Mansion of Mayhem -- Privacy Policy

1.1 Information You Provide Directly

• Account Information. When you create an account, we collect your email address, chosen display name, and date of birth (to verify you meet our minimum age requirement of 17 years).
• Profile Information. You may upload a profile photo or avatar image that is stored on our servers and displayed to other players.
• FaceCast Photo (optional). If you choose to use the optional FaceCast feature, you provide a photo of your face. This photo is sent to a third-party AI provider to generate your in-game likeness. FaceCast is entirely optional — the Service is fully playable without it, and we ask for your consent before any data is sent to an AI provider (see Section 2.2).
• User-Generated Content. We collect content you create, upload, or share through the Service, including chat messages, in-game communications, alliance discussions, voting decisions, social posts, and voice confessionals (audio recordings).
• Game Creation Content. If you use Mansion Studio to create custom game universes, we collect the game configurations, rules, assets, and narrative content you produce.
• Purchase Information. When you make purchases through Apple In-App Purchase, we receive a transaction record including the product purchased, transaction ID, and purchase date. We do not receive or store your payment card details -- Apple processes all payments directly.
• Support Communications. If you contact us for support, we collect the content of your messages, your email address, and any attachments you provide.

1.2 Information Collected Automatically

• Device Identifiers. We collect your device ID, device model, operating system version, and app version to ensure compatibility and diagnose technical issues.
• User ID. A unique identifier is assigned to your account upon registration and is used internally to associate your activity with your account.
• Usage Data. We collect information about how you interact with the Service, including games joined, game outcomes, voting patterns, playtime, features used, and in-app navigation.
• Log Data. Our servers automatically record information including your IP address, access times, pages and screens viewed, app crashes, and other system activity.
• Local Storage Data. We use local storage on your device (including AsyncStorage and similar technologies) to maintain session state, game preferences, and cached data. This data remains on your device and is not transmitted to our servers unless necessary for Service functionality.

1.3 Information from Third-Party Services

• Apple. When you authenticate or make purchases through Apple, we may receive limited account information and transaction confirmations as permitted by Apple's policies.
• Supabase Authentication. If you sign in using email-based authentication through Supabase, we receive and store your authentication credentials (email and hashed password) and authentication tokens.

We use the information we collect for the following purposes:

2.1 Providing and Operating the Service

• Creating and maintaining your account.
• Enabling multiplayer gameplay, including matchmaking, alliance formation, voting, elimination mechanics, and spectator features across all game universes (Mansion of Mayhem, Survival Island, Mafia Empire, The Manor, Fame Game, Colony One, Iron Throne, The Board, Heart Island, and Open Studio).
• Processing in-app purchases and managing your virtual currency (coin) balance.
• Managing Mansion Studio subscriptions (Free, Studio, and Pro tiers).
• Delivering voice confessionals and chat messages to other players as part of gameplay.

2.2 AI Director Processing and Third-Party AI Transmission

Mansion of Mayhem uses artificial intelligence, powered by Anthropic's Claude AI ("Anthropic"), to operate our AI Director system. The following data is transmitted to Anthropic's servers for processing approximately every 4 hours per active game:

• Your display name as chosen during account creation. Your real name, email address, and other account credentials are never transmitted to Anthropic.
• Chat messages and social posts you submit during gameplay, transmitted verbatim to generate contextual AI responses.
• Voice confessional transcripts (text transcriptions of audio recordings), transmitted for content moderation and narrative generation.
• Voting patterns, including who you vote for and who votes for you.
• Alliance membership and relationship data, including which players you have allied with, communicated with, or are in conflict with.
• Scenario responses, including your answers to in-game prompts and challenges.
• Game state information, including your archetype, status (active, eliminated, spectating), drama score, and strategic positioning.

How this data is used by the AI Director:

• Generate personalized in-game scenarios, twists, and dramatic events that reference your display name and behavior.
• Create narrative provocations targeting specific players or relationships.
• Manipulate alliances and create strategic dilemmas as a core game mechanic.
• Produce personalized push notifications during Drama Hours (10 PM -- 4 AM).
• Generate AI episode recaps that reference player actions and outcomes.
• Moderate voice confessional transcripts for prohibited content.

Anthropic's data handling: Anthropic processes this data through their Claude API. Per Anthropic's API data usage policy, API inputs are not used for model training and are not retained beyond the duration needed to generate a response. Anthropic's privacy policy is available at https://www.anthropic.com/privacy. We do not control Anthropic's data practices beyond our contractual terms.

FaceCast photo: If you use the optional FaceCast feature, the photo you provide is also sent to a third-party AI provider to generate your in-game likeness. FaceCast is optional and the Service is fully playable without it.

Your consent: Before any of your data is sent to a third-party AI provider, the app presents an in-app disclosure identifying what data is sent and to whom (Anthropic), and asks for your explicit consent. Because the AI Director is a core game mechanic, consent is required to play — if you decline, no data is sent and you will not be able to use the Service. You can delete your account and data at any time in Settings.

