Privacy Policy

1. Who We Are and What This Covers

Wigley Studios LLC ("we," "our," or "us") runs wigleystudios.com and the products sold on it, including Chiave, PromptUI, PicSift, PostPilot, ShipKit, the UI Kit Generator, UI Kit Packs, the Cold Ledger games, Developer Labs, the free resources and Play games, and our professional services (collectively, the "Services"). This policy explains what we collect, why, who it goes to, how long we keep it, and the choices you have. We are the controller of this information. Contact: support@wigleystudios.com, or Wigley Studios LLC, 8735 Dunwoody Place #12345, Atlanta, GA 30350, USA.

Some products have their own privacy policies, which govern them: each of our Shopify apps, Summa for monday.com and The Lot. Cookies, browser storage and advertising tags are covered in detail in our Cookie & Storage Policy.

2. Information We Collect

2.1 Other Things You Send Us

• Professional services: the quote form (name, email, company, project description, tech stack, repository address, budget, timing, how you heard of us, and your IP address), files you upload to your project (up to 100 MB each), portal messages, and the payment requests and deliverables for your project. Large invoices can be paid by bank transfer, which Stripe verifies
• Reviews: your rating, title, review, display name and, for games, how you played. We also keep your email, account and the purchase the review is linked to, which are never shown, and we're emailed each new review
• Newsletter: your email, where you signed up, your confirmation and the IP address you signed up from
• ShipKit architecture overview: the email you give the form on the ShipKit page, used to send you the PDF once and kept as a record of the request; nothing else is sent to it
• Acquisition and contact enquiries: what you write and the details you give, plus your IP address, and any email you send us
• Play games: no account needed. We store each answer, whether it solved the case and how long it took. If you use a reward coupon, we store a keyed hash of the email you paid with and the payment reference, so a coupon is used once

3. How We Use Your Information

3.1 Review Requests

After you buy, we may email you up to three times asking for a review: about 2 hours, 7 days and 30 days after the purchase (48 hours, 7 days and 30 days for party games; for services, counted from delivery). Each email has a link to stop them, and they stop once you've left a review.

3.2 Marketing Emails

Our welcome email and product tips carry an unsubscribe link, and one click stops them. We don't send marketing to the addresses of people who have unsubscribed.

4. Who We Share It With

4.1 Service Providers

• Stripe: payments, invoices, refunds and our billing portal. Stripe also uses payment data to prevent fraud, under its own privacy policy
• Hostinger: our web hosting, servers and email (we send from noreply@, hello@, support@ and admin@wigleystudios.com)
• Anthropic: PromptUI sends your prompt and design choices to Anthropic's API to generate code. Your email and account are not sent
• OpenRouter, which routes to xAI: PostPilot sends your brand description, voice notes and topics to generate posts
• X (Twitter): if you connect your X account in PostPilot, the posts you approve are published through it
• Google: Google sign-in (if you choose it), Google Fonts, and the advertising and analytics tags below
• country.is: on your first visit, your browser asks this service which country you're in, so we know whether to show the cookie banner; it receives your IP address
• Cloudflare and jsDelivr: deliver page libraries and icons; Cloudflare Turnstile checks the Chiave trial sign-up for bots

Our AI providers process this data under their API terms, which do not allow them to train their models on it. We don't use your prompts or outputs to train AI models either.

4.2 Advertising and Analytics

We use Google Ads, Google Analytics and the TikTok pixel to measure visits and which ads lead to sign-ups and purchases. Visitors from the EU, the EEA, the UK and Switzerland are asked first and nothing loads unless they accept. Elsewhere they load by default, and choosing Decline under Cookie Settings in the footer turns them off on every page after that. A browser that sends Global Privacy Control is treated as a Decline wherever you are. When you're signed in, Google's tag also receives your email address (which it hashes) and name, so that a purchase can be matched to the ad that led to it. If you arrived from a Google ad and haven't declined, our server may also send Google that ad's click ID with a SHA-256 hash of your email when you sign up or buy. Our four sites (wigleystudios.com, nupalz.com, innerhavenai.com and connectintently.com) use Google's cross-domain linking, so Google can recognise the same visitor moving between them. Secret link codes, such as download and password-reset tokens, are removed from page addresses before they reach Google, and TikTok is not loaded on those pages. Full detail is in the Cookie & Storage Policy.

4.3 Legal Requirements

We may disclose information when required by law or to:

• Comply with legal processes and government requests
• Enforce our Terms of Service
• Protect our rights, property, or safety
• Prevent fraud or abuse
• Protect users' safety

4.4 Business Transfers

If our business or a product is sold or merged, the information that goes with it may transfer to the new owner, who must keep protecting it under this policy. We'll tell you before that happens.

