Privacy Policy

Dynamo Engine LLC (“we”, “us”) provides Dynamo, an AI-assisted game-development tool. This policy describes what personal data we collect when you sign in to or use Dynamo, why we collect it, how we store it, and the choices you have over it.

We aim to collect the minimum data needed to run the product and never sell your personal information.

When you sign in to Dynamo we collect the following from your chosen identity provider:

• Email address — used as your account identifier and to email you transactional messages (sign-in links, security notices, free-trial reminders and the trial-ended notice, billing receipts).
• Display name and avatar URL (when available from your provider) — shown in your account page so you can confirm you signed in with the right account.
• Provider user ID— the unique identifier your provider (Google, Microsoft, GitHub, or Discord) assigns you. We use this to verify it's the same person on subsequent sign-ins.

When you authorize Dynamo to sign in with Google, we receive only the data covered by the email, profile, and openid scopes. We do not request access to your Gmail, Drive, Calendar, or any other Google service.

From the Dynamo Engine app or the Dynamo command line running on your machine, we additionally collect:

• Device fingerprint— a hash derived from your machine's hardware identifiers, used to enforce your plan's seat limit and to allow one free trial per computer. We never see your raw machine identifiers; only the salted hash.
• Hostname, operating system, Dynamo version — shown in your device list so you can recognize each registered machine.
• Last-seen timestamp per device — updated each time the app or the command line authenticates so you can spot inactive devices.

Ad and campaign attribution. If you arrive at dynamoengine.dev from a link that carries campaign tags (utm_source, utm_medium, utm_campaign, utm_content, utm_term) or a Google Ads click identifier (gclid), the site keeps them in your browser and, when you create your account, stores them with your account. When you start a subscription they are also sent to Stripe with it. When your free trial starts, the click identifier and the trial's start time are made available to Google Ads so it can count which ad led to a trial (see Who we share data with).

Your prompts and code.When you use Dynamo, your prompts, the code and project content it reads, and the AI's responses go directly from your machine to the AI provider you connect (for example a provider you added an API key for, a subscription you signed in with through that provider's own tool, or a model running on your own computer). They do not pass through Dynamo's servers, and that provider's own terms and privacy policy apply to them.

Crash reports.When the Dynamo command line crashes, it asks you, for that crash, whether to send us a crash report; nothing is sent unless you say yes. A crash report can include file paths on your machine (such as your project folder), the command that was running, and the last lines of Dynamo's log, which may contain text from your project. The Dynamo Engine app does not send crash reports itself; it lets you copy one to send us if you choose.

GitHub. If you sign in to GitHub from the app (Settings → Integrations), Dynamo works with your repositories through that sign-in on your machine. Dynamo never sees or keeps your GitHub password or token.

• To create and maintain your account and license record.
• To enforce the seat limit included with your plan, and to allow one free trial per computer.
• To send you sign-in links, account notifications, free-trial reminders, and (if you subscribe) billing receipts.
• To measure which ads and campaigns lead to sign-ups and trials.
• To diagnose and fix bugs affecting your account.
• To protect Dynamo from abuse, fraud, and security incidents.

We do not use your personal information to train AI models, sell it to advertisers, or share it with third parties for marketing.

Your account, license, and device records are stored in a Supabase-hosted Postgres database. Supabase runs on Amazon Web Services. Database access requires authenticated requests and is restricted at the row level so you can only read or modify your own data.

Transactional emails (sign-in links, license notices, free-trial reminders) are sent via MailerSend, which receives your email address only at send time.

We share your data only with the service providers that operate Dynamo's infrastructure:

• Supabase — database, authentication, and edge functions.
• MailerSend — transactional email delivery.
• Vercel — hosts dynamoengine.dev and auth.dynamoengine.dev.
• Stripe — payment processing for subscriptions, and merchant of record for customers outside the United States where Stripe offers it. Stripe receives what is needed to take your payment, plus the campaign attribution described above.
• Google Ads — receives the Google Ads click identifier and the time your free trial started, so we can measure which ads lead to trials. It does not receive your email or name.
• Your chosen OAuth provider — only when you initiate a sign-in flow.

