Privacy Policy

Effective June 1, 2026

Broken Bot is run by Yulia Winslow, an individual based in New York, USA ("I" or "me"). This policy explains what data Broken Bot (brokenbot.games) collects, why, who it's shared with, and the choices you have.

Who Broken Bot is for

Broken Bot is for people aged 18 or older. It isn't directed at children, and I don't knowingly collect data from anyone under 18.

The data I collect

What's needed for Broken Bot to function and develop:

• Account details. Your email address and a password, used to create and access your account. Passwords are handled by the authentication provider and stored in hashed form — I never see your actual password.
• Game data. The responses you type in the pre-test and post-test, records of which prompts you've seen, and per-game logs (timing, completion, and the single analysis line generated for that game). Spoken responses during the game body are not recorded; only typed pre/post responses are stored.
• Payment data. If you buy access, payment is processed by Stripe. I receive confirmation that a payment succeeded and basic subscription status, but I never receive or store your full card number.
• Messages you send. If you use the contact form, I receive the name, email, and message you submit.
• Newsletter. If you subscribe to news, your email is stored by the newsletter provider (Buttondown) so I can send updates. You can unsubscribe at any time using the link in any email.
• Basic usage data. Standard analytics about how the site is used (e.g., pages viewed, approximate region, device/browser type), collected through Google Analytics. A value called bb_session is stored in your browser to keep you signed in and track free-game usage; it stays on your device.

Why I collect data

• To create your account, sign you in, and keep you signed in.
• To run games, avoid repeating prompts you've seen, and produce your per-game analysis.
• To enforce free-game limits and process paid access.
• To understand, in aggregate, how the site is used and to improve it.
• To answer messages you send and, if you opt in, to send you news.
• To study associative and cognitive patterns — the core research purpose of the project. What I learn informs how I improve Broken Bot and design new games and related products, including ones I may offer commercially to individuals or organizations. Where this analysis is tied to your account, it is treated as personal data under this policy.

Research data

"Research data" means the gameplay data used for the project's core research purpose: the responses you type in the pre-test and post-test, and the Discoveries notes you choose to write.

Who it's shared with

I don't sell your data and I don't show ads. I use a small number of service providers ("processors") that handle data on my behalf so the product can function:

• Supabase — stores your account, game data, and logs (the database and authentication).
• Anthropic (Claude API) — receives your typed pre-test and post-test responses to generate the analysis line for a game. These are sent for processing and are not used to train models when sent through the API.
• Stripe — processes payments.
• Netlify — hosts the site and runs the serverless functions; contact-form submissions are delivered through Netlify.
• Buttondown — stores newsletter subscribers and sends news emails.
• Google Analytics — provides aggregate usage statistics.

I may also disclose data if required by law, or to protect the rights, safety, or security of users or the service.

Aggregated and de-identified data

I use aggregated and de-identified data — information that doesn't identify you and can't reasonably be linked back to you — to understand patterns, build and improve games and products, create new offerings (including commercial ones), and illustrate ideas in materials such as presentations, pitches, talks, or publications. This may include anonymized examples of response patterns, described so that no individual can be identified. I don't sell your personal data, and I don't share your name, email, or other identifying information with third parties for their own purposes.

Where data is processed

These providers may process and store data in the United States and other countries. By using Broken Bot, you understand your data may be transferred to and processed in countries that may have different data-protection rules than where you live.

How long it's kept

Account and game data is kept while your account is active. If you delete your account, the associated game logs and responses are deleted or anonymized. Newsletter data is kept until you unsubscribe. Contact-form messages are kept as long as needed to handle your request. Aggregate analytics that can't identify you may be retained.

Your choices and rights

You can ask to access, correct, or delete your personal data, or to close your account, by writing to info@theoryofvalues.com. Depending on where you live, you may have additional rights under laws such as the GDPR (EU/UK) or US state privacy laws, including the right to object to or restrict certain processing. I'll respond to reasonable requests. You can unsubscribe from news at any time, and you can use most of the site without analytics by using your browser's tracking controls.

Security

I take reasonable measures to protect your data, and the providers above maintain their own security practices. No method of transmission or storage is perfectly secure, so I can't guarantee absolute security.

Not medical or psychological advice

Broken Bot is a research and entertainment tool. Its prompts and the analysis it produces are not medical, psychological, or therapeutic advice, and are not a substitute for care from a qualified professional.

Changes to this policy

I may update this policy as the product changes. The effective date above shows the latest version. Material changes will be reflected here.

Contact

Questions about privacy: info@theoryofvalues.com.