Privacy notice

Version 1.4, 21 September 2026. This notice explains how personal data is processed when you use dev.pinionfall.com (the “site”) and buy a Pinionfall Engine licence, and what the free game at pinionfall.com does and does not do with your data. It is written to meet the Swiss Federal Act on Data Protection (FADP) and, where they apply to us because we offer the licence to people in the European Union, the EEA or the United Kingdom, the EU General Data Protection Regulation (GDPR) and the UK GDPR.

1. Who is responsible

The controller is the operator of Pinionfall, a sole proprietor established in Switzerland, reachable at support@pinionfall.com. The controller’s name and postal address are given in the imprint. For any privacy question or request, write to support@pinionfall.com.

2. What we collect and why

We collect only what we need to sell and deliver the licence, keep the evidence the law and disputes require, and run the site securely. We do not use analytics, advertising or tracking tools.

Account data: when you sign in with GitHub through our sign-in provider: the sign-in provider’s user id for you, your GitHub numeric user id and login, and the email address associated with your account. Purpose: to identify you, bind the licence to your GitHub account and contact you. Legal basis: performance of the contract and steps before it.

Licence and order data: the name of the licensed entity, the licence key, the licence version, the licence status, the amount and currency paid, the payment provider’s identifiers for the customer, payment and charge (never card data), the receipt link, and the dates of purchase and of the confirmation email. We also record the country you choose before checkout and the billing country reported by the payment provider (the country only, not the address). Purpose: to conclude and perform the contract, keep the licence registry, handle transfers, and meet accounting obligations. The countries are used to sell only where the merchant of record handles the taxes on the sale, and to decline and refund a purchase from elsewhere. Legal basis: contract; legal obligation for accounting records.

Consent and evidence record: the confirmations you give before payment (acceptance of the licence and terms of sale, request for immediate delivery and acknowledgement of the loss of the right of withdrawal, confirmation of evaluation), with the time, the licence version and a fingerprint of its text, your IP address and your browser’s user-agent string. Purpose: to record conclusion of the contract and the consents relevant to withdrawal, and to establish, exercise or defend legal claims, including refund claims and payment disputes. Legal basis: contract; legal obligation where consumer law requires this confirmation; our legitimate interests in evidence and in preventing fraud.

Delivery data: the state of the invitations to the repositories (pending, invited, active, removed), their dates, and error information. Purpose: to deliver access, resend invitations, revoke access where the licence ends, and prove delivery. Legal basis: contract; our legitimate interests in evidence.

Attribution word: a single word (src, for example menu) recording which link led you to the purchase page. It is not linked to any tracking. Purpose: to know which of our own links are used. Legal basis: legitimate interests.

Audit log: a record of actions on your licence and account (for example purchase, invitation, refund, dispute, revocation, transfer), including who or what performed them. Purpose: security, correctness of the licence registry, and evidence. Legal basis: legitimate interests; legal obligation where applicable.

Technical and security data: request logs from our hosting provider (IP address, time, requested page, browser information, status), the session data of our sign-in provider, and short-lived rate-limiting counters. Purpose: to operate, secure and debug the site, and to prevent abuse. Legal basis: legitimate interests.

Correspondence: what you send us by email, and our replies. Purpose: to answer you and handle your request, including investigating and resolving security reports. Legal basis: contract or legitimate interests.

Withdrawal statements: your name, purchase reference or identifying details, chosen acknowledgement email, statement, submission time and receipt reference, together with acknowledgement/provider status and our review notes. We notify the person handling the request and send your acknowledgement through our transactional email provider. The form does not require an account or a reason. Rate counters use keyed hashes of your email and connection address, rather than storing those raw values in the counter. Purpose: to receive and acknowledge withdrawal, review and fulfil the applicable remedy, and keep evidence of the statement and our response. Legal basis: legal obligation where consumer law applies; contract and our legitimate interests in handling requests, preventing abuse and establishing or defending claims.

You must provide the account, licence and consent data to buy a licence; without them we cannot conclude the contract. Repository access is administered automatically from payment and licence records. A refund, payment dispute or licence revocation can restrict access. If you believe a restriction is wrong, contact support@pinionfall.com to request human review, explain your position and challenge the result. Payment-provider fraud screening is described in section 3 and in the provider’s own notice.

