Privacy Policy

Anomalist is a brand of Anomalist Enterprise LLC ("we", "us"), an Indiana company. We make games, and we build websites and apps for clients. This policy covers anomalistenterprise.com, its subdomains, and the products we run under the Anomalist name. It's written in plain language on purpose. If something isn't clear, email support@anomalistenterprise.com and we'll explain it or fix it.

Some products publish their own privacy notice. Our game Zoning does, at zoning.anomalistenterprise.com/privacy. A product's own notice adds detail for that product: what it collects and how it deletes from its own live systems. It can add providers and state a shorter backup window where that product's systems have one, but it doesn't remove a provider listed in Section 3, and our sections on your rights, security and contact apply to every product. Sites we host for a client on one of our subdomains are governed by that client's own terms and privacy notice.

1. What we collect

1.1 Information you give us

• Contact form. Your name, email, message and the topic you picked, plus your business name and phone number if you give them, and the consent you tick. Used to reply to you and follow up on what you asked about.
• Playtest sign-up. On our Games page, and on anomalistbeta.com, which has the same sign-up form and sends it to the same playtest list: your name, email, the devices you'd play on (iPhone, Android, desktop), your month and year of birth (used once to check you're 13 or older; we keep only the result, never the month or year), an optional note about what you like to play, and your agreement to be emailed about playtests. Used only to decide who to invite, to invite you, and to let you sign in to playtests (Section 5). If you ask one of us to playtest directly instead of using the form, we record your email, your name if you give it, and that the person who added you confirmed you're 13 or older, and use them the same way.
• Orders and quotes. When you order a site on /start we collect what the agreement needs: your name, email, phone, business name, the legal entity name, state and entity type that go on the contract, your role, how you'd like to be contacted, your timeline, how you heard about us, and what you tell us about your business, goals and existing site. This is used to generate your scope summary and Statement of Work, to set up your account if you buy, and to do the work.
• Electronic signature records. When you accept an agreement at checkout, we record, deliberately and as evidence, the name you typed, your email, the date and time, your IP address and browser user agent, and the exact version and SHA-256 fingerprint of each document you accepted. We also record when you open each document. This is what makes a tick-box acceptance enforceable under Indiana's Uniform Electronic Transactions Act and the federal E-SIGN Act, and it protects you as much as us.
• Payment details. We never see or store your card. Stripe handles payment on its own secure form; we receive back a confirmation, the amount, and what you bought.
• Client work. When we build or look after a site or app for you, we use the content, files and account access you give us to do the work.
• Accounts in our products. A product you sign in to keeps what it needs to work: your sign-in email and what you create in it.

1.2 Information collected automatically

• Form metadata. When you send the contact form, the playtest sign-up (on our Games page or on anomalistbeta.com) or an order on /start, we store your IP address and browser user agent with the submission, and briefly use your IP address to limit repeated requests, to stop spam and abuse. A copy of each contact form submission is emailed to us. A playtest sign-up only sends us an email saying a new sign-up arrived, with none of your details in it.
• Server logs. Our hosting provider, Cloudflare, logs standard request details (IP address, user agent, the page requested, the time) for security, abuse prevention and keeping things running.
• Page analytics. Cloudflare Web Analytics runs on some of our pages and subdomains. It measures page views and load performance in aggregate (the page, the referring site, browser and country). It sets no cookie and doesn't build a profile of you.
• Security checks. Cloudflare may run a bot check and set a short-lived security cookie to tell people from bots.
• Fonts. Our pages load fonts from rsms.me and cdn.jsdelivr.net, so those services see your IP address when your browser fetches them.
• Cookies and browser storage. This website sets no cookie of its own. It keeps a few small things in your browser's local storage: whether you paused the site's animations, your progress through an order on /start, and, if the playtest sign-up on our Games page turns you away, the time it did, so the form stays closed in that browser for a day. Products you sign in to keep a sign-in session in a cookie or in your browser's storage so you stay signed in, and each game's own notice lists what it stores; signing in to a playtest sets Cloudflare Access's sign-in cookie on our playtest sites. We run no advertising trackers or pixels.

