Privacy Policy
What WristForge, our apps, and the games and watch faces made with our engine collect, why, and how to get rid of it. Written to describe what we actually do rather than what a template assumes.
Last updated 29 September 2026
The short version
We collect what it takes to run accounts, sell and deliver digital items, and keep the service working: an email address, a sign-in, what you download or buy, and the content you choose to upload. Games and watch faces built with WristForge can send anonymous play statistics tied to a random install ID, never to your name. We do not sell your personal information, we do not share it for advertising, and there is no advertising in our apps or on our site. You can delete your account yourself, at any time, from your account page.
The rest of this page is the detail behind those sentences.
What this policy covers
This policy applies to all of the following:
- The WristForge website and your WristForge account.
- The WristForge desktop editor, including signing in from it.
- The WristForge Face Hub and Game Hub apps for Wear OS and other watch and phone platforms, including anything installed through them.
- Games and watch faces made with WristForge and published by Stone Golem Studios.
Developers can also use WristForge to publish their own games and watch faces. If you install one that someone else published outside of our own apps, that developer is responsible for their own privacy policy. We are responsible for the parts that run on our servers and for anything listed under our name.
Who we are
WristForge is operated by Stone Golem Studios. For data protection purposes we are the data controller, meaning we decide what is collected and why.
The best way to reach us about anything on this page is email: support@stonegolemstudio.com. We read it, and we answer.
What we collect
If you join the waitlist
| What | Why |
|---|---|
| Your email address | To email you when WristForge is available |
| Which form you used, and the site that sent you here | To learn which parts of the page work and where people find us |
| Your browser identification string and the time | To spot automated signups and keep the list in order |
| Whether you want to build a game or an app, and where you heard about us, if you tell us | To decide what to build first. Both are optional. |
If you create an account
| What | Why |
|---|---|
| Your email address and password | To sign you in. Passwords are handled by our authentication provider and stored only as a cryptographic hash. Nobody at Stone Golem Studios can see or recover your password. |
| A display name, and a creator name if you publish | To show who you are on your account and on anything you publish |
| A friend code | A short code we generate so other players can find you. Nobody can search by name or email. |
| The invite code you signed up with, if any | To check it is valid and to grant the access it was issued for |
| Sign-in tokens for the desktop editor and apps | To keep the editor or an app signed in without your password. We store only a hash of each token, with an optional label and the time it was last used, and you can revoke them. |
If you buy something
Payments are taken by a payment provider, never by us. Depending on what you buy, that is Google Play (for coins bought in our apps) or Stripe (for engine subscriptions and packs bought on our website). Your card or account details go to them directly. We never see or store a full card number.
Purchases on our website are sold through Link, Stripe's checkout service. Link (Sold through Link, LLC) is the merchant of record, which means it is the seller on your receipt and handles tax, payment, and billing support. At checkout, Link and Stripe collect your name, email, billing address, and payment details, and use them under Link's own privacy policy. If you choose to save your details with Link for faster checkout elsewhere, that is between you and Link. Link then shares the order details with us (your email, what you bought, the amount, and the order reference) so we can give you what you paid for.
What we keep is our own record of the sale: what you bought, the price and currency, the date, the status, and the provider's reference for the payment so we can handle refunds and support requests. Coins you hold are recorded as a balance on your account, along with a history of how coins were added and spent.
What you download, like, and use
We record which watch faces, games, assets, and engine versions your account downloaded, and which watch faces you liked. This powers your library, your download links, and the like counts shown to creators.
Online features in games
If you sign in inside a game that uses our online services, we store what that feature needs and nothing more:
- Cloud saves: the save data the game writes, per game and per slot, so you can pick up on another device.
- Leaderboards: your scores, linked to your display name so others can see your rank.
- Friends: friend requests and the friend list between accounts, created only when you send or accept a friend code.
Anonymous play statistics
Games and watch faces made with WristForge can report how they are used, so their developers can see whether people play and how far they get. Each install generates a random ID on the device. It is not connected to your account, your name, your email, or your advertising ID, and it is not something we can use to work out who you are.
