Serakki Privacy Policy
Last updated: 2026-10-23
Serakki does not use advertising trackers or visitor analytics. Creating an account does not subscribe you to marketing. Optional announcement preferences require a separate choice for game releases, paid DLC or free DLC, not regular newsletters or sales campaigns. Hosted accounts use essential sign-in sessions, and Hub, Game and Studio store the account, license, project, save and settings data needed to provide their functions. Hosted applications do not upload client diagnostic logs or failure snapshots. The desktop Serakki Mini, full game and Studio keep their files and diagnostics locally unless you choose to share them. This policy explains these different uses and your rights.
1. Who is responsible
I am Marek Hanzal, a self-employed individual (sole trader), identification number (IČO) 87911418, with my registered business address at Severní 1175, 363 01 Ostrov, Czechia. You can contact me about privacy at support@serakki.dev or by post at this address.
I am the controller of personal data processed to provide Serakki accounts and hosted applications, handle enquiries and support, protect the Service and meet legal obligations. This policy covers serakki.dev and its hosted Hub, Game and Studio applications, their supporting hosted functions, Serakki Mini, the full desktop Serakki game and its Studio. External hosting, stores and communication platforms have their own responsibilities and privacy notices.
2. Website previews and essential sign-in storage
Serakki has no visitor analytics, advertising trackers, tracking pixels, fingerprinting or session recording. The public presentation pages do not set cookies or store visitor profiles in local storage, session storage or IndexedDB. Fonts and illustrations are served with the website, without external embeds. Account registration and sign-in are provided through Hub, separately from the presentation pages.
Interactive previews run in your browser. Their temporary project and gameplay state stays in memory and is discarded when the page reloads or the preview closes. Your browser may cache ordinary website files; this is not a visitor profile or tracking database maintained by me.
Authenticated use of Hub, Game and Studio uses essential session cookies and technical session information to verify sign-in, protect the account and authorize requests. These are necessary for the account functions you request, not advertising or analytics. Blocking or clearing them can prevent sign-in or end your session. Session expiry and sign-out end access through the affected session; they do not delete the account or its stored content. Necessary technical storage is not treated as consent to optional tracking.
3. Hosting and downloads
The website and hosted application files, including development deployments, are delivered through Bunny Storage and CDN. Bunny processes the technical request information needed to deliver them. CDN request logs are available to me with IP anonymisation enabled; they are used for delivery troubleshooting, not visitor profiling.
Neon hosts the API and PostgreSQL. Better Auth runs in that API; account and session records, Terms acceptance, roles and the association with a Stripe Customer are stored in PostgreSQL. Private projects, Notes, saves, settings and resource objects use account-scoped Bunny Storage with protected delivery. Product and purchase-derived license information is read from Stripe. Bunny and Neon process the network, request and service information needed to deliver and secure these functions, which can include IP addresses and technical client information. IP anonymisation of Bunny CDN logs is not a claim that all providers receive no IP addresses or that all Service data is anonymous.
Hub, Game and Studio associate private account content with its account and authorize access accordingly. Other visitors do not receive access to your private projects or saves merely by registering or knowing a content identifier. I and the providers needed to operate the Service can process that content for the purposes described here. Content you choose to share is available to its intended recipients under the permissions you grant. These hosted functions are separate from the temporary landing-page previews.
Hosted Hub, Game and Studio do not send client diagnostic logs or upload diagnostic failure snapshots, game configurations or save copies for troubleshooting. Ordinary account content, including gameplay saves, is still stored to provide the requested hosted functions. Hosting providers process the technical request information described above; that operational processing is separate from client diagnostic reporting.
Desktop downloads requested through Hub are delivered through Bunny. When your account first requests a desktop download link for a file, the Service records your account identifier, the canonical file URL without its access token, and the request time. This includes Mini. Repeated requests for the same file keep the first record and its original time; they do not create further download-request records.
When you open a Serapack in the browser, the Service also records your account identifier, the canonical address of that Serapack’s Board page, and the time of its first permitted content request. This includes browser play of Mini. The recorded address contains no query parameters or fragment. Repeated requests for the same Board address keep the first record and its original time.
