This Privacy Policy explains how DevGhouse ("we", "us") collects, uses, shares, and protects personal information across every DevGhouse app and subdomain (app, marketplace, weddings, events, games, websites, crypto, courses, docs, and the marketing site). All of these run on one shared backend and one account, so this single policy covers them all.
1. Information We Collect
Depending on which features you use, we may collect:
- Account information: name, username, email address, password (stored hashed), and profile details you provide.
- OAuth & connected-account data: information from providers you authorize (GitHub, Google, Twitter/X, Phantom wallet, and others).
- Content you upload or generate: files, code, images, videos, documents, prompts, and other materials.
- Biometric data (only if you use those features): voice recordings and voiceprints used for voice cloning and text-to-speech, and facial images used for face swap, lip-sync, and avatar generation. See Section 4.
- Communications content (only if you connect an account): when you connect an email inbox (Gmail, Outlook, IMAP) or messaging account (Twitter/X, Instagram, WhatsApp, Telegram) so the platform can read, summarize, or act on messages on your behalf, we process the contents of those communications, including data about the third parties you correspond with. See Section 5.
- Usage data: IP address, browser and device type, pages visited, features used, and timestamps.
- Transaction & wallet data: purchase history, credit balances, connected wallet addresses, and on-chain transactions. We are crypto-only and use no card processor.
- User-created games & wagering activity (only if you use the Games module): the game logic you submit for a user-created game, its review/approval status, match history, and, for wagered matches, the on-chain wager and revenue-ledger records tied to your account or a game you created.
- Approximate location derived from your IP address.
2. How We Use Your Information
- Operate and maintain the platform and the specific features you invoke
- Process transactions, credits, marketplace escrow, and payouts
- Display your public profile and listed products to other users
- Send you account, transaction, and security communications
- Detect and prevent fraud, abuse, and security incidents
- Comply with legal obligations
We do not use your content, uploads, prompts, biometric data, or connected-communications data to train our own machine-learning models, and we do not authorize our AI subprocessors to train their models on it. We process it only to deliver the feature you requested.
3. AI Processing
Many features send your content to third-party AI providers to generate a result (for example image, video, audio, 3D, text, and code generation). Providers we use include OpenAI, Anthropic, xAI (Grok), ElevenLabs, and ModelsLab, among others. When you use one of these features, the input you supply is transmitted to the relevant provider and processed under their terms. We select providers that do not train on submitted data by default and do not knowingly send them content for training.
4. Biometric Data
Some creative tools process biometric identifiers. Voice cloning and text-to-speech create and use a voiceprint from audio you provide; face swap, lip-sync, and avatar tools process facial images. We collect and use this data only when you actively choose to use those features and only to produce the output you request.
When you use Clone Reference Vault, your original face and body references and finished voice sample are stored as private files and served through expiring signed links. A phone-capture link expires after 15 minutes by default and grants access only to that one draft. We send photos to OpenAI for automated blur, lighting, framing, duplicate, and face-count guidance, and use ModelsLab when you request Clone face, voice, image, or video generation. Automated quality checks can be wrong and are not identity verification; your consent and self-attestation are still required.
We do not sell or lease biometric data, and we do not use it to train models. You can delete your saved voices, facial inputs, and generated biometric outputs at any time from your account, and we delete the underlying biometric data when you delete the item, when you close your account, or when it is no longer needed for the purpose you provided it, whichever comes first. If you are in a jurisdiction with a biometric-privacy law (for example Illinois, Texas, or Washington), using these features constitutes your consent to this processing and retention.
A Clone Reference Vault draft is retained until you delete it. A completed vault is retained while you keep its linked Clone so the references can be reused. Removing a vault photo deletes that private original and updates the linked Clone; at least one accepted identity photo must remain. Deleting a completed vault requires confirmation because it also deletes the linked Clone, its saved voice record, and the vault's raw photo and voice files. Generated outputs are separate assets and are not automatically deleted with the vault. During the initial production beta, vault access is limited to an explicit account allowlist and is not publicly listed.
5. Connected Accounts & Communications
If you connect an email or messaging account, you authorize us to access and process its contents to provide the features you enabled (such as reading, summarizing, drafting, or sending on your behalf). We access only what those features require, use it only to provide them to you, do not use it for advertising, and do not sell it. Data obtained from Google APIs is used in compliance with the Google API Services User Data Policy, including its Limited Use requirements. You can disconnect any account at any time from your settings, which stops further access.
5.1 Google Ads
If you connect Google Ads, we ask Google for the scope https://www.googleapis.com/auth/adwords, together with basic sign-in information (your Google email address and name). That scope lets DevGhouse read and manage the Google Ads accounts you pick.
What we read: the name and ID of the connected account, its campaigns, ad groups, ads, keywords, search terms, budgets, bids, and performance metrics such as clicks, impressions, cost and conversions. Why: only to show them to you, to let you (or an AI helper you instruct) create and change campaigns, and to report results back to you. We do not use this data for advertising, do not sell it, and do not use it to train generalized AI models.