3. Payment and the merchant of record

Payments are processed through Stripe’s Managed Payments service, in which Link acts as merchant of record. For the payment, Link and the Stripe group company named on your receipt collect your payment details, billing information and transaction data, carry out fraud screening, handle applicable taxes within the service’s documented tax coverage, issue receipts and invoices, and handle payment support, refunds and disputes. For that processing they act as an independent controller under their own privacy policy, which you are shown at checkout. We receive only the identifiers and transaction details described in section 2, never your card details.

4. Service providers

The following providers receive data for the purposes stated below. A provider acts as a processor when handling data on our behalf and as an independent controller when it determines the purposes and means of its own processing, such as account administration, fraud prevention or legal compliance.

• Clerk (sign-in and session management), United States: processor for the sign-in service; it also processes account information for its own purposes under its privacy policy.
• Stripe / Link (payment processing; merchant of record), United States and Ireland: acts as processor for processing on our behalf and as an independent controller for its own payment, fraud, account-administration and legal-compliance purposes, including the merchant-of-record processing described in section 3.
• GitHub (repository hosting and delivery by invitation), United States: we use GitHub’s service to invite and remove your account; GitHub is an independent controller of your GitHub account under its own privacy statement.
• Vercel (hosting of the site and request logs), United States, with a global delivery network: processor.
• Neon (database hosting): processor. The database region is Frankfurt, Germany (EU); that storage location does not mean all provider administration or support processing takes place in Germany.
• Brevo (Sendinblue SAS; sending of transactional email, such as the purchase confirmation): processor for sending our messages. Its published service chain includes hosting in France and Belgium, infrastructure in the EU and United States, and support and maintenance companies in France, Germany, India and the United States.
• ImprovMX (forwarding of email sent to our contact address): processor, with mail infrastructure in France and the United States. Forwarded mail is then received in the mailbox used to handle your request.

We do not sell, rent or give your personal data to anyone else, except where the law requires it, to competent authorities or courts, or to our professional advisers bound by confidentiality, where this is needed to establish, exercise or defend legal claims.

5. International transfers

Some of these providers process data in the United States or in other countries whose data protection laws may not be considered adequate by Switzerland, the EU or the UK. Where data is transferred to such a country, the transfer takes place on the basis of an adequacy decision (including, where the recipient is certified, the Swiss-US or EU-US Data Privacy Framework or the UK Extension to it) or of standard contractual clauses approved by the Swiss Federal Data Protection and Information Commissioner, the European Commission or the UK authorities, as applicable, with supplementary measures where needed. You can ask us for information about these safeguards.

6. How long we keep data

• Continuing licence register: the identity, licence, purchase and access information needed to administer your rights is kept while the licence or related obligations continue. Deleting your sign-in account or reaching an accounting retention deadline does not cancel your licence. When those purposes end, we review the remaining records under the accounting and claims criteria below.
• Accounting records (including invoices and transaction records that support our accounts): 10 years from the end of the financial year in which they were created, under Swiss accounting requirements. This period applies to the records needed for those requirements, rather than to every item of personal data associated with a purchase.
• Consent and purchase evidence, delivery data and audit records: only while needed to establish or administer the licence, resolve an outstanding matter, or establish, exercise or defend legal claims. We review these categories separately; an ongoing licence does not require us to keep every diagnostic entry or duplicate message. Where claims evidence is still necessary after the underlying purpose ends, the relevant limitation period and any pending dispute or proceeding determine retention. The start and length of that period depend on the claim and applicable law, not simply the purchase date. We review the IP address and browser information separately and erase them when no longer needed for purchase, fraud or claims evidence. Removing these request details does not cancel your licence or change the statements you accepted.
• Uncompleted checkout records: reviewed for deletion after 30 days. We first check whether payment completed. We retain unresolved records while investigating a missing or pending payment, a recovery flow or a specific claim. Once a purchase has its own complete evidence record, we remove its redundant checkout draft after 30 days.
• Account data of users who have not bought a licence: until you delete your account or ask us to delete it, subject to resolving pending payments and specific claims. We remove eligible profile data and keep a minimal sign-in identifier and deletion date for 90 days to prevent delayed requests from recreating the account, then delete that record. Deleting sign-in does not cancel a purchased licence; records needed for that purchase remain under the retention periods above.
• Request logs and rate-limiting data: for a short period, normally no longer than 30 days, unless needed to investigate a specific security incident.
• Correspondence: for as long as needed to handle the matter, and as long as it forms part of the records above.
• Withdrawal statements and acknowledgements: while handling the request and, where necessary, for the accounting or claims purposes and applicable periods above. Unmatched or mistaken requests are reviewed for deletion when they are no longer needed for the request or a specific claim; submitting a form does not itself justify indefinite retention.