The purpose of these records is to keep evidence relevant to digital supply and any applicable purchase-withdrawal claim. A record shows a request for a download link or permitted browser content; it does not establish that the file was fully downloaded, installed or played, or that a browser game started successfully. It does not replace any separately required consent to immediate supply, acknowledgment of loss of withdrawal rights or contract confirmation. Requesting a free playtest or Mini download or opening its browser game does not, by itself, place a paid order or waive statutory rights.
Bunny Privacy & Data Policy · Neon / Databricks Privacy Notice
4. Accounts, licenses and hosted content
Registration requires an email address you control and your declaration that you are at least 18 years old. Registration does not request your date of birth or identity documents, independently verify your age, or retain a separate age-declaration record. The Service processes an internal account identifier, the email address, verification status, any display information you provide, and authentication and session records. The hosted API sends verification and sign-in messages through Resend. Resend processes the recipient email address and message content, including the expiring six-digit one-time code. Never send sign-in codes or other credentials to support.
Without the email address and verification needed for sign-in, I cannot provide an account or its hosted functions. You can still browse the public website and use a lawfully obtained offline desktop edition without a hosted account.
Account, security and requested support messages are separate from optional release announcements. I may send affected players essential notices about major changes to a Serakki service they already use, including entering or leaving Early Access or the main release when the change affects their access, applicable terms, compatibility or stored data. These notices explain the change and any necessary action; they do not contain sales pitches, discounts or invitations to buy.
I do not send regular newsletters, routine promotional updates, discount campaigns or third-party advertising. In Profile, you can separately choose announcements about major game releases (including entering or leaving Early Access and the main release), paid DLC and free DLC. These are optional commercial communications, even when the announced content is free. All choices start off, including for existing accounts; registering, accepting the Terms or reading this policy does not enrol you. You can turn each category on or off, or change all three together, at any time in Profile. Withdrawal will not affect your account or essential service messages. The account stores only the categories you have enabled and when you enabled them; turning a category off deletes that subscription record. Active choices remain until you withdraw them or the account is deleted, including the playtest reset. Re-registering does not restore former subscriptions. Commercial announcement delivery is not currently active. Before sending starts, each announcement must clearly identify its commercial nature and sender and include a simple, free way to unsubscribe; Profile alone does not replace that in-message mechanism.
Account records include the time you accepted the Terms of Service. License records identify the relevant Serapack or Studio entitlement, its source, status and applicable validity period. If you provide purchase or redemption evidence to resolve an entitlement problem, I process that evidence only as needed to verify the entitlement and handle the request. Creating an account does not, by itself, create a purchase or marketing subscription.
When you acquire a product, including a free claim, the Service prepares a private copy of the applicable contract documents and stores the completed purchase confirmation in Bunny Storage. It identifies your account, Stripe Customer and order, email, product, amounts and the applicable purchase terms. For a paid acquisition, it also includes the immediate-supply checkbox text and our checkout acknowledgment retained in the Stripe order metadata. The Service separately records the paid document's order identifier and integrity hash against your account in PostgreSQL, and the first recorded display of the notice that this original confirmation is available. This is a notice of document availability, not a new agreement, proof of reading or download, or a second consent to immediate supply. The same record applies to browser play and desktop downloads. Free claims do not require this notice record. The original copy is available through your profile and a protected download, independently of your current game licence. This processing supplies your contractual records and evidence needed to handle purchase rights and claims. These records are stored separately from your editable projects and saves. Account closure does not automatically erase records still necessary for legal obligations or claims; their retention and eventual deletion follow section 12. Contact support@serakki.dev for a copy if you cannot access your account.
Game stores saves and gameplay progress under your account. Studio stores your projects, Notes and associated resources. Hub uses account, catalog and license information to present your dashboard and available products. Sound, appearance and other Service settings are associated with the account where they are saved remotely. Projects and saves can contain information you author, including personal data you place in them; avoid including unnecessary sensitive information about yourself or others.
Session and license checks determine technical access to the requested product based on the account and recorded entitlement. If a record or access decision appears incorrect, contact support@serakki.dev for review. A license is not an advertising profile. The Service does not sell your hosted content or use it for advertising.
