Privacy
Policy

Article 01

1. Who this policy covers

Jovian Labs, Inc. operates Pact Breaker and is the controller of personal information handled for the purposes described in this Policy. "Jovian Labs," "we," "us," and "our" refer to Jovian Labs, Inc.

This Policy applies when you visit Pact Breaker, create or use an account, open or join a table, send press, use an AI diplomat, buy or spend Pact Breaker credits, or contact us.

For a privacy question or request, email team@pactbreaker.com.

Article 02

2. Information we handle

Account and authentication

Pact Breaker's application storage keeps your Clerk account identifier and public username. Clerk processes the authentication information needed to sign you in, which may include an email address, password credential, recovery information, and Google sign-in data.

Pact Breaker's application storage does not keep your password or email address. Those authentication details are handled by Clerk and, if you choose it, Google sign-in.

Tables and play

We keep table names and codes, seats, powers, ownership, readiness, orders, press, phase timing, game state and history, results, your active and completed game library, and the changes needed to restore a table after a restart. For all new Solo, Invite, Public, and Room games, human powers are assigned randomly only when the game begins.

For public matchmaking, we keep membership, readiness, random power assignments, the owner role, and the current boot-vote count. Public matchmaking listings do not include player usernames. Before a game begins, a joined public roster may show public usernames, readiness, and the owner role but not powers; afterward it may also show assigned powers.

Before a Room game begins, each Room link identifies a stable player slot, Player 1 through Player 7, rather than a country. After the game begins, the roster may show the power randomly assigned to each player slot.

Future-match blocks are private matchmaking state. Block lists are private to the person who created them. A block does not change a table or press history the two players already share.

Orders remain private until a phase resolves. Press is available to its intended participants. A shared board does not receive private seat orders.

Invitation drafts

When a private-table owner chooses an invitation action, Pact Breaker combines the table code and join URL together with your public username in your browser. Pact Breaker does not collect a recipient email address or phone number, and does not send invitations or track whether they are opened or delivered.

Your mail, messaging, or share app processes the draft under its own terms and privacy practices. The related browser capabilities run only when you choose the corresponding invitation action.

AI configuration and output

If you save a personal OpenAI API key, Pact Breaker stores it encrypted and returns only a masked form to the browser. We also process the chosen model and effort settings, how each game pays for AI diplomats, AI context, AI messages and orders, model responses, usage measurements, failures, and calculated cost.

When Pact Breaker credits pay for AI diplomats, Pact Breaker sends requests through Jovian Labs' OpenAI account. That account's API key is never sent to your browser. Your own OpenAI key remains optional.

Payments and Pact Breaker credits

We keep Stripe Checkout Session, customer, payment, and event references; the selected pack; Account and game credit ledger entries; purchase status; billing restrictions; disputes, reversals, and refunds; and available tax status. Stripe collects and processes the billing and payment details used at Checkout.

Pact Breaker does not receive or store full card numbers or card security codes.

Requests, security, and browser storage

When you connect, our server necessarily receives essential request information such as an IP address, request time, route, browser or device headers, and connection status. We use short-lived IP counters to enforce creation and connection limits and reduce abuse.

Pact Breaker uses browser local and session storage for functional information such as interface preferences, in-progress order drafts, pending navigation, table and seat references, and seat tokens. Clerk may use its own cookies or browser storage to maintain authentication.

Article 03

3. Why we use information

We use information only for defined purposes and under the legal ground that applies where you live:

Deliver the contract

To authenticate you, open and restore tables, adjudicate orders, deliver press, preserve shared history, manage your library, and provide account controls.

Provide optional AI

To send relevant game context to the chosen AI provider, receive diplomat actions, measure usage, and apply your OpenAI-key limit or Pact Breaker credit charge.

Process payments

To open Stripe Checkout, verify signed payment events, credit the correct pack once, maintain the ledger, calculate tax status, and handle disputes or reversals.

Protect the Service

To authenticate requests, enforce access and purchase limits, prevent fraud and abuse, investigate security events, and protect players and infrastructure. These are our legitimate interests and, in some places, legal duties.

Keep Pact Breaker reliable

To save game state, diagnose failures, restore service, maintain backups, and understand aggregate operational cost. We do not currently use product-analytics trackers.

Meet legal obligations

To maintain required accounting records, respond to lawful requests, establish or defend legal claims, and comply with tax, payment, consumer, and privacy law.

Use consent where required

Where law requires consent for a particular activity, we rely on that consent and provide the choices required by law. You may withdraw consent for future processing, subject to contractual and legal limits.

Article 04

4. AI-enabled games and OpenAI

AI is optional. When AI diplomats are enabled, Pact Breaker sends OpenAI the game information the diplomat needs to play its power. This can include the board state, orders, prior game history, character instructions, and press available to that power, including private messages addressed to it.

OpenAI states that data submitted through its API is not used to train its models by default. API content may still be retained for abuse monitoring or under the platform controls that apply to the account, endpoint, and feature. Those controls can change; read OpenAI's current API data controls for the current details.

