Privacy Policy

Sifr Studio (“we”, “us”) operates sifr.studio and related product sites (including toolbox.sifr.studio / opentoolbox.dev, black.sifr.studio, delegate.sifr.studio, 333sentences.sifr.studio, pal.sifr.studio, theinfinitegame.ai, and experiments.sifr.studio). This policy explains what personal data we collect and how we use it.

Contact: [email protected]

What we collect

• Account data — when you sign in with Google: name, email, and Google account id.
• Session data — a signed session cookie (sifr_session) shared across *.sifr.studio so you stay signed in.
• Usage & support — product analytics and Support chat via PostHog (events, device/browser info, pages viewed; we may identify signed-in users by email).
• Ads measurement — The Infinite Game sends page views and a hashed copy of your email to X (Twitter) so we can measure ads.
• Payments — Stripe processes payments (e.g. Black, 333 Sentences, The Infinite Game wallet). We receive billing metadata and status; Stripe handles card details.
• Email — transactional mail via Zoho (e.g. operational messages from [email protected]).
• Product content you submit
  • Toolbox — optional usage of the free agent-toolbox host (opentoolbox.dev / toolbox.sifr.studio); request metadata as needed to operate the Worker. Self-hosted installs are under your control.
  • Pal — WhatsApp phone number (jid) and message content needed to run the companion.
  • 333 Sentences — learning preferences, progress, reminders, and purchase status tied to your account. See the 333 Sentences privacy policy.
  • The Infinite Game — game sessions, typed actions, generated video, and wallet ledger.
  • Delegate — project credentials and run logs needed to execute automations (may include third-party tool data you connect).
  • Black — license entitlement after purchase; the extension keeps analytics on-device.
• Infrastructure logs — hosting and edge providers (Oracle Cloud VPS, Cloudflare) may process IP addresses and request metadata to operate and secure the services.

How we use Google user data

We use Google sign-in only to authenticate you and create/maintain your Sifr Studio account (name, email, Google id). We do not sell Google user data. On The Infinite Game we send a hashed copy of your email to X so we can measure ads. We do not grant unrelated apps access to your Google account data beyond what Google OAuth returns for sign-in.

Why we process data

• Provide and secure the products you use
• Authenticate sessions and prevent abuse
• Process payments and fulfill licenses
• Understand product usage and provide Support
• Measure X ads for The Infinite Game
• Send essential service messages
• Comply with law when required

Processors

We use these processors to run the services:

• Google — sign-in
• PostHog (US cloud) — analytics and Support widget
• Stripe — payments
• Cloudflare — DNS, tunnel, Access for some admin tools; also hosts the Toolbox Worker
• Zoho — email delivery
• Oracle Cloud — application hosting
• fal.ai and OpenAI — The Infinite Game video and narrative parsing
• X (Twitter) — ads measurement for The Infinite Game (browser pixel and Conversion API)

Self-hosted Toolbox instances and any tools you point agents at are outside Sifr Studio’s control.

Cookies

• sifr_session — required for signed-in access
• PostHog cookies / storage — analytics and Support
• X pixel cookies — ads measurement on The Infinite Game
• Product-specific cookies where an app needs them to function

Retention

Account and product data are kept while your account or project is active. You may ask us to delete your account data. Backups may retain copies for a limited period. Payment records may be kept as required for accounting and fraud prevention. Analytics events follow PostHog’s retention settings.

Your rights

Depending on where you live, you may have rights to access, correct, delete, or export personal data, or to object to certain processing. Email [email protected] and we will respond within a reasonable time. For 333 Sentences, you can also request account and associated data deletion online. You may also revoke Google access in your Google account settings.

Children

Our services are not directed to children under 16. We do not knowingly collect their data.

International transfers

We and our processors may process data in the United States and other countries. If that is not acceptable for your use case, do not use the services or contact us before signing up.

Changes

We may update this policy. The effective date above will change when we do. Continued use after an update means you accept the revised policy.