Per play session, the report contains:
- the random install ID and a session ID,
- which game it is,
- when the session started and how many seconds it lasted, and
- any named progress markers the developer chose, such as reaching a level.
Because the ID is per install, reinstalling the game or clearing its data creates a new one. Games can offer a setting to turn these reports off, and turning it off stops them. No personal information is included in these reports, and we do not use them for advertising.
If you create and publish content
Projects, images, audio, and other files you upload, along with the watch faces, games, and assets you submit for the hubs and store, are stored on your account. Anything you publish is public by design: players will see your creator name, the title, description, previews, and the item itself. Please do not put personal information in content you publish.
Watch faces submitted for the hub are reviewed by us before they are listed. We may view your submission for that purpose.
If you earn money as a creator
When someone buys your item with coins, we record a creator earning against your account: the sale, the amount, and when it becomes available. This applies to every creator.
A small number of creators are invited to withdraw earnings as real money. For those partners, identity, bank, and tax information is collected and held by Stripe through its Connect onboarding, not by us, and Stripe can issue any tax forms the law requires. We keep only what we need to pay you and to keep financial records: the payout amounts and dates, the status of each payout, a reference to your Stripe account, and a record of the agreement you accepted (which version, and when). We do not store your tax ID or your bank details.
When anyone visits a page on our website
We run our own visitor counting rather than using a third-party analytics service. For each page view we record the page address, the hostname of the site that referred you (never the full URL), your country as reported by our network provider, whether you are on a phone, tablet or desktop, and the time.
To count unique visitors we create a fingerprint from your IP address and browser, combined with a secret key we hold and a salt that changes every day. The result is a one-way hash. We cannot reverse it to recover your IP address, and because the salt rotates daily we cannot connect your visit today to your visit tomorrow. We never store your IP address itself for this purpose.
If your browser sends a Do Not Track signal we record nothing at all for that visit.
Things we do not collect
Our apps and the games and watch faces we publish do not use advertising SDKs, do not collect your location, contacts, photos, microphone, or camera, and do not read your messages. Where a watch face shows health or activity data such as steps or heart rate, that data is read on your watch to draw the face and is not sent to us.
Cookies
This site sets no advertising cookies, no analytics cookies, and no third-party cookies. That is why you have not been shown a cookie banner: the only cookies here are the strictly necessary kind, which do not require consent.
| Cookie | Purpose | Lifetime |
|---|---|---|
| Authentication session | Keeps you signed in to your account | Until you sign out |
| Site access | Remembers you entered the pre-launch password, if one is set | 7 days |
We also self-host our fonts rather than loading them from Google. Visiting this site does not send a request to Google, or to any other third party, on your behalf. The exception is when you choose to pay: the checkout page is run by Stripe and Link, and has its own policy.
Why we are allowed to do this
If you are in the UK or the European Economic Area, the law requires us to name a lawful basis for each use.
| Use | Lawful basis |
|---|---|
| Waitlist email | Your consent, given when you submit the form |
| Running your account, purchases, downloads, saves, and payouts | Performance of a contract with you |
| Keeping financial and tax records | Compliance with a legal obligation |
| Website visitor counting and anonymous game statistics | Our legitimate interest, and that of the developers using the engine, in knowing whether things work, balanced against your privacy by using no name, no email, no advertising ID, and no cookies |
| Blocking abuse, fraud, and spam, and reviewing submissions | Our legitimate interest in keeping the service safe and usable |
Who else sees it
We do not sell, rent, or trade your personal information. We do not share it for advertising. The only third parties involved are the companies that run our infrastructure or take payments, acting on our instructions or under their own policies as noted:
| Company | What they do |
|---|---|
| Vercel Inc. | Hosts the website and its servers |
| Supabase Inc. | Runs the database and file storage that hold accounts, saves, uploads, and records |
| Resend (Plus Five Five, Inc.) | Delivers account emails such as confirmations and password resets |
| Stripe, Inc. | Takes payments on our website, and runs onboarding and payouts for creators who withdraw earnings |
| Sold through Link, LLC (Link, part of Stripe) | Sells WristForge Pro and website purchases as the merchant of record: runs checkout, collects tax, and handles billing support |
| Google LLC (Google Play) | Distributes our apps and processes coin purchases made in them. We confirm a purchase with Google using its purchase token. |
Other players see what you choose to make public: your display name on a leaderboard, your creator name on things you publish, and your name to a friend you have accepted. Developers who use WristForge see anonymous statistics for their own games, and sales and earnings for their own items, but never your email address.