Important: The AI Director processes your messages and behavior within the context of gameplay. The AI does not make decisions about your access to the Service, your account standing, or any matter outside of in-game events. AI-generated content is clearly attributed as coming from the AI Director within the game interface.

2.3 Safety and Content Moderation

• Detecting and blocking prohibited content, including slurs, threats, doxxing, and other violations of our Terms of Service.
• Enforcing community standards and investigating reports of misconduct.
• Preventing fraud, cheating, and abuse of the Service.

2.4 Improvement and Analytics

• Analyzing usage patterns to improve game balance, features, and user experience.
• Diagnosing and fixing technical issues, crashes, and bugs.
• Developing new features, game universes, and Service improvements.

2.5 Communications

• Sending transactional notifications related to your account, purchases, and gameplay (e.g., game invitations, elimination notices, subscription renewals).
• Sending promotional communications about new features or game universes, if you have opted in. You may opt out at any time.

We do not sell your personal information. We share your information only in the following circumstances:

3.1 With Other Players

• Your display name, avatar, and in-game actions (chat messages, votes, alliance memberships, game outcomes) are visible to other players within the games you join. This is an inherent part of the multiplayer gameplay experience.
• Voice confessionals are shared with other players as part of the game mechanics.

3.2 With Service Providers

We use the following third-party service providers to operate the Service:

• Supabase, Inc. -- Provides database hosting, user authentication, real-time data synchronization, and file storage. Supabase processes your account data, user-generated content, and game state data. Supabase's privacy policy is available at https://supabase.com/privacy.
• Apple Inc. -- Processes all in-app purchases, including coin purchases and Mansion Studio subscriptions. Apple collects payment and transaction data subject to Apple's own privacy policy, available at https://www.apple.com/privacy.
• Anthropic, PBC -- Provides the Claude AI models that power the AI Director. The following data is transmitted to Anthropic for processing: player display names, chat messages (verbatim), voice confessional transcripts, voting patterns, alliance membership, scenario responses, and game state data. Anthropic's data usage policies prohibit using API inputs for model training. Anthropic does not retain API inputs beyond the duration needed to generate a response. Anthropic's privacy policy is available at https://www.anthropic.com/privacy.

3.3 For Legal Reasons

We may disclose your information if required to do so by law, in response to a valid legal process (such as a subpoena, court order, or government request), or when we believe in good faith that disclosure is necessary to:

• Comply with applicable law or legal obligation.
• Protect the rights, property, or safety of ImmersiVerse OS, our users, or the public.
• Detect, prevent, or address fraud, security, or technical issues.
• Enforce our Terms of Service.

3.4 Business Transfers

If ImmersiVerse OS is involved in a merger, acquisition, bankruptcy, dissolution, reorganization, or similar transaction, your information may be transferred as part of that transaction. We will notify you of any such change in ownership or control of your personal information.

We retain your personal information for as long as your account remains active or as needed to provide you the Service. Specific retention periods are as follows:

• Account Data (email, display name, user ID): Retained for the duration of your account and for 30 days following account deletion to allow for account recovery.
• User-Generated Content (chat messages, voice confessionals, social posts): Retained for the duration of the game in which they were created. Chat logs from completed games are retained for up to 90 days for moderation and dispute resolution purposes, then deleted.
• Voice Confessionals (Audio): Retained for the duration of the game and up to 30 days following game completion, then deleted.
• Purchase History: Retained for as long as your account is active and for 3 years following account deletion, as required for financial record-keeping and dispute resolution.
• Usage and Analytics Data: Retained in aggregated, de-identified form indefinitely. Identifiable usage data is retained for up to 12 months.
• AI Processing Data: Messages sent to the AI Director are processed in real time. Anthropic does not retain API inputs beyond the duration necessary to provide the response, in accordance with their data retention policies.
• Device and Log Data: Retained for up to 12 months.

When your data is no longer needed, we delete or de-identify it. De-identified data that cannot reasonably be used to identify you may be retained and used indefinitely for analytical purposes.

We implement industry-standard technical and organizational measures to protect your personal information, including:

• Encryption of data in transit using TLS 1.2 or higher.
• Encryption of sensitive data at rest.
• Row-level security (RLS) policies in our database to ensure users can only access data they are authorized to view.
• Secure authentication with hashed passwords (never stored in plaintext).
• Regular security audits and vulnerability assessments.
• Access controls limiting employee access to personal data on a need-to-know basis.

No method of transmission or storage is 100% secure. While we strive to protect your personal information, we cannot guarantee its absolute security. If we become aware of a data breach that affects your personal information, we will notify you in accordance with applicable law.

Mansion of Mayhem is rated 17+ and is not intended for use by anyone under the age of 17. We do not knowingly collect personal information from individuals under 17 years of age.

Age Verification. We require users to confirm their date of birth during account creation. Users who indicate they are under 17 are blocked from creating an account.

If we learn that we have collected personal information from a user under the age of 17, we will take steps to delete that information as quickly as possible. If you are a parent or guardian and believe your child under 17 has provided us with personal information, please contact us at legal@immersiverseos.com and we will promptly delete the information.

