Privacy Policy

Last updated: October 8, 2026

Updated Oct 8 2026: how files are stored today and the move to private storage; what deleting removes, including backup copies; GitHub and Resend added to the list of services we use.

Updated Oct 7 2026: wording only (channel → collection, draft → Private).

recursive.eco (the “Service”) is operated by PlayfulProcess LLC, a Delaware limited liability company (“we,” “us,” “our”). This policy explains what we collect, why, who we share it with, and the rights you have. By using the Service you agree to this policy and to our Terms of Service.

What recursive.eco is

recursive.eco is a platform where people create and share grammars — symbolic systems like tarot decks, stories, I Ching books, and interpretation sets — and generate AI illustrations for them.

Information we collect

How we use it

To provide the Service (store and render your grammars, run AI features you initiate, process payments), to secure it (authentication, rate-limiting, abuse prevention), and to communicate with you about your account. Our lawful bases (where the EU/UK GDPR applies) are performance of a contract (running the Service you signed up for), legitimate interests (security and improvement), and consent(any optional communications). We do not sell your personal data, and we do not use your private content to train AI models. We show a few ads for recursive.eco itself to visitors who are not signed in (you can see every one of them); we run no third-party ads and no third-party tracking scripts. To count page views we use our host’s own analytics (Vercel Web Analytics and Speed Insights), which set no cookies and do not identify you.

AI features and your content

When you initiate an AI interaction (chat, agent tool-call, or image generation), the relevant prompt and content are sent to the AI provider that serves that request (below) solely to produce your result. Outputs are AI-generated and may be inaccurate — see the AI disclaimer in our Terms.

How your files are stored (private vs. public)

Today. Most images and audio made or added in the app — images you attach to a chat, AI-generated images, read-aloud (text-to-speech) audio, and files added through an AI agent (MCP) — have been stored on our public file host (Cloudflare R2), including files that belong to your journal or to a Private grammar. Each file has a long, unguessable web address. We do not list or publish these addresses, but anyone who has the exact address of such a file can open it. A small number of files, mostly AI images made by the assistant while editing a Private grammar, are already in private storage.

What is changing. We are moving these files to a private storage bucket that has no public web address. Once that is switched on:

Published and Link grammars. A grammar that is Published, or shared by Link, is viewable by others, so its images and audio are stored on the public file host (this is how others can view, copy, and build on your published work).

Publishing a file makes that file public. If you publish a Private grammar, or put an image from your journal into a grammar that is published, that file moves from private to public storage at that moment. Its recursive.eco link stays the same, so nothing you shared breaks. Files you never publish stay private.

Public files are served from the public file host’s own address. Private files are served only through a recursive.eco link, after the ownership check above.

Sub-processors & third-party services

These providers process data on our behalf under their own terms. Some are located in the United States; if you are in the EU/UK, your data may be transferred there under appropriate safeguards (such as Standard Contractual Clauses or an equivalent framework).

Publishing & licences

When you choose to publish a grammar (share it to a collection or make it public), it is shared under the licence you chose (CC BY‑SA 4.0 unless you picked another). Under the default, Creative Commons Attribution-ShareAlike 4.0 (CC‑BY‑SA 4.0), others may view, copy, adapt, and build on that work, with attribution and under the same licence. You can pick another licence in the grammar editor or when you share it to a collection, and we record the one you chose at that moment.

Because Creative Commons licences are, by their nature, irrevocable, published work (and the images it depends on) may remain available to people who have copied or saved it even if you later delete your account — otherwise their copies would break. Your Private grammars, journal entries, chats, and personal data are never published and are deleted as described below. You can also unpublish a grammar at any time (it leaves the public catalog going forward), and we keep a narrow takedown path for genuine issues such as personal information in a published image or a copyright complaint.

Data retention

We keep your account and content for as long as your account is active. When you delete a grammar, it is removed from the database; its images and audio are removed from storage (those of a published grammar go to a recoverable trash first, so they can be restored if you ask); and its file in our private GitHub backup repository is removed. Earlier saved versions remain in that repository’s history. Neither that history nor the trash is yet cleared on a schedule; you can ask us to clear yours (contact below). If you close your account, or delete your content and keep the account, we delete your private personal data within a reasonable period, including your files in storage and in the backup repository (except limited records — e.g. payment/tax — we must retain to comply with law; the backup history caveat above also applies). Content you published may be retained and re-attributed as described above.

Your rights

You can access, correct, export, or delete your data. Most actions are self-service: edit or delete grammars and journal entries in the app, and rotate or revoke your API token in Account settings. For a full export or account deletion, contact us (below). If the GDPR or a U.S. state privacy law (e.g. CCPA/CPRA) applies to you, you also have the right to object to or restrict certain processing and to lodge a complaint with your local data-protection authority; we do not “sell” or “share” personal information as those laws define it.

Security

Data is stored in Supabase with row-level security so you can only access your own records. All connections use HTTPS. Service credentials are kept server-side. No method of transmission or storage is perfectly secure, but we take reasonable measures to protect your data and will notify affected users and authorities of a qualifying breach as required by law.

Children

The main Service is intended for users aged 13 and older and is not directed to children under 13. A family/“kids” viewing experience is intended to be set up and supervised by a parent or guardian from their own account; it is not designed to collect personal information directly from children. If you believe a child under 13 has provided us personal information without verifiable parental consent, contact us and we will delete it. (See the Terms for more.)

Changes

We may update this policy; we will revise the “Last updated” date and, for material changes, provide notice in the app.

Contact

For privacy questions, data-access, or deletion requests, contact pp@playfulprocess.com(PlayfulProcess LLC). We respond to verified requests within the timeframe required by applicable law.