// Privacy Notice

Above Constraints is a solo-founded platform based in Italy, built to serve indie game developers, modders, and the wider creator community. The data controller is Above Constraints, operated by its founder. You can reach the controller at info@aboveconstraints.com.

This notice covers aboveconstraints.com and any subdomain (merch, solutions, community servers) that links back to it.

Only what the platform actually needs to function:

• Account data — username, email, password hash, avatar selection, optional bio, optional Discord handle.
• Submissions — game pitches, course progress, community posts, anything you choose to publish on a public profile.
• Connected accounts — if you link Discord, Patreon, Steam or YouTube, we store the linkage tokens and the public identifiers those services return. We never see your password on those platforms.
• Technical logs — IP address, browser, page URL, error traces. Used for security and debugging, kept short.
• Above-Chan conversations — message content sent to the assistant, processed via Anthropic's API and not used to train models.

• Run your account, save your progress, show you your submissions and unlocks.
• Operate community features — public profiles, news, badges and credits.
• Keep the platform secure: spam prevention, abuse detection, rate-limiting.
• Improve courses and tools using aggregated, non-identifying usage signals.
• Send you transactional emails (account confirmations, submission updates) and — only if you opt in — community newsletters.

We do not profile you for advertising. We do not sell, rent, or license personal data to third parties.

Above Constraints is based in Italy and processes data under the EU General Data Protection Regulation (GDPR) and Italian data protection law:

• Contract — to deliver the account and platform features you sign up for.
• Legitimate interest — to keep the platform secure, prevent abuse, and improve product quality.
• Consent — for non-essential cookies, marketing communications, and any optional integration you connect.
• Legal obligation — when we are required to retain or disclose data by law.

The platform runs on a small set of services. Each only sees what it needs to do its job:

• Hosting / infrastructure — site delivery, database, authentication.
• Anthropic — powers Above-Chan; messages are processed in real time and not retained for training.
• Discord, Patreon, Steam, YouTube — only when you explicitly connect them, and only for the linkage you authorised.
• Email delivery — to send account and submission emails.
• Analytics — if used, configured to be privacy-respecting (no cross-site identifiers, IP truncated).

We use the minimum cookies needed to keep you signed in and remember your preferences. Non-essential cookies require your consent through the cookie banner. You can change your choice at any time by clearing cookies for the domain or contacting us.

• Account data — kept while your account is active, deleted within 30 days of account closure.
• Public submissions — game pitches and community posts you publish remain visible until you remove them or close your account.
• Logs — retained no longer than 90 days unless investigating an active security incident.
• Above-Chan conversations — short-term context only; not retained for training or profiling.

Under GDPR you have the right to:

• Access the data we hold about you.
• Correct anything that is inaccurate.
• Delete your account and associated data.
• Export your data in a machine-readable format (portability).
• Object to or restrict certain types of processing.
• Withdraw consent at any time, without penalty.
• Lodge a complaint with the Italian Garante per la protezione dei dati personali.

To exercise any of these, email info@aboveconstraints.com. We aim to respond within 14 days.

Passwords are hashed with modern algorithms; transport is encrypted via HTTPS; access to production systems is limited to the founder. No system is unbreakable — if a breach affects you, we will notify you and the relevant authority within the timelines GDPR requires.

Above Constraints is not directed at children under 16. If you are below the age required for digital consent in your country, do not create an account without a parent or guardian. If we learn we have collected data from a child without proper consent, we will delete it.

When something material changes, we update the date at the top and — for changes that affect your rights — notify you by email or in-app banner before the new version takes effect.