If a game uses your personal OpenAI key, the call is made under the OpenAI account associated with that key. If it uses Pact Breaker credits, the call is made through a Jovian Labs OpenAI project. In either mode, do not send information in press that you do not want the intended players and, when AI is involved, OpenAI to process.

Article 05

5. Service providers and where information goes

We use service providers to run Pact Breaker. They process information under their own terms and privacy notices:

• Clerk provides authentication and account access. Read Clerk's Privacy Policy.
• Stripe provides Checkout, payment processing, fraud tools, billing references, and tax features. Read Stripe's Privacy Policy.
• OpenAI provides the models used by optional AI diplomats. Read OpenAI's Privacy Policy and its API data controls.
• Render hosts Pact Breaker's server and persistent application storage. Read Render's Privacy Policy.
• Google processes information if you choose Google sign-in. Pact Breaker also requests its display fonts from Google Fonts, which means Google receives ordinary web-request information such as your IP address and browser headers. Read Google's Privacy Policy.

We may also disclose information when required by law, to protect rights or safety, to investigate abuse or fraud, or as part of a corporate transaction subject to appropriate safeguards and applicable law.

Article 06

6. No advertising, sale, or product tracking

Pact Breaker currently has no advertising and does not sell personal information. We do not share personal information for cross-context behavioural advertising, and we do not use product-analytics trackers or session-replay tools.

Essential authentication, payment, font, security, and hosting requests are not advertising. The providers listed above may receive the information needed to perform those functions and apply their own published practices.

Article 07

7. How long information remains

We retain information only as long as reasonably needed for the purposes described here, subject to these specific product rules:

• Profiles and personal keys. Your profile remains until account deletion. An encrypted personal OpenAI key remains until you remove it or delete your account.
• Shared game records. A game may remain while another participant retains it. After your account is deleted, your displayed identity is removed and your former powers are marked as belonging to a deleted player.
• Credit and payment records. Immutable ledger entries and necessary payment references may remain after account deletion for accounting, tax, fraud prevention, dispute handling, and other legal obligations.
• Browser data. Local and session storage remains until its programmed expiry, relevant sign-out or leave behaviour, or you clear browser data. Some seat references intentionally survive a reload so you can return to a table.
• Security counters and operational data. Rate-limit counters are short-lived. Server records and backups are kept only as reasonably needed to operate, secure, restore, or investigate the Service.
• Provider records. Clerk, Stripe, OpenAI, Render, and Google apply the retention periods described in their own current policies and service controls.

Article 08

8. Safeguards

We use safeguards appropriate to the information and the size of the Service. These include authenticated access, authorization checks by account and table role, encrypted storage for saved personal OpenAI keys, limited public file serving, signed webhook verification, retry-safe credit ledger entries, rate limits, and restricted access to service credentials.

No online service is perfectly secure. You should protect your authentication account, keep personal API keys private, use seat links only with intended players, and tell us if you believe information or access has been compromised.

Article 09

9. International processing

Jovian Labs is based in Canada, and Pact Breaker is reachable internationally. We and the providers listed above may process information in Canada, the United States, and other countries where they operate. Those countries may have privacy laws that differ from the law where you live, and information may be available to courts, law enforcement, or regulators under local law.

Where required, we rely on contractual, organizational, and technical safeguards for international transfers. Contact us if you want more information about the safeguards relevant to your information.

Article 10

10. Your privacy rights and choices

Depending on where you live, you may have rights to ask whether we process your personal information; access it; correct it; delete it; receive a portable copy; restrict or object to processing; or withdraw consent for future processing. You may also have the right to complain to a privacy or data-protection regulator.

To make a request, email team@pactbreaker.com. Describe the right you want to exercise and the Pact Breaker username involved. We may need to verify that you control the relevant account before responding. We will respond within the time required by applicable law.

Some requests are limited by other people's rights, shared game records, security needs, legal claims, and accounting, tax, fraud, or payment-record obligations. We will explain any material limit that applies.

You may also complain to the regulator where you live. In Canada, information about federal privacy rights and complaints is available from the Office of the Privacy Commissioner of Canada.

Article 11

11. Account deletion and shared records

You can request account deletion from Pact Breaker's Account controls. Deletion removes your profile, saved personal OpenAI key, game library, and access to shared game history. It also forfeits unused Account credits and credits held in games without refund.

Deletion does not erase a game another participant retains. Pact Breaker removes your displayed identity from that shared record and labels your former powers as a deleted player. Necessary immutable credit and payment records may also remain for the reasons described above.

Deleting Pact Breaker does not automatically delete information held independently by Clerk, Stripe, OpenAI, Google, or another provider. You may need to use that provider's account or privacy controls for a separate request.

Article 12

12. Adults only

Pact Breaker is for people who have reached the age of majority where they live. We do not knowingly offer the Service to children and do not collect a date of birth to verify age.

If you believe a child has used Pact Breaker contrary to this rule, contact us so we can review and take appropriate action.

Article 13

13. Changes and contact

We may update this Policy when Pact Breaker's features, providers, or legal obligations change. Material revisions will receive a new effective date, and we will provide any notice required by law.

For privacy questions, requests, or concerns, email team@pactbreaker.com. Jovian Labs, Inc. is responsible for responding.