5. Offline applications and local files
The desktop Serakki Mini, full game and Studio do not automatically send me usage data, gameplay history, diagnostic reports or your files. Local desktop play does not require a Serakki hosted-service account. Saves, settings, authored projects and imported resources are stored locally, not uploaded to the hosted Service merely because you play or author on desktop.
The applications automatically write local technical logs for troubleshooting. A failed game session can also leave a local incident snapshot with game data. These files stay on your device unless you share them. New technical log and incident-text writes apply best-effort filesystem-path masking before storage, for ordinary desktop use. The known application installation and Serakki data directories are replaced with named placeholders, preserving relative suffixes. Other filesystem paths or differently represented paths may remain. Existing files are not rewritten. Local logging is separate from the voluntary Export Diagnostics action described below.
Your operating system, store client or a backup/synchronisation service you use may process local files under its own settings. Optional Studio agent connections are described in section 11.
6. What desktop Export Diagnostics contains
Export Diagnostics in the application menu opens a save dialog and creates a ZIP file at the location you choose. Cancelling creates no archive. Exporting does not upload the ZIP, send an email or notify me. You decide whether to inspect, keep, delete or send it.
The archive contains the following:
- A manifest with the export time, application version, operating-system platform and release, CPU architecture, and display dimensions and scale factor.
- Filtered support logs: timestamps, severity and technical summaries; for installed games and Studio Board sessions, session identifiers, game/package or project versions, gameplay events and performance or failure information needed to reproduce a problem. Session identifiers are not an account or a persistent player identifier.
- The last played game's package identifier, version and content hash, plus its available save slots and backups. Saves contain gameplay progress, state and authored game content.
7. What the standard desktop export leaves out
The standard ZIP does not include game packages or artwork/audio bundles, private Studio project files, detailed application logs, MCP tool logs or the local incident snapshot. It includes the support-log files and last-played game saves described above.
Detailed error bodies are omitted from the support log. Structured support events redact fields designated for email addresses, paths, project identifiers, credentials, tokens and raw errors. Installed-game and Studio Board support logs can still contain authored Item and production Line names and identifiers, gameplay events and state; saves can contain authored game content. Excluding complete Studio project files does not remove this content from the technical evidence. The export is designed for technical troubleshooting, not to collect contact details or sensitive personal data. This filtering is not a guarantee that every possible piece of personal information is removed. An archive may constitute personal data in my support records when associated with its sender.
Review files before sharing them, including authored content in support logs and saves. Detailed local logs can contain raw error details, with best-effort filesystem-path masking in new writes. Older logs and files you attach separately may contain filesystem paths or complete project files that the standard export excludes. Captured game configurations and saves retain their exact replay content and are not text-filtered. Do not send passwords, access tokens or unnecessary personal information.
8. Contact and voluntary support
If you email me, I receive your email address, any name you provide, the message, ordinary email metadata and any attachments you send. Support email sent to support@serakki.dev is received and stored by Resend (Plus Five Five, Inc.), and I read it in Resend's dashboard. Resend processes the message content, attachments and delivery data to provide that service.
If you contact me on Discord, I receive the account name, messages and attachments you choose to share. Messages in public community channels can also be read by other members. Discord processes platform data under its own privacy policy.
Contacting me and sending a desktop diagnostic archive are voluntary. You can browse and play without contacting support or sending that archive. Hosted applications do not automatically submit client diagnostic reports. Without information relevant to a request, I may be unable to investigate it. This policy does not create a support entitlement beyond the license or applicable law.
Resend Privacy Policy · Discord Privacy Policy
9. Purposes and legal grounds
I use account, session and entitlement information to register and verify your account, provide requested access, enforce the applicable licenses and send the limited account and service messages described in section 4. Hosted projects, saves and settings are used to provide their authoring, gameplay and preference functions. Diagnostic archives you voluntarily submit are used to investigate failures and fix defects; necessary operational request information is used to deliver and secure the Service. I use support information only as needed to answer enquiries, investigate problems, handle complaints and privacy requests, or establish, exercise or defend legal claims. I do not sell personal data, use support correspondence for advertising or build advertising profiles from Service use. Use of an email address for optional announcements is limited to the categories you separately choose in section 4.