2. How we use it

• To reply to you, invite you to playtests you signed up for and let you sign in to them, and do the work you hired us for.
• To take payment and keep the records the law and our agreements require.
• To run, secure and fix our websites, games and products.

When you ask us to build something for your business, we may also look at public information about it (your website, public business listings, public social profiles) and keep a working profile of your business so we can do the work. That is research for your benefit; you can ask to see, correct or delete it.

We don't sell, rent or trade information about you, and we don't use it for advertising.

3. Who processes it for us

We use a small set of service providers, each only for the job listed:

• Cloudflare: hosting, delivery, DNS, databases and file storage, security checks, page analytics, the sign-in check for our playtests (Cloudflare Access, which also emails the one-time sign-in codes, from noreply@notify.cloudflare.com), and some built-in AI features (for example text-to-speech). Data is stored in Cloudflare's North American regions and processed in the United States.
• Stripe: payments. Stripe collects your card and billing details directly under its own privacy policy. Depending on the product, we give Stripe your email or Stripe collects it on its own checkout form (as in our games); Stripe also gets what you're buying, and we get back the result.
• Have I Been Pwned: checks new game passwords against known data breaches; it receives only the first 5 characters of a password's hash, plus the request details any website gets (your IP address and browser).
• Resend: sending our email (replies, sign-in links, receipts, notices).
• Google Workspace: our company email. Messages you send us, and copies of form submissions, arrive there.
• Google Firebase Authentication: sign-in for our games, if you choose to sign in. See the game's own notice.
• Google sign-in for playtests: if you sign in to a playtest with your Google account, Google handles that sign-in under its own privacy policy and tells Cloudflare Access your account's email address and basic profile details, such as your name.
• AI providers (Anthropic, and OpenRouter for some earlier apps): for product features that generate text. What you send those features goes to the provider through its API to produce a response; under those API terms it isn't used to train the provider's models. Delta also uses OpenAI's models through OpenAI's Codex app on our ChatGPT plan, under that plan's terms, and can fall back to Ollama's hosted models, under Ollama's terms (Section 7). We also use AI assistants ourselves when researching and building client work.
• Brave Search: web searches made by the AI features of some earlier apps.
• Plaid: bank-account connections for our own internal bookkeeping tool.

We add or change providers only when there's a real need, and we update this list when we do.

4. AI

Some of our products and tools use AI. When you use an AI feature, the content you send (your message, the conversation, and context the feature retrieves) goes to the model provider so it can answer. We don't sell your data, and we don't train AI models on it ourselves. AI output can be wrong, incomplete or out of date; don't rely on it alone for medical, legal, financial or safety-critical decisions.

5. Games

Our games can usually be played without an account. If you sign in, your progress follows you between devices. A game may show a public leaderboard with the nickname and avatar you choose and your scores, and may sell in-game items or a subscription through Stripe. Anyone may play as a guest; game accounts, leaderboards and purchases are for players 13 and older. Each game publishes its own privacy notice with the details for that game, and that notice controls for the game, within the limits described at the top of this policy. For Zoning that's zoning.anomalistenterprise.com/privacy. Downbeat has no accounts: your progress and settings stay in your own browser's storage, and its fonts and files all come from our own site. When you finish or leave a level, it sends us a few anonymous numbers (which level, attempts and clears, jumps and how many landed on the beat, and roughly where each fall happened), which we add into daily totals for each level. A promo code you type is checked by our server and not stored. We don't store IP addresses, device IDs or cookies for any of this; your IP address is used only for a moment, to limit abuse. The details are at downbeat.anomalistenterprise.com/privacy. Cloudflare's standard hosting logs and security check (Section 1.2) apply there as on our other pages.

Playtests are for people 13 and older. If we invite you, we add the email you signed up with to the list of people allowed into our playtest sites, and send you one email telling you how to sign in; it contains no sign-in link or code. You sign in through Cloudflare Access with Google or with a one-time code, using exactly the email address we approved. With Google, Access checks your Google account's email address against that list. With a code, Cloudflare emails the code to that address from noreply@notify.cloudflare.com; that email comes from Cloudflare, as our service provider, not from us. Cloudflare records each sign-in (your email, the time, your IP address and the country it maps to) in our account's security logs. The first time you sign in, Cloudflare also creates a user record in our account with your email address, your name as Google gives it if you signed in with Google, and when you last signed in. Cloudflare doesn't let us delete that record, so it stays in our Cloudflare account after you're removed, although it no longer gets you in. If you ask us to delete your information, we'll ask Cloudflare to delete that record too and tell you what they say. A game you play in a playtest may collect more, as its own notice says. When you're removed from the list, you're signed out and can't sign back in, apart from the one exception in Section 8.