When no remaining purpose or applicable retention requirement justifies keeping data, we delete or anonymise it. If a specific dispute, proceeding or other legal requirement prevents deletion, we retain only the relevant records for that purpose and review them again when it ends.

7. Your rights

Subject to the conditions and exceptions of the applicable law, you have the right to:

• access the personal data we hold about you and receive information about its processing;
• rectification of inaccurate or incomplete data;
• erasure of your data, where we have no legal obligation or overriding legitimate interest to keep it (for example, we cannot erase licence and accounting records during their retention period);
• restriction of processing;
• object to processing based on our legitimate interests, on grounds relating to your particular situation;
• data portability: to receive data you provided to us in a structured, commonly used and machine-readable format, or have it transmitted to another controller; and
• withdraw consent at any time, where processing is based on consent (we do not rely on consent for the processing described in this notice).

To exercise these rights, write to support@pinionfall.com. We may need to verify your identity, for example by asking you to write from the email address of your account or to confirm through your GitHub account. We respond within 30 days, or within the period the applicable law provides.

You also have the right to lodge a complaint with a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU or EEA, the data protection authority of your country of residence, work or of the alleged infringement; in the UK, the Information Commissioner’s Office (ICO). We would appreciate the chance to address your concern first.

8. Cookies and similar technologies

The site uses only the cookies needed for sign-in: the session cookies set by our sign-in provider, which keep you signed in and protect your session. They are strictly necessary for the service you ask for, so no consent banner is used. The site sets no analytics, advertising or tracking cookies, and uses no tracking pixels.

The checkout page is operated by the merchant of record, which may use its own cookies and similar technologies for payment and fraud prevention under its own policy.

9. United States residents

We do not sell personal information and do not share it for cross-context behavioural advertising, as those terms are defined under California law and similar state privacy laws, and we do not use it for targeted advertising or for profiling that produces legal or similarly significant effects. We use personal information only for the purposes in this notice. You can ask us to access, correct or delete your personal information as described in section 7, and we will not discriminate against you for doing so.

10. Children

The site and the licence are intended for adults. You must be at least 18 to buy a licence. We do not knowingly collect personal data from children. If you believe a child has given us personal data, contact us and we will delete it.

11. The free game at pinionfall.com

• No telemetry. The game does not collect analytics, usage statistics or crash reports, and has no account.
• Saves stay on your device. Save games are stored in your browser’s storage on your device. We cannot see them. Clearing your browser data deletes them.
• On-device AI. The dialogue language model and the speech synthesis run on your device. What you type or say to characters is not sent to us or to any AI provider.
• Downloads from third parties. At runtime the game downloads its speech model and, when used, its optional dialogue model from Hugging Face. To deliver those files, the provider receives the technical data any web request carries (such as your IP address, browser information and the time of the request) and processes it as an independent controller under its own privacy policy. The game’s fonts are served with the game from pinionfall.com; loading them does not make a request to Google Fonts.
• Hosting. The hosting provider of pinionfall.com processes ordinary request logs to deliver and secure the game.
• Link to this site. The game links to this site with an attribution word (section 2). No data about your play is attached.

12. Security

We protect personal data with appropriate technical and organisational measures, including encrypted connections, access restricted to what each service needs, and storage of payment data only with the merchant of record. No system is completely secure; if a breach affects your data and the law requires it, we will notify you and the competent authority.

13. Changes to this notice

We may update this notice when our processing or the law changes. The date at the top shows the current version. If a change materially affects how we process data you have already given us, we will tell you by email.

14. Contact

Pinionfall, support@pinionfall.com
Name and postal address: see the imprint.