5. How We Protect Your Data

6. Your Choices and Rights

Wherever you live, you can:

6.1 Exercising Your Rights

Use the dashboard tools above, or email support@wigleystudios.com from the address on your account (we may ask you to confirm it's you). If you bought without an account, or signed in with Google and have no password, email us and we'll handle it. We reply within 30 days.

Deleting your account removes it, with your purchases, licences, product data, reviews, uploads and history, from our live systems. We keep a minimal record that the deletion happened (a one-way hash of your email, a masked form of it, and the IP address and browser of the request). Copies in backups expire within 30 days, and Stripe keeps its own payment records under its policy.

7. How Long We Keep It

• Your account, purchases and what you create: while your account exists, until you delete it or ask us to
• Reviews: until you ask us to take one down, or delete your account
• Payment records: Stripe keeps its own records of your payments under its policy
• Application logs: about 7 days
• Web-server logs (IP address, browser and the page asked for): 12 months. Each month's log is deleted in the clean-up on the first of the month after it passes 12 months, so a line can be up to 13 months old before it goes
• Our own site analytics (the same details per page view, plus how you arrived): 25 months
• Account and security activity (sign-ins and failed sign-ins, registrations, password-reset requests and licence checks from our desktop apps, with IP address): 12 months
• The Lot bug reports and emails in our mailboxes: these don't yet have a fixed deletion schedule, and we delete them on request
• Backups: up to 7 days on our server and up to 30 days in the encrypted off-site copy, so deleted data can remain there until those copies expire

8. International Data Transfers

We're based in the United States and your information is processed there, and in the countries where the providers in section 4 operate. Where EU or UK law requires a safeguard for that transfer, we rely on the standard contractual clauses in those providers' data processing terms.

9. Children's Privacy

Our Services are not directed to children under 13, and we don't knowingly collect personal information from them. We don't ask for your age when you sign up or buy. If you believe a child under 13 has given us personal information, contact support@wigleystudios.com and we'll delete it.

If you're under 18, please use our Services with a parent's or guardian's permission. Some games are for older players, and each says so on its page.

10. Product-Specific Practices

10.1 PicSift (Desktop Application)

• Local processing: all image analysis and deduplication happens on your computer; your photos and files are never uploaded
• Licence checks: activation sends your licence key, an identifier derived from your computer's hardware, and your computer's name; the check repeated about once a week sends the licence key and that identifier
• No usage analytics: PicSift doesn't report how you use it

10.2 Chiave (Hosted License Management)

• Your account: when you start a trial or subscribe, Chiave receives your account name and admin email
• Tenant isolation: each customer's licence data is kept separate, and tenant secrets are stored encrypted
• Your customers' data: you control what you store in Chiave; we access it only to run the service
• Trials: a trial that isn't upgraded is deleted, with its data, 51 days after it ends

10.3 PromptUI and PostPilot

• Where prompts go: PromptUI to Anthropic, PostPilot to xAI through OpenRouter (section 4.1)
• What we keep: your prompts, generated output and PromptUI chat history stay in your account until you delete it
• No training: we don't train AI models on them, and our providers' API terms don't allow it

10.4 UI Kit Generator, UI Kit Packs and ShipKit

• The UI Kit Generator builds kits on our server without sending your settings to an AI provider, and keeps your generated kits in your account
• Packs and ShipKit are delivered by private download link; the code you download doesn't contact us

10.5 Developer Labs and Free Resources

• Free resources: the free tools process what you paste in your browser. The four store checkers send the store address you enter to our server, which scans that public storefront
• Developer Labs: the tools work without an account. If you sign in, you can save projects on our server (with version history), share them by link (anyone with the link can view a shared project) and copy or download your output. Deleting your account deletes your projects

10.6 The Lot (Desktop Application)

The Lot is a Windows application that mirrors your own logged-in AI tools onto screens inside a 3D world, and talks to AI, voice and search services, most of which you set up with your own keys. It has no analytics service and no advertising. Wigley Studios receives two things from it: bug reports you send, and automatic error reports if you switch those on (they're off until you do). It has its own policy, which governs the application: The Lot privacy policy. Its licence terms are at The Lot terms and licence, and its components are credited in the third-party notices.

10.7 Shopify Apps

Each of our Shopify apps has its own privacy policy, saying what it reads from your store, what it stores and what it sends where: Cited, Payout Guard, AccessGuard, Merchant Guard, Old Glory, AgeProof and CheckoutProof.

10.8 Cold Ledger Digital Editions

• What a copy holds: a digital edition is played in your browser, and your copy of the case keeps its progress on our server: which hints were opened, the worksheet and notes typed into it, the