The fine print

Privacy policy

Effective: 13 October 2026

ALCHEMIKA is a camera card game: you photograph real things and AI turns each one into a card; combine two cards and AI decides what they make, once, for the whole world, in a public book called the Codex. This policy explains, in plain words, what that means for your data. It also covers our website, alchemika.gazum.ai, and its launch waitlist.

The short version

Your photos are sent to OpenAI to read what they show. OpenAI does not use them to train its models.
Your photos stay private. Each one is kept on the back of your own card, where only you can see it. A photo whose main subject is a person, a document or a screen is refused, and we keep nothing of it.
Location is removed. We strip location (GPS) and all other metadata from every photo before it is stored or sent anywhere.
The Codex is public. What you make or find first becomes a public entry in the Codex, with the alchemist name you choose, and never with your photo.
No email, no ads. The game gives you an anonymous account and never asks for your email; only the waitlist on our website does, if you join it. We don't sell your data.
Delete everything, any time, from Settings in the game. What you made first stays in the Codex, credited to "an alchemist".

Who we are

GAZUM, Corp., 7345 W Sand Lake Rd, Ste 210, Orlando, FL 32819-5280, United States ("we", "us"). Contact: support@gazum.ai.

What we collect, and why

Your photos and the cards made from them

When you take a photo in the game, or choose one from your library, it is uploaded to our servers, reduced to at most 1,024 pixels on its longer side and stripped of its metadata (including location). A smaller copy is then sent to OpenAI's API: one of its models reads the main thing in the photo and writes its card (a plain name, its element, a line of lore and a short description of the thing for the painter), while OpenAI's moderation service checks the photo.

Refused photos. A photo whose main subject is a person or a face, a document or a screen, or that shows sexual content, violence, hate, self-harm, a weapon made to hurt people or illegal drugs, is refused, and we keep nothing of it. A person, a screen or writing only in the background doesn't refuse a photo: the card is about the main thing.
Your specimen. We keep an accepted photo on the back of its card, as its specimen. Only you can see it, through private links that work for an hour at most. It is never shown to anyone else or used to paint anything, and it is deleted with its card or with your account.
What the card says. The model never writes down the words it sees, such as labels or names, and brands become plain names (a can of a famous cola is a "Soda Can"). If the Codex doesn't hold that kind of thing yet, it also becomes a new entry in the Codex, written from the model's words and painted from them, never from your photo (see below).

We use them to make and run your cards. Legal basis (EEA and UK): the performance of our contract with you, and your consent to send your photos to OpenAI, which the game asks for before your first photo.

Combinations

When you combine two of your cards and the Codex already knows that pair, you get its result at once, and nothing is sent anywhere. When the pair is new, we send OpenAI the two cards' names and short descriptions, never your photos or anything that identifies you: one of its models invents the result; others check it against our content policy, moderate it and compare it with the entries already in the Codex; and, when the result is new to the Codex, OpenAI's image model paints its art from a written description.

The Codex and your alchemist name

The Codex is the game's public, numbered book of everything ever made.

Entries. Each new result, and each kind of thing captured for the first time, becomes an entry: its number, name, art and lore, its element and metal, how it is made, the date it was first made and the alchemist name of whoever made or found it first. Entries are public, worldwide: anyone can see them, whether they play or not.
Your alchemist name. You choose it when you start, and you can change it in Settings; it doesn't have to be unique, and a new name shows on all your entries. Because it is public, it is best not to use your full real name. Before a name is accepted, it is checked by our word filter, by OpenAI's moderation service and by an OpenAI model, against the rules in our Terms.
When you delete your account, your entries stay in the Codex, credited to "an alchemist" instead of your name.

Legal basis (EEA and UK): the performance of our contract with you. The public Codex is how the game works, as our Terms describe.

Your player account

a random player id, and a random access key kept on your device (we store only a one-way hash of the key);
a random device id made by the game, used only to limit how many accounts one device can create in a day;
when you joined, and when you gave your consent to AI processing;
your alchemist name, and the language you chose for the game (English or Spanish).

The game keeps your access key and player id, its device id, your invitation code, if any, and your settings (such as sound, and the cards on your Table) in your browser's storage, on your device. We use no cookies, and neither the game nor our website has trackers or ads.

Your play

Your cards: which entry each one is, when you got it and, for a card you made, the two cards it was made from; how many world-firsts you made each day; the entries you report, with the reason and any note you add; and, for a few days, how many captures, combinations, name changes and reports you made, to apply the game's limits.

Purchases

ALCHEMIKA sells nothing yet. Purchases will come with the iPhone and Android apps: they will be made through Apple or Google and verified by RevenueCat, our purchases provider. We will receive what you bought, the store's transaction id, when, and whether it was refunded, and will never see your payment details. Your player id will also be your id at RevenueCat. We will update this policy before anything is sold.

Network data

Your IP address is used to protect the service from abuse, for example to limit how many new accounts, or waitlist sign-ups, one network can make. We keep only a hash of it, for a few days. Our hosting provider keeps standard server logs for 30 days. Legal basis (EEA and UK): our legitimate interest in protecting the game and its players from abuse.

The launch waitlist

If you join the waitlist on our website, we keep your email address, the language we will write to you in, the page you joined from, when you joined, when we last sent you a confirmation email and, once you confirm, when you did. We use your address only to write to you about ALCHEMIKA's launch: a few emails on the way, and one when it opens. Legal basis (EEA and UK): your consent, given when you join and confirmed by email.

