Metis logoMetis

Privacy Notice

Last updated: November 14, 2026

This Privacy Notice explains how Metis collects, uses, shares, stores, and protects personal data when you use the Metis platform at metis.ltd, the games published on it, and its websites (the "Service"). Metis is the data controller for personal data processed through the Service ("we", "us", "our").

1. Data We Collect

  • Account data: your name, email address, and profile picture, and the identifier of the sign-in method you choose (email and password, Google, Microsoft or Apple). Passwords are stored only as salted hashes.
  • Game data: the games you play, your moves, saved games and progress; for creators, the game definitions and content you create.
  • Usage data: log records, IP address, browser and device information, and interaction events used to operate and secure the Service.
  • Billing data: handled by our third-party payment processor; we receive limited billing metadata (product, status, last four digits of the card) but never full card numbers. For creators, the details needed to pay royalties.
  • Feedback: messages you send us through the Feedback option.

2. Google User Data

If you choose "Continue with Google", Metis uses Google Sign-In (OpenID Connect) and requests only the openid, email and profile scopes. From your Google account we receive:

  • your Google account identifier;
  • your email address and whether Google has verified it;
  • your name and profile picture URL.

How we use it: only to create your Metis account, sign you in, show your name and picture in the Service, and contact you about your account. We do not request access to your Gmail, Google Drive, Contacts, Calendar or any other Google data, and we do not receive your Google password.

Sharing: we do not sell Google user data, share it with third parties, or use it for advertising. It is processed only by the subprocessors that host the Service (see section 5), and disclosed only where required by law.

Storage and protection: it is stored in our database in Microsoft Azure (United States), encrypted in transit and at rest, and accessible only to the Service and authorized administrators.

Retention and deletion: we keep it while your account is active. You can delete your account, or ask us to delete your data, by writing to support@metis.ltd; we delete it within 30 days. You can also remove Metis's access at any time from your Google Account at myaccount.google.com/permissions.

Metis's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

3. How We Use Data

  • Provide, maintain, and secure the Service, and run the games you play.
  • Generate AI output you or a game's creator request.
  • Calculate and pay creator royalties.
  • Communicate about your account, security notices, and product updates.
  • Comply with legal obligations and enforce our Terms of Service.

We do not sell personal data, and we do not use your content or your Google user data to train AI models.

4. Legal Bases (EEA/UK)

We rely on contract performance, legitimate interests, consent (where required), and legal obligation.

5. Subprocessors

We use vetted subprocessors for cloud hosting and database (Microsoft Azure), email delivery (Twilio SendGrid), payment processing, and AI model providers. A current list is available on request from support@metis.ltd.

6. International Transfers

Personal data is processed in the United States and may be transferred to other countries where our subprocessors operate. Where required, we rely on Standard Contractual Clauses or other lawful transfer mechanisms.

7. Retention

We retain personal data for as long as your account is active. When you close your account we delete or anonymize your personal data within 30 days, except where we must keep it for legal, tax or accounting reasons. Published games may remain available to players who bought them.

8. Your Rights

Depending on your jurisdiction, you may have the right to access, correct, delete, restrict, or port your personal data, and to object to certain processing. To exercise these rights contact support@metis.ltd.

9. Security

We use administrative, technical, and organizational controls including encryption in transit and at rest, role-based access, audit logs, and secret management to protect personal data.

10. Cookies

The Service uses only strictly necessary cookies, for authentication and session management. We do not use advertising or analytics cookies.

11. Children

The Service is not directed to individuals under 16.

12. Changes

We may update this Notice from time to time. Material changes will be communicated through the Service or by email.

13. Contact

Privacy questions: support@metis.ltd.