The download-request records described in section 3 are used only as evidence relevant to digital supply and withdrawal-related claims, not for visitor analytics or marketing.
Under the GDPR, the legal grounds depend on the purpose: performing the Service agreement or taking steps you request before a contract for accounts, requested hosted functions and entitlements (Article 6(1)(b)); legitimate interests in securing the Service, proportionate troubleshooting, responding to enquiries and protecting legal claims (Article 6(1)(f)); and complying with legal obligations, including applicable complaint, accounting and privacy duties (Article 6(1)(c)). I process only the data needed for the relevant purpose. Browsing, registering, accepting the Terms of Service, downloading or sending a message is not treated as blanket consent to personal-data processing. Any optional purpose requiring consent must have its own choice.
The legal ground for optional announcement subscriptions is your separate consent (Article 6(1)(a)), which you may withdraw at any time in Profile without affecting the lawfulness of processing before withdrawal. Subscription records and their deletion are described in section 4. Commercial delivery remains inactive; this notice will identify the relevant delivery provider and any additional delivery records and retention before that processing starts.
10. AI-assisted diagnostic analysis
I may use OpenAI Codex to analyse standard diagnostic archives you voluntarily send me, solely to investigate technical problems and develop fixes. From your support submission, I provide only the diagnostic archive or relevant extracts from it. I do not provide your email or Discord correspondence, contact details, sender identity or other attachments, and I do not add information identifying you to the analysis.
Standard desktop diagnostic archives contain the filtered technical logs, application and system information, and available last-played game saves described above. Their session identifiers identify individual desktop game sessions, not a hosted account or a persistent player profile. The desktop application creates the archive locally; exporting it does not automatically send anything to me or OpenAI. This voluntary support process does not authorize sending your account records, private Studio projects or other hosted account content to OpenAI.
I use a personal OpenAI account with contributions to model improvement enabled. With this setting, OpenAI may also use content processed through the account to improve and train its models under its applicable terms and data controls.
11. Optional agents and external services
The desktop Studio can connect to an agent through MCP if you enable and configure it. A connected client can receive project information, artwork previews and Board screenshots, and use the tools you make available. A remote connection can also involve a tunnel provider. Those connections are your explicit choice; they are not telemetry sent to me. The connected agent and other providers may process the supplied content under their own terms and privacy policies.
Links to Discord, YouTube, Steam, GitHub and other websites open external services. Store purchases and accounts are handled by the store. These providers process information under their own privacy notices when you use their services.
12. Recipients and international processing
Service data is available to me and the providers needed to operate the relevant function: Neon for API hosting and account/session database storage, Bunny for application delivery, private content storage and CDN delivery, Resend for account-email delivery and support-email reception and storage, and Stripe for Customer identity and purchase-derived license information. Information you send for support is available to me and the providers needed to deliver and store that communication, including Resend for email and Discord when you use it. These recipients receive the information needed for their respective functions, not an unrestricted right to use all account content. I may disclose necessary information if required by law or to resolve a legal claim. I do not publish your private hosted projects or submitted diagnostic archive as part of routine support.
Neon is part of Databricks, and its service terms identify international subprocessors, including providers in the United States. Selecting European storage infrastructure does not mean every technical, operational or support process stays within the European Economic Area. Bunny also publishes the subprocessors used for its services. Applicable provider processing terms and safeguards govern those operations; information about the recipients and safeguards relevant to your Service data is available on request.
Neon service terms · Databricks subprocessors · Bunny subprocessors
OpenAI receives the diagnostic content I provide for AI-assisted analysis. Its processing and retention are governed by the terms, privacy policy and data controls applicable to the service and account used. Processing may take place outside the European Economic Area, including in the United States. Further information is available in OpenAI's Europe Privacy Policy linked below.
Resend stores customer data in the United States, including email content, delivery logs and account records. Its European sending region controls email routing and sending, not the location of stored data. Resend's Data Processing Addendum incorporates EU Standard Contractual Clauses for transfers outside the European Economic Area.
Resend data storage and transfer safeguards · Resend Data Processing Addendum
GitHub and Discord describe international processing, including in the United States, and their transfer safeguards in their privacy notices. This does not mean that all data handled by external services stays in the EU.