6. Sites and apps we build for clients

When we build or maintain a website or app for a client, the information that site collects from its own visitors belongs to the client. We handle it only on the client's behalf and under our written agreement with them. If you're a visitor to a client's site, that site's own privacy policy applies.

7. Our earlier apps

Before becoming a games studio we ran several apps:

• Berea and Compass closed to the public on September 30, 2026. On October 4, 2026 we permanently deleted the remaining accounts and their contents from our live systems, except accounts that belong to us and a few accounts we kept. On October 11, 2026 we deleted both apps and every account that was left, with its contents. Residual copies in our hosting provider's backups are gone within 90 days. What remains: Berea's library of public-domain and openly licensed texts is a free tool that AI assistants can connect to, atberea.anomalistenterprise.com/mcp. It has no accounts and stores nothing about you; your IP address is used only for a moment to limit how often it can be called, and our hosting provider (Cloudflare) keeps its standard request logs for its usual log period. Compass is now a private tool used only by us.
• Station is paused. It takes no new listeners and makes no new episodes. An existing listener's feed and archive still work, and deletion works as in Section 9.
• Atlas has closed. On October 22, 2026 we emailed its testers outside our company, and on November 5, 2026 we will permanently delete Atlas accounts and their chats, feedback and journal notes. Until then you can still ask us for a copy, or to delete yours sooner (Section 9). Backups age out as described in Section 9.
• Nexus has closed, and nobody can sign in to it. Its databases are no longer at our hosting provider. We keep an offline copy of its records, made on October 19, 2026, which includes its account records; email us and we'll delete yours, including that copy.
• Delta is an earlier beta app, provided as it is; it may change or close, and we'll give notice before closing it if you have an account in it. It has its own privacy page, at delta.anomalistenterprise.com/privacy, which describes it in detail; this policy covers anything that page doesn't. Delta answers using a computer we operate, reached over an encrypted Cloudflare connection. To write an answer, that computer uses OpenAI's models, through OpenAI's Codex app on our ChatGPT plan and under that plan's terms; if OpenAI fails, it can fall back to Anthropic (Claude), to Ollama's hosted models, or to a model running on that computer itself. You can delete your Delta account yourself, in Settings → Delete my account and data: Delta cancels any subscription that hasn't ended first, then deletes your account and its contents from its database straight away. Delta's privacy page lists exactly what is deleted and what is kept, and deleted data leaves its database backups within 30 days.
• The beta portal at ai.anomalistbeta.com, where one sign-in opened Atlas, Delta and Nexus, closed on Thursday, October 22, 2026. Nobody can sign in to it any more, so its delete button, and restoring a deleted account by signing back in, have ended too. Closing the portal didn't delete or change your accounts in the apps. Delta has its own sign-in: enter your email on Delta and it emails you a link. Nexus could be signed in to only through the portal, so you can no longer sign in to Nexus. After the portal closed, we permanently deleted the portal accounts of everyone outside our company on October 22, 2026, including the copies described below; this didn't touch your accounts in the apps. At any time, email support@anomalistenterprise.com for a copy of what the portal or an app holds about you, or to have it deleted. Backups age out as described in Section 9. Copies of the beta portal's account records are also kept in a Cloudflare account run by one of our founders; deletion requests cover those copies too.
• Beta applications and waitlist entries are deleted after the beta they were for closes.

