session identifiers are stored only as one-way hashes, passwords are hashed with scrypt, and access to our systems is restricted. No system is perfectly secure; if you find a vulnerability, please see our Security page.
Children
Chezalab is not directed at children. You must be at least 16 years old to create an account. If you believe a child has given us personal information, contact us and we'll delete it.
Changes
If we change this policy, we'll update the date above. For significant changes, we'll also let account holders know by email.
Contact
Chezalab · support@chezalab.store