Privacy Policy

1. Who is responsible

The data controller is the operator of TileSmithy, established in Spain (EU). You can reach us about any privacy matter through the contact page or by email at legal@thegeekpixel.com.

2. What data we collect

We collect only what we need to run TileSmithy:

• Account data: your email address, your display name, and a securely hashed password (managed by our authentication system). We never store your password in plain text.
• Your content: the tilesets you save (parameters, seeds and textures) and the text prompts you write to generate AI textures.
• Usage and product events: exports, texture generations, credit usage and your plan — used to operate the service, enforce plan limits and prevent abuse.
• Billing data: handled by our payment processor, Stripe. We store your subscription and credit status and a customer reference, but we never see or store your full card number.
• Technical data: your IP address and basic browser or device information appear in server logs, kept for security and troubleshooting.
• Communications: anything you send us through the contact form or support.

3. Why we use it, and our legal basis

We use your data for the following purposes:

• To provide the service and your account, save your tilesets, run exports and enforce plan limits — on the basis of our contract with you (Art. 6(1)(b) GDPR).
• To process payments, credits and subscriptions — on the basis of our contract with you.
• To keep the service secure and prevent fraud and abuse, including server logs — on the basis of our legitimate interests (Art. 6(1)(f) GDPR).
• To send transactional emails about your account, billing and support — on the basis of our contract with you.
• To meet legal and tax obligations, such as keeping invoicing records — on the basis of a legal obligation (Art. 6(1)(c) GDPR).
• We do not send marketing emails. If we ever introduce them, they will be based on your consent, which you can withdraw at any time.

4. AI texture generation

When you choose to generate a texture, the text prompt you write is sent to a third-party AI image-generation provider that produces the image and returns it to us. We do not send your name or email to that provider, and prompts are used to generate your texture, not to identify you.

5. Who we share data with

We do not sell your data and we do not share it for advertising. We use a small number of trusted service providers (processors) strictly to run TileSmithy:

• Supabase — database, authentication and storage, self-hosted by us on our own European server.
• Stripe — payment processing.
• Resend — delivery of transactional emails.
• Cloudflare (R2) — object storage and content delivery for your saved assets.
• A third-party AI image-generation provider — only to turn your prompts into textures.
• Our hosting is on our own server located in Germany (EU).

6. International transfers

Your account, your tilesets and our database are hosted in the European Union (Germany). Some processors — such as Stripe, Resend and Cloudflare — may process limited data outside the European Economic Area, including in the United States. Where that happens, it is covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses or an adequacy decision.

7. How long we keep data

We keep your account data for as long as your account is active. When you delete your account, we delete your account data and saved tilesets, except where we must keep certain records (for example, billing and invoicing data) for the period required by Spanish tax and accounting law.

Server logs are kept for a short period for security. You can delete individual tilesets at any time from within the app.

8. Your rights

Under the GDPR you have the right to access your data, to rectify it, to erase it, to restrict or object to its processing, to data portability, and to withdraw any consent you have given. To exercise any of these, contact us through the contact page or at legal@thegeekpixel.com — you can also delete your account and its data directly from your settings.

If you believe we have handled your data improperly, you have the right to complain to the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or your local supervisory authority.

9. Security

We protect your data with HTTPS encryption in transit, hashed passwords, access controls, and European hosting. No online service can be perfectly secure, but we take reasonable technical and organisational measures to keep your data safe.

10. Children

TileSmithy is not directed at children under 16, and we do not knowingly collect data from them. If you believe a child has given us personal data, contact us and we will remove it.

11. Changes to this policy

We may update this policy as TileSmithy evolves or the law changes. We will update the "last updated" date above and, for material changes, notify you where appropriate.

12. Contact

For any question about this policy or your data, reach us through the contact page or by email at legal@thegeekpixel.com.