Depending on your jurisdiction, you may have the following rights regarding your personal information:

7.1 Access

You have the right to request a copy of the personal information we hold about you. You can access most of your account data directly through the app settings.

7.2 Correction

You have the right to request correction of inaccurate personal information. You can update your display name and avatar directly through the app.

7.3 Deletion

You have the right to request deletion of your account and associated personal information. You can initiate account deletion through the app settings, or by contacting us at legal@immersiverseos.com. Upon receiving a valid deletion request:

• Your account will be deactivated immediately.
• Your personal data will be deleted within 30 days, except for data we are required to retain for legal or financial record-keeping purposes (see Section 4).
• Content you shared in multiplayer games (chat messages visible to other players) may persist in other players' game history in de-identified form.

7.4 Data Portability

You have the right to request your personal data in a structured, commonly used, and machine-readable format. Contact us at legal@immersiverseos.com to submit a portability request.

7.5 Opt-Out of Marketing

You can opt out of promotional communications at any time by using the unsubscribe link in any marketing email or by adjusting your notification preferences in the app settings. Opting out of marketing communications does not affect transactional notifications related to your account or gameplay.

7.6 Restriction of Processing

Where applicable by law, you have the right to request that we restrict processing of your personal information under certain circumstances.

7.7 Exercising Your Rights

To exercise any of these rights, contact us at legal@immersiverseos.com. We will respond to your request within 30 days (or such shorter period as required by applicable law). We may ask you to verify your identity before fulfilling your request.

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with additional rights:

• Right to Know: You have the right to know what personal information we collect, use, disclose, and sell.
• Right to Delete: You have the right to request deletion of your personal information, subject to certain exceptions.
• Right to Correct: You have the right to request correction of inaccurate personal information.
• Right to Opt-Out of Sale/Sharing: We do not sell your personal information. We do not share your personal information for cross-context behavioral advertising purposes.
• Right to Non-Discrimination: We will not discriminate against you for exercising your privacy rights.

Categories of Personal Information Collected: Identifiers (email, user ID, device ID), internet activity (usage data, game interactions), audio information (voice confessionals), commercial information (purchase history), and profile information (avatar photos).

Business Purpose for Collection: Providing the Service, processing transactions, AI Director gameplay processing, content moderation, analytics, and communications as described in Section 2.

To submit a CCPA request, contact us at legal@immersiverseos.com or through the in-app privacy settings.

If you are located in the European Economic Area (EEA), the United Kingdom (UK), or Switzerland, the following additional provisions apply:

9.1 Legal Bases for Processing

We process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

• Performance of a Contract: Processing necessary to provide the Service you have requested (account creation, gameplay, purchases, AI Director functionality).
• Legitimate Interests: Processing for analytics, Service improvement, fraud prevention, and security, where our interests do not override your fundamental rights.
• Consent: Where we rely on your consent (e.g., marketing communications), you may withdraw consent at any time.
• Legal Obligation: Processing necessary to comply with legal requirements.

9.2 International Data Transfers

Your personal data may be transferred to and processed in the United States, where our service providers (Supabase, Anthropic) are located. We ensure appropriate safeguards for such transfers, including Standard Contractual Clauses approved by the European Commission.

9.3 Supervisory Authority

You have the right to lodge a complaint with your local data protection supervisory authority if you believe your personal data has been processed in violation of applicable law.

9.4 Data Protection Officer

For GDPR-related inquiries, contact us at legal@immersiverseos.com with the subject line "GDPR Inquiry."

Mansion of Mayhem is a mobile application and does not use browser cookies. However, we use the following local storage technologies:

• AsyncStorage / Local Storage: We store session tokens, user preferences, cached game state, and current game identifiers locally on your device. This data is necessary for the Service to function properly and is not shared with third parties.
• Authentication Tokens: Secure tokens are stored locally to maintain your logged-in session. These tokens expire and are refreshed periodically.

If you access any Mansion of Mayhem web properties (such as our marketing website), those properties may use cookies. Any such use will be disclosed in a separate cookie notice on those web properties.

The Service may contain links to third-party websites or services that are not operated by us. We are not responsible for the privacy practices of any third-party websites or services. We encourage you to read the privacy policies of any third-party services you visit.

We may update this Privacy Policy from time to time. When we make material changes, we will:

• Update the "Last Updated" date at the top of this Privacy Policy.
• Notify you through the app via an in-app notification or push notification.
• For material changes that affect how we process your data, we will provide at least 30 days' notice before the changes take effect.

Your continued use of the Service after the effective date of any updated Privacy Policy constitutes your acceptance of the updated terms. If you do not agree with the updated Privacy Policy, you must stop using the Service and delete your account.

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

ImmersiVerse OS Email: legal@immersiverseos.com

For data deletion requests, please include your registered email address and user display name so we can locate your account.

For GDPR-related inquiries, please include "GDPR Inquiry" in the subject line.

We will respond to all inquiries within 30 days.

Copyright 2026 ImmersiVerse OS. All rights reserved.