// PRIVACY
PRIVACY
Last updated: July 8, 2026
1. Who we are
Glitchcraft Arena ("Glitchcraft", "we", "us") is operated by Lost Poets. This Privacy Policy explains what personal information we collect from writers, readers, subscribers, and visitors of glitchcraft.xyz and related sites, how we use and share it, and your rights. This page is maintained by us, not an independent auditor. Contact: privacy@glitchcraft.xyz.
2. Information we collect
Account data: email, display name/handle, avatar, password hash, role (writer/reader/moderator/admin), preferences, and email-verification status. Submissions and creative content: stories, PDF manuscripts, cover images, titles, synopses, drafts, and metadata (word count, arena, round). Feedback and reader activity: ratings, written feedback, read receipts, time-on-page signals, and reader assignments. Payment data: Stripe customer/account IDs, payment status, payout status, and Stripe Connect verification metadata. We do not receive or store full card numbers or bank-account numbers; Stripe handles those directly. Tax data: information required to issue tax forms (e.g., name, address, taxpayer ID collected via Stripe). Communications: emails you send us, support tickets, and newsletter subscription state. Device and usage data: IP address, browser and device type, referring page, pages viewed, actions taken, and rough geolocation derived from IP. Cookies and similar technologies: see the Cookies section.
3. How we use your information
We use personal information to: (a) create and secure your account; (b) operate arenas, route reader assignments, compute round scores and cuts, and determine winners; (c) run AI-assisted grading and plagiarism/quality checks on submissions and feedback; (d) process entry fees, prize-pool payouts, refunds, chargebacks, and tax reporting via Stripe; (e) send transactional emails (assignments, results, payouts, security alerts) and — with your consent where required — marketing and newsletter emails; (f) prevent, detect, and investigate fraud, abuse, and violations of our Terms; (g) improve the platform and analyze aggregate usage; (h) comply with legal obligations.
4. Legal bases (EEA/UK users)
Where GDPR/UK GDPR applies, we rely on: (a) performance of a contract — to operate your account, submissions, arenas, and payouts; (b) legitimate interests — to secure the service, prevent fraud, improve features, and communicate about your activity; (c) consent — for optional marketing emails and non-essential cookies (you may withdraw consent at any time); (d) legal obligation — for tax, accounting, and lawful requests.
5. How we share information
We share personal information with: • Other users — your handle, avatar, public profile, published submissions, and finalist/winning entries are visible to other users and the public as inherent to the service. Readers see the submissions they are assigned. Writers see anonymized feedback and scores from readers. • Service providers (subprocessors) — see the Subprocessors section. • Legal and safety — to comply with law, respond to lawful requests, enforce our Terms, and protect the rights, safety, or property of Glitchcraft, users, or the public. • Business transfers — in a merger, acquisition, financing, or sale of assets, with contractual protections for your data. We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising as those terms are defined by California law.
6. Subprocessors
We currently use: Supabase (hosted database, authentication, file storage); Stripe, Inc. (payments, Stripe Connect payouts, tax-form collection); our transactional email provider (delivery of platform emails); Lovable AI Gateway and its underlying model providers such as OpenAI-class LLMs (AI scoring, plagiarism checks, feedback analysis); and analytics tooling for aggregate usage measurement. Each processes only what is needed for its function under a data-processing agreement.
7. International data transfers
Glitchcraft is operated from the United States. If you access the platform from outside the US, your data will be transferred to and processed in the US and other countries where our subprocessors operate. Where required, we rely on transfer mechanisms such as the EU Standard Contractual Clauses and equivalent safeguards.
8. Data retention
We keep account, submission, and feedback records while your account is active and for up to 24 months after account closure, to support accounting, safety, and dispute resolution. Payment and payout records are retained for at least 7 years to satisfy tax and financial-record obligations. Server logs are retained for up to 90 days. Backups are cycled on a rolling basis. Published winning entries, aggregated leaderboard data, and anonymized statistics may be retained indefinitely.
9. Your rights
Depending on where you live, you may have rights to: (a) access the personal information we hold about you; (b) correct inaccurate information; (c) delete your account and associated personal information; (d) receive a portable copy of your data; (e) object to or restrict certain processing; (f) withdraw consent for consent-based processing; (g) lodge a complaint with your local data-protection authority. California residents (CCPA/CPRA) additionally have the right to know the categories and specific pieces of information collected, sources, purposes, and recipients; the right to delete; the right to correct; the right to limit use of sensitive personal information; and the right to non-discrimination for exercising these rights. To exercise any right, email privacy@glitchcraft.xyz from your account address. We will respond within 30 days (or as required by law). Deletion does not retract already-published winning entries, aggregate leaderboard data, or records we are legally required to keep.
10. Cookies and tracking
We use first-party cookies for sign-in sessions, security (CSRF), and preferences, plus a small number of analytics cookies to measure aggregate usage. We do not use third-party advertising cookies or cross-site tracking. You can control cookies in your browser; blocking essential cookies will break sign-in. We honor Global Privacy Control (GPC) signals as an opt-out request for non-essential tracking.
11. Security
Data is encrypted in transit (TLS) and at rest by our backend providers. Manuscripts and PDFs are served via short-lived signed URLs scoped to the requesting user. Access to production data is restricted and role-based. We use row-level security on every user-facing database table. No system is perfectly secure; report suspected vulnerabilities to security@glitchcraft.xyz.
12. AI processing of Your Content
To score submissions and analyze feedback, we send excerpts of Your Content to AI model providers via our AI gateway. We instruct providers not to use your content to train their general models and we do not permit such training use. Model outputs (scores, plagiarism signals, structured feedback) are stored with your submission record.
13. Marketing emails
You will receive transactional emails necessary to run your account and arenas. Marketing emails (Glitchcraft news, arena announcements, founder newsletters) are sent only where permitted, and you can unsubscribe from any marketing email via the link in the email or in your account settings.
14. Children
The platform is for users 18 and older. We do not knowingly collect personal information from anyone under 18. If we learn that we have collected such information, we will delete it. Parents or guardians may contact privacy@glitchcraft.xyz.
15. Do Not Track
Our platform does not respond to browser "Do Not Track" signals as there is no common standard for compliance. We do honor Global Privacy Control (GPC) as described above.
16. Changes to this policy
We may update this policy. Material changes will be announced in-app and by email at least 14 days before they take effect. The "Last updated" date at the top always reflects the current version.
17. Contact
Privacy: privacy@glitchcraft.xyz · Security: security@glitchcraft.xyz · Legal: legal@glitchcraft.xyz · Copyright: dmca@glitchcraft.xyz.