8. How long we keep it

• Contact form messages. Up to 24 months from when you contacted us, or sooner if you ask. Then deleted.
• Playtest sign-ups. A sign-up we haven't acted on is kept up to 24 months from when you signed up, then deleted by an automated job. If we invite you, we keep it for as long as you're on the playtest list. You can ask us to delete it sooner. If you're removed from the playtest list (a playtest closes, you ask, or we decide), you lose access straight away: your address is taken off the sign-in list and your sign-in to every playtest ends. The one exception is an address one of our founders added to the sign-in list directly; a founder takes that off by hand. If we decide not to invite you, nothing changes on the sign-in list. Either way, your sign-up is then erased from our live systems 30 days later by an automated job, and backups age out as described in Section 9. If by then we haven't been able to confirm with Cloudflare that you're off the sign-in list, we keep only your email address, and only until we have. Cloudflare keeps its sign-in records for its standard log period, and keeps the user record described in Section 5.
• Orders you start but don't complete. Up to 12 months after your last activity on the order, or sooner if you ask. Then deleted.
• Orders, agreements and signature records. For the life of the engagement and then seven (7) years, which is how long we may need to show what was agreed for tax, accounting and limitation-period purposes. These are deliberately not deleted on request while that period runs; an agreement you can erase is no evidence of anything. Everything else about you can still be deleted (Section 9).
• Accounts in our products. For as long as the account is active, then on the deletion clock in Section 9, unless the product's own notice says otherwise.
• Server logs. Cloudflare's standard short retention, typically days to weeks.

9. Your rights and choices

You can ask us to:

• show you what we hold about you;
• correct anything that's wrong;
• delete your information (except records we must keep, listed in Section 8);
• stop contacting you.

Email support@anomalistenterprise.com from the address associated with your account or submission. We'll respond within 30 days.

The deletion clock

Unless a product's own notice says otherwise, deleting an account runs on this clock, including backup periods we can't shorten (a product's own notice may state a shorter backup window):

• Immediately. The account is deactivated: you're signed out everywhere, any public link to it stops working, and any subscription stops renewing (you keep what you've paid for until the period ends).
• For 30 days. You can change your mind by signing back in with the same email, and your account and its contents come back. A subscription that has ended doesn't restart on its own.
• After 30 days. The account and its contents are permanently erased from our live systems by an automated job. That can't be undone.
• Afterwards. Residual copies may remain in backups until they age out: within 90 days in our hosting provider's automatic encrypted backups, which can't be switched off, and within 180 days in any recovery backup we keep ourselves. We won't claim erasure is instant when it isn't.

The same clock applies to a deletion request you email us, except in apps without a delete button, where we delete by hand within 30 days (Section 7). The records in Section 8 that we must keep are the one documented exception.

10. Programs we've discontinued

We previously ran an insurance text-message program and a business lead-generation program. Both are discontinued: we don't send texts and we don't use those records for outreach. Any opt-out you gave stays honored permanently, and we have never shared mobile numbers or text-message opt-in data with anyone for their marketing. Records from those programs are kept only as required for legal and record-keeping purposes. To ask about records that concern you, email support@anomalistenterprise.com.

11. Children

Our website and services are for people 18 and older, except our games. In our games, anyone may play as a guest on their own device, and accounts, leaderboards and purchases are for players 13 and older; players under 18 need a parent or guardian's permission to buy, and a game's own terms may ask more. Each game's own notice gives the details (for Zoning: zoning.anomalistenterprise.com/privacy). Playtests are also open from age 13 (we ask your month and year of birth to check, and keep only the result), and if you're under 18 a parent or guardian should know you're taking part. We don't knowingly collect personal information from children under 13. If you think a child has given us information, email support@anomalistenterprise.com and we'll delete it.

12. Security

We use encryption in transit (HTTPS everywhere), scoped session cookies, signed sign-in links, least-privilege access to internal tools, and security agents of our own that scan our code and infrastructure every day. No system is unbreakable. If we discover a breach that affects your data, we'll tell the people affected without unreasonable delay.

13. International users

We operate from the United States, and your information is processed in the US, which may have different data-protection standards from your home country. If you're in the EU or UK and want to exercise rights under GDPR, email us and we'll handle the request.

14. Changes to this policy

We update this page when something material changes about how we handle information, and the effective date at the top shows the latest change. Earlier versions are available on request. Continued use of the site or our products after an update means you accept the revised policy.

15. Contact

Privacy questions, requests or complaints: support@anomalistenterprise.com.

Anomalist Enterprise LLC · Evansville, Indiana · United States.