Each provider has access only to what's needed for its function. We do not sell, rent, or trade your personal data.

We may disclose your data when required by law (e.g. a valid subpoena) or to protect the safety of our users and our service.

You can:

• Access the data we have about you by signing in at dynamoengine.dev/account.
• Revoke device access from the Dynamo command line (dynamo account devices, then dynamo account revoke), or by emailing support@dynamoengine.dev.
• Export your data from /account. Click Download my data to receive a ZIP containing your profile, license history, device list, and audit-log entries as JSON files.
• Delete your account and associated data from /account via the Delete account button. Deletion starts immediately — we cancel your active subscription and schedule the underlying records (profile, license, devices) for permanent removal after a 30-day grace period. Within that window you can email support@dynamoengine.dev to cancel the deletion. After day 30 it is permanent and irreversible.
• Revoke OAuth access at any time from the relevant provider's settings (e.g. Google account permissions).

What is retained after account deletion: We keep payment records (invoice dates and amounts) for 7 years per tax law, but the customer record is scrubbed of personal identifiers (name, email, address) at deletion time. A minimal audit-log entry recording that an account was deleted is retained for 90 days for security and complaint-handling purposes, with your personal identifier removed.

If you are located in the European Economic Area, the United Kingdom, or another jurisdiction with comparable data-protection laws, the above flows satisfy your rights to access, portability, and erasure. For other rights (e.g. objection to processing) email support@dynamoengine.dev.

Dynamoengine.dev uses essential cookies and local-storage entries required to keep you signed in. We never sell your data.

It also keeps campaign attribution in your browser: a local-storage entry (dynamo_attribution) holding the campaign tags and Google Ads click identifier you arrived with, for up to 30 days; a short-lived first-party cookie (dyn_oauth_attr, 15 minutes) that carries the same values across a sign-in with Google, Microsoft, GitHub or Discord; and a local-storage marker (dynamo_signup_reported) so a new account's sign-up is counted only once.

When we run paid search campaigns, the site loads the Google Ads conversion tag so we can count how many sign-ups and trials an ad produced. It may set a first-party cookie (_gcl_au, and _gcl_aw when you arrived from an ad) that lets Google attribute a trial to an ad click. If you are visiting from the EU, EEA, UK or Switzerland, that cookie is not set: the tag runs in a consent-denied mode and reports only aggregate, cookieless counts. Like any embedded script, loading the tag sends Google the standard request information — your IP address, browser details and the page you are on — on each page where it loads, plus the conversion count and the click identifier Google itself placed on the link you arrived through. We configure the tag with ad personalization disabled, so it is not used to build remarketing audiences.

For aggregate traffic measurement we use Cloudflare Web Analytics, a privacy-first analytics tool that counts page views and basic performance metrics without cookies and without collecting personal data or building a profile of you. There is nothing to opt out of because no personal identifiers are stored.

The Dynamo Engine app and the Dynamo command line do not write to your browser at all.

The Dynamo Engine app and the Dynamo command line can send anonymous usage data (which commands and features you use, your OS and version, and a random anonymous install ID) so we can see what helps and what to build next. It is opt-in and off by default: in the app it is a switch in Settings → Advanced (“Share anonymous usage data”); the command line asks once on first run, and dynamo telemetry off turns it off any time. It never includes your prompts, code, file contents, file paths, AI responses, email, or IP, and is never used to train AI models.

For the exact list of what is and isn't collected, where it goes, retention, and how to control it, see dynamoengine.dev/privacy/telemetry.

Dynamo is not directed at children under 13. We do not knowingly collect personal information from anyone under 13. If you believe we have, please contact us and we will delete it.

We will update this page when our practices change. Substantive changes will be announced via email to registered users at least 14 days before they take effect. The “Last updated” date at the top reflects the most recent change.

Questions about this policy or your data: privacy@dynamoengine.dev