Privacy Policy
Version 1.0 · last updated 1 September 2026
1. Who is responsible for your data
The controller of your personal data is Grzegorz Korycki, operating as
the informal organisation PSI-Q, Lubin 59-300, Poland.
Contact for anything in this policy: [email protected].
2. What we collect, why, and on what legal basis
| Data | Why | Legal basis |
|---|---|---|
| Account: e-mail, username, password hash, plan, credit balance | To give you an account and provide the service | Performance of a contract (Art. 6(1)(b)) |
| Your content: projects, uploaded images, sounds and models, built games | To store your work and build your games | Performance of a contract (Art. 6(1)(b)) |
| AI prompts you type, and the images they produce | To generate what you asked for, and to enforce the Acceptable Use Policy | Contract (Art. 6(1)(b)) and legitimate interest in preventing abuse (Art. 6(1)(f)) |
| Moderation logs: every prompt, upload and generation tied to your account, with category, timestamp and IP | To detect and prove abuse, to answer complaints, and because our payment provider requires it | Legitimate interest (Art. 6(1)(f)) and legal obligation (Art. 6(1)(c)) |
| Payment data: what you bought, when, and the amount | To take payment and keep accounting records. We never see or store your card number. | Contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Consent records: what you accepted, which version, when, from which IP | To be able to demonstrate that consent was given, as the GDPR requires | Legal obligation (Art. 6(1)(c)) |
| Anti-abuse signals: IP at sign-up, browser fingerprint, bot-check result | To stop mass fake accounts | Legitimate interest (Art. 6(1)(f)) |
| Marketing e-mail address, if you opted in | To send occasional product news | Consent (Art. 6(1)(a)) - withdrawable at any time |
3. Who your data is shared with
- Polar - our payment provider, acting as merchant of record. Polar is the seller of record for your purchase and handles payment, invoicing and sales tax. It receives your e-mail address and purchase details, and its own privacy policy applies to the payment itself.
- Stripe - used by Polar to process card payments. Card details go straight to Stripe and are never stored by us.
- Cloudflare - serves and protects the site (CDN, bot check on the sign-up form). It processes IP addresses and request metadata.
- Our hosting provider - the server that runs PSXForge, located in Poland.
AI generation runs on our own machines. Your prompts and generated images are not sent to a third-party AI provider.
We do not sell your data, and we do not use it for advertising.
4. Transfers outside the EEA
Our servers are in Poland. Some of the providers above (Stripe, Cloudflare, and Polar depending on the entity handling your payment) may process data outside the European Economic Area, in which case the transfer relies on the European Commission's Standard Contractual Clauses or an adequacy decision.
5. How long we keep it
- Account and your content - while the account exists. After you delete it, both are removed within 7 days.
- Moderation logs - kept for 12 months, then deleted. They survive account deletion for that period, because their purpose is exactly to show what happened after the fact; after deletion they are detached from the account.
- Consent records - kept for as long as needed to prove consent, and for the limitation period after the account ends.
- Accounting and payment records - 5 years, as Polish tax law requires.
- Anti-abuse signals - up to 30 days for the fingerprint check, longer only where an account was blocked.
6. Your rights
You have the right to access your data, to have it corrected, to have it deleted, to receive it in a portable format (portability), to restrict or object to processing based on legitimate interest, and to withdraw consent at any time without affecting what was done before.
Export of your account data and deletion of your account are available directly in Account settings - you do not have to write to us to use them. For anything else, contact [email protected].
If you think we have handled your data wrongly, you can complain to the Polish supervisory authority: Prezes Urzędu Ochrony Danych Osobowych (PUODO), ul. Stawki 2, 00-193 Warszawa, uodo.gov.pl.
7. Cookies
PSXForge uses only cookies that are strictly necessary to run the site - there is no analytics and no advertising, which is why there is no consent banner. The full list is on the Cookies page.
8. Changes
If this policy changes materially we will announce it in the service. The version number at the top tells you which text you accepted; your consent record stores that version.
See also the Terms of Service and the Acceptable Use Policy.