The confirmation email. When you join, we send one email to the address you gave, in the language of the page you joined from, asking you to confirm that the address is yours and that you want to hear from us. Its link works for 7 days; if it fades, join again on our website and a fresh one will come. Until you confirm, we send you nothing but confirmation emails, each one only when your address is entered on our website, and never more than one every 10 minutes. If someone else entered your address, ignore the email: an address that is never confirmed is deleted 30 days after its last confirmation email.
When you confirm, we record when, as proof of your consent.
No tracking in our emails: no tracking pixels, and no links that report your clicks.
Leave the list whenever you like, with the unsubscribe link in any email after the confirmation, or by writing to support@gazum.ai. We stop writing to you and delete your address.

When you write to us

If you write to support@gazum.ai, we use your address and your message only to answer you and to do what you ask, and keep them for as long as we need them for that, or to show how we handled a request about your data.

Our records of AI use

For each call to OpenAI, we record what it was for (reading a photo, writing a result, a check or a painting), the model, how long it took, its estimated cost, and the card, entry, pair or account it concerned: never a photo or your alchemist name. We use these records to keep the game within its daily AI budget and to understand its costs. We also keep, with each entry, a private record of how it was made: the models used, the answers they considered and what the safety checks found. It names no player.

Moderation and safety

Every photo is checked by OpenAI's moderation service as it is read, and refused if it shows sexual content, violence or self-harm, as well as for the reasons above. Every new result is written under our content policy (no real people or brands, no slurs, no sexual content, no real-world weapons, no drugs, alcohol or tobacco, no politics or religion) and, before it enters the Codex, checked against it by OpenAI's moderation service and by a second OpenAI model; a result that fails is replaced. Alchemist names are checked too. Players can report entries. Every report reaches our team for review: an entry reported as offensive or as showing a real person is hidden from the public Codex at once until it has been reviewed, and we may remove an entry, remove an alchemist name, take an account's name off the Codex, or suspend an account that breaks our Terms.

What others can see

Your photos: only you, through private links that expire within an hour. Like any link, one works for whoever has it until then.
Your cards and your Grimoire: only you.
The Codex: everyone. The entries you make or find first show your alchemist name, until you delete your account.

Who processes your data for us

OpenAI (United States) reads your photos, writes the cards and the results of new combinations, checks them, paints their art, and moderates photos, results and alchemist names. Under OpenAI's API terms, data sent through its API is not used to train its models. OpenAI may keep API data for up to 30 days to detect abuse, then deletes it.
Amazon Web Services (United States, us-east-1) hosts the game and its website, its database (the waitlist too), your photos and the Codex's art.
Resend (United States) sends our emails: the waitlist's confirmation email now, the launch emails later. It receives your email address and each email's content to deliver it, sends them from its servers in São Paulo, Brazil (AWS sa-east-1), and keeps a record of each email and whether it was delivered, for a limited time under its own retention policy. We have turned off its open and click tracking.
Cloudflare (United States) runs our domain's DNS, which points your device to our servers, and forwards the email you send to support@gazum.ai to our mailbox at Microsoft (United States).
When the apps arrive, RevenueCat (United States) will verify purchases and manage the Pass, and Apple and Google will run the app stores, under their own privacy policies.

Each of these providers processes your data only to provide its service to us, under its data processing terms. When your data leaves the EEA or the UK, it is protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long we keep it

Your cards and their photos: until you delete your account. A photo is deleted with its card.
When you delete your account, your account, cards, photos, reports and daily counts are removed from our database and storage at once, and backup copies (of the database and of stored photos) are deleted within 7 days. The entries you made or found first stay in the Codex, credited to "an alchemist".
The Codex: its entries stay public indefinitely, for as long as the game runs, unless we remove them. The private record of how each entry was made is kept with it.
Our records of AI use: 13 months.
The waitlist: until you leave it or ask us to delete your address, and no longer than 12 months after the game's public launch. An address that is never confirmed is deleted 30 days after its last confirmation email.
Hashed IP addresses, and the counts behind the game's limits: a few days.
Purchase records, once there are purchases: linked only to your random player id, for as long as tax and accounting law requires (up to 10 years).

Deleting your account

In the game, open Settings → Delete my account and confirm. It takes effect at once and can't be undone: your cards and their photos are deleted for good, and the entries you made or found first stay in the Codex, credited to "an alchemist".

If you can no longer open the game, for example because your browser's data was cleared, write to support@gazum.ai. Because accounts are anonymous, we can only find yours if you send your player id, shown at the bottom of Settings.

Your rights

Depending on where you live (for example in the EEA, the UK or California), you can ask to access, correct, delete or receive a copy of your data, object to how we use it, and withdraw your consent. You can withdraw your consent to AI processing at any time: you'll still be able to play with your cards, but not to capture new ones. Write to support@gazum.ai; we answer within one month. You can also complain to your data protection authority.

Children

ALCHEMIKA is not meant for children under 13, or under the age of digital consent where they live (up to 16 in some EEA countries). We don't knowingly collect their data. If you believe a child is using the game, tell us and we will delete the account.

Security

Connections to the game are encrypted (HTTPS), data is encrypted at rest by our hosting provider, access keys are stored only as hashes, your photos are reached only through links that expire within an hour, and access to our systems is limited to the people who run them.

Changes

We will post any change here. If a change is significant, we will tell you in the game before it applies.