We may also disclose information if the law requires it, or to protect our rights or someone's safety.
Where your data is held
We are based in the United States and our providers process data there. If you are in the UK or EEA, your information is transferred outside your country. Our providers rely on Standard Contractual Clauses and the EU-US Data Privacy Framework for these transfers.
How long we keep it
- Waitlist emails: until you ask us to remove you, or until we have finished the launch announcements the list exists for.
- Account data: for as long as your account exists. When you delete your account, your profile, sign-in, wallet and coin balance, likes, cloud saves, scores, friend links, tokens, and uploaded projects are deleted. Download records are kept as anonymous counts, with your account removed from them.
- Financial and legal records: records of payouts, creator earnings, and completed sales are kept with your account reference removed, for as long as tax and accounting law requires. The record that you accepted an agreement, including the email address you used, is kept as proof of the terms you agreed to.
- Anonymous game statistics: kept for the developer of the game. They are not linked to an account, so they are not removed when an account is deleted.
- Website visit records: 12 months, then deleted.
Deleting your account and data
You can delete your account yourself. Sign in, open your account page, and choose the option to close your account. This takes effect immediately, cancels any active engine subscription, takes down any watch faces you published, and deletes the data listed under "How long we keep it". Any coin balance is forfeited, since coins have no cash value.
If you cannot sign in, or you want us to delete something without closing your account, email support@stonegolemstudio.com from the address on your account and we will do it. If you only used a game anonymously and never made an account, there is no personal data to delete; email us the game name if you would like its anonymous statistics removed as far as we can identify them.
Your rights
Wherever you live, you can email us at support@stonegolemstudio.com and ask us to show you what we hold, correct it, or delete it. We will respond within 30 days.
If you are in the UK or EEA
Under the UK GDPR and the EU GDPR you have the right to access your data, to have it corrected, to have it erased, to restrict how we use it, to receive a copy in a portable format, to object to processing based on legitimate interests, and to withdraw consent at any time. Withdrawing consent does not affect anything done before you withdrew it.
You also have the right to complain to your national data protection authority. In the UK that is the Information Commissioner's Office.
If you are in California or another US state with a privacy law
Under the CCPA as amended by the CPRA, and similar laws in other states, you have the right to know what personal information we collect and why, to request deletion, to request correction, and not to be discriminated against for exercising those rights.
We do not sell personal information, and we do not share it for cross-context behavioural advertising, as those terms are defined in those laws. There is therefore nothing to opt out of.
Children
WristForge accounts are not intended for children, and our apps are not directed at children under 13. You must be at least 16 years old to create an account or join the waitlist. We do not knowingly collect personal information from anyone younger. Games and watch faces that do not use an account collect only the anonymous play statistics described above. If you believe a child has given us their information, email us and we will delete it.
How we protect it
- All traffic to our site, apps, and servers is encrypted in transit.
- Passwords and sign-in tokens are stored as cryptographic hashes and are never visible to us.
- Database access is restricted at the database itself, so one account cannot read another's data even if the application had a bug.
- Payment and payout details are held by Stripe and Google, not by us.
- Administrative credentials are held on the server and are never sent to your browser or your device.
No system is perfectly secure, and we cannot promise otherwise. If a breach affects you we will tell you and the relevant authority as the law requires.
Changes to this policy
We will update this page when what we do changes, and change the date at the top. If a change materially affects you and we hold your email address, we will email you.
Contact
Questions, requests, or complaints: support@stonegolemstudio.com.