What we change: only what you or an AI helper acting for you asks for. When an AI helper changes anything that can spend money (a budget or bid change, turning a campaign on), the change is refused until it is explicitly confirmed, and the campaigns, ad groups, ads and keywords it creates start paused.
Storage: the Google sign-in tokens are encrypted at rest. We keep the connected account's name and ID, and the IDs of the campaigns and ads we publish for you. Other Google Ads data is read from Google when you open a page or an AI helper asks for it, and is not kept in a separate store (when an AI helper reads it, it is processed as described in Section 3). We keep the tokens and connection until you disconnect or delete your account. Campaign data you choose to import into a website is kept with that website until you delete it.
Deletion and revoking: disconnect Google Ads in Marketing or on a website's Ads tab and we delete the stored tokens and connection immediately. Deleting your account also deletes your Google Ads connection. You can also remove DevGhouse at any time in your Google Account permissions. A connection made by a realm belongs to that realm and is removed when a realm owner or admin disconnects it.
DevGhouse's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Questions: [email protected].
6. Content Storage
Your uploaded and generated content is stored on our servers and third-party cloud infrastructure (including Cloudflare R2 and CDN services). We take reasonable measures to secure stored content, but we do not guarantee the security or permanence of any stored data. You are responsible for maintaining your own backups. Paid digital products are made accessible to buyers only upon completed payment.
7. How We Share Information
We share information with:
- Other users: your public profile, listings, and seller information are visible to other users by design.
- Service providers (subprocessors) that help us operate the platform, by category: cloud hosting & CDN (Cloudflare), AI model providers (OpenAI, Anthropic, xAI, ElevenLabs, ModelsLab), payment & on-ramp providers (Privy, MoonPay, Coinbase), blockchain infrastructure (Solana and EVM RPC providers, Jupiter, Li.Fi), analytics & SEO tools (DataForSEO, GTmetrix), market-data feeds (Binance), and integration providers you connect (Google, GitHub, Twitter/X, Meta, Telegram, Vercel, Figma, Notion, and similar). We provide each only the data needed to perform its function.
- Legal requirements: when required by law, subpoena, or legal process.
- Business transfers: in connection with a merger, acquisition, or sale of assets.
We do not sell your personal information, and we do not share it for cross-context behavioral advertising.
8. Crypto & Payments
The platform runs on crypto rails with no card processor. If you create a platform wallet, the private key is encrypted at rest and its plaintext never leaves the backend. If you connect a self-custody wallet (such as Phantom) or a Privy wallet, custody stays with you or the custodian respectively. Blockchain transactions are recorded on public ledgers outside our control and cannot be deleted by us.
9. Data Retention
We retain personal information for as long as your account is active or as needed to provide the services you use. When you delete an item or your account, we delete the associated personal data, except where we must retain limited records to comply with law or for legitimate business purposes such as fraud prevention and dispute resolution. Biometric data follows the shorter schedule in Section 4.
Revenue-ledger records for wagered matches (including a creator's rake-share entries) are retained under this same exception for financial-audit and dispute-resolution purposes even after a user-created game is removed or an account is closed.
10. Your Rights & Choices
Depending on where you live, you may have the right to access, correct, delete, or export your personal information, to object to or restrict certain processing, and to withdraw consent. You can delete your account and connected data from your settings or by contacting us. We do not sell or "share" (as defined by California law) personal information, so no opt-out is required, but you may still exercise the rights above.
California residents (CCPA/CPRA) have the rights to know, delete, correct, and to non-discrimination for exercising them. EEA/UK residents (GDPR): our legal bases are performance of our contract with you, your consent (for biometric data, connected communications, and optional features), our legitimate interests (security and fraud prevention), and legal obligations; where we transfer data internationally we rely on appropriate safeguards such as Standard Contractual Clauses.
To exercise any right, use the controls in your account or email [email protected]. We will verify your identity before acting on a request.
11. Cookies & Tracking
We use cookies and similar technologies for authentication (a session cookie scoped to .devghouse.com so one login works across our subdomains), preferences, and basic analytics. You can control cookies through your browser; disabling essential cookies will break sign-in.
12. Security
We implement reasonable technical and organizational measures to protect your data, including encryption of sensitive secrets at rest and tenant isolation between accounts and realms. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security. You are responsible for keeping your account credentials and any API or wallet keys you generate secure.
13. Children
The platform is not intended for and is not directed to individuals under 18 years of age, and we do not knowingly collect personal information from anyone under 18. If we learn we have collected such information, we will delete it.
14. International Users
We operate from and store data in facilities that may be outside your country. By using the platform you understand your information may be transferred to and processed in jurisdictions with different data-protection laws, subject to the safeguards described in Section 10.
15. Changes to This Policy
We may update this Privacy Policy from time to time. For material changes we will take reasonable steps to notify you, and we will not apply materially different uses to previously collected data without a lawful basis or your consent. The "Last updated" date above reflects the current version.
16. Contact
For privacy questions or to exercise your rights, contact us at [email protected].