Privacy
We operate Can You Beat AI?, a game inside ChatGPT. Contact lodestonegames.support@gmail.com.
What we save and why
We create an anonymous game profile after you approve connecting, to save your games and recognise your authorised connection. Each game stores its type, board, starting player, moves, result, and timestamps. Earlier development games may also retain their original game instructions and turn metadata. We use these records to validate moves, restore games and calculate your personal results.
No name, email address, password, payment details or sensitive personal information is requested through gameplay. We do not record your conversation, location, browser fingerprint, ChatGPT model, thinking level or token usage. We do not capture raw tool requests or responses, and there is no separate analytics or diagnostic event collection. We do not sell game data, use it for advertising or use it to train AI models.
Your connection
Opening the connection page creates a temporary consent record and security cookie, valid for ten minutes, to verify your approval or cancellation. Opening or cancelling it does not create a new game profile or long-lived profile cookie.
OAuth lets ChatGPT access your saved games after you authorise the connection. Tokens are managed by ChatGPT and checked by our backend; they are not placed in game-tool arguments or results. Internal player identifiers are not returned to the model. Boards include a game ID needed to identify the round; that ID alone does not grant access.
A Secure, HttpOnly cookie recognises your anonymous profile when connecting again in the same browser. We store a hash of this cookie with a one-year expiry. Our OAuth provider stores token hashes and encrypted authorization properties in D1. Access tokens expire after one hour; refresh access expires after 30 days of inactivity. Clearing cookies or using another browser may create a separate profile. Earlier development histories remain stored and are not automatically merged into a new profile.
Providers
Cloudflare hosts the Worker, D1 database and website. An IP address is processed for rate limiting but is not written to our game database. Cloudflare may process network metadata under its own policies. OpenAI hosts ChatGPT and the board interface, and receives game state and legal moves to play its turns. Google processes support email through Gmail. These providers may process information outside your country. We may disclose information where legally required.
Retention and your choices
Saved games and histories remain until deleted on request or the service closes. Removing the optional diagnostic and analytics systems deletes their old database records; it preserves game histories. Expired connection records are cleaned up hourly.
Cloudflare Workers logs are retained for up to seven days. Routine request logging is disabled; error logs may include Cloudflare-generated request metadata. D1 database recovery history is retained for up to 30 days, so records deleted from the live database may remain recoverable during that period.
Support email has no automatic expiry: your message and email address remain in the support mailbox until manually deleted. You can request deletion by contacting support.
The widget saves game references and pending-turn information so it can restore your board. You can stop playing and disconnect the app. Disconnecting or clearing storage does not delete saved games and may prevent access to an anonymous profile.
Contact support to request access, correction or deletion of records we can identify as yours. Include a game ID if available; never send tokens, cookies or full chat history. We may need to verify control of the game before acting. You may raise privacy concerns with the relevant data protection authority.