Any transfer I arrange of personal data outside the European Economic Area must comply with the GDPR, using an applicable adequacy decision or appropriate safeguards. You can contact me for information about the recipients and safeguards applicable to your data, including a copy of relevant safeguards where applicable.
13. How long information is kept
Local application logs rotate within fixed size and file-count limits; an incident snapshot is replaced by a later failed session. Exported ZIPs, saves and projects remain on your device until you remove them or your own storage system does so. I cannot remotely access or delete those files.
Outside the temporary playtest, hosted account records, projects, saves and settings are kept while needed to provide your account and the relevant functions, until you delete the content or close the account, subject to necessary legal retention. License expiry alone does not immediately delete the account or its content and does not promise indefinite storage. Before a planned removal of retained content following loss of access or Service closure, I provide the applicable notice and opportunity to retrieve it under the Terms of Service and law.
Download-request records follow the account-retention rules above and are deleted with the account, including in the playtest reset. Your privacy rights, including any right to earlier erasure, remain available.
The playtest is a temporary test environment. Its accounts and hosted data may be lost, deleted or become unusable during testing, including through breaking updates and test resets. The playtest ends with a hard reset at the transition to Early Access: playtest accounts and their associated hosted data are deleted, as explained in the Playtest Terms. I will announce that reset in advance. No contractual promise of preservation, migration, restoration, export or compatibility between versions applies to playtest data. Re-registering starts a new account without restoring the former account or its data. Necessary legal records, provider backups and privacy rights remain subject to the limited retention rules and applicable law described below.
Session information is kept for the session lifetime and as needed to investigate security problems. Any diagnostic records or failure snapshots retained from earlier hosted reporting are kept only while needed for operational troubleshooting or an active incident; current hosted applications do not upload new client diagnostics. Acceptance, license, complaint and transaction evidence may be kept after account closure where necessary to meet legal obligations or establish, exercise or defend claims, for the applicable statutory retention or limitation period. Data kept for those limited purposes is not used to continue ordinary account activity or marketing. Deleted data can remain in provider backups until their applicable backup lifecycle expires; necessary restoration must respect deletion requests.
For information you send me, retention depends on whether the enquiry or investigation remains open, whether follow-up is needed and whether the information is still necessary to resolve the problem. I delete personal data when it is no longer needed for these purposes. Material needed for a legal obligation or claim may be kept for the applicable statutory retention or limitation period. Where possible, a technical defect record is kept without unnecessary sender information.
I keep submitted diagnostic archives only while analysing the reported issue and, where applicable, developing a fix. Once that work is complete, I delete the archive, whether it results in a bugfix or no change. I do not retain it for later support. OpenAI applies its own applicable retention rules to content processed through its services.
Hosting and communication providers also apply the retention and backup rules relevant to their functions. This does not remove my responsibility to handle requests about data I control. External stores and platforms handle their independent processing under their own notices; requests about that independent processing should be addressed to the relevant provider.
14. Your privacy rights
Where the GDPR applies, you may request access to your personal data, correction, erasure, restriction of processing and portability where its conditions are met. You may object to processing based on legitimate interests on grounds relating to your situation. These rights are subject to the conditions and exceptions in applicable law.
Send requests to support@serakki.dev or my postal address in section 1. I will respond without undue delay, normally within one month; a lawful extension will be explained. I may need proportionate information to confirm your identity. The discretionary nature of game support does not limit my privacy-law obligations.
You can complain to a supervisory authority, including the Czech Office for Personal Data Protection (Úřad pro ochranu osobních údajů), Pplk. Sochora 27, 170 00 Praha 7, Czechia, or the authority in your place of habitual residence, work or the alleged infringement.
Czech Office for Personal Data Protection: complaints
15. Policy updates
This notice describes the website and applications. Changes will be published here with a new update date, and material changes will be brought to your attention through the Service or an appropriate account communication. Changes to processing require an updated notice and, where legally required, a separate choice or consent before the new processing starts. This policy is information about processing, not a request to agree to optional processing.
Privacy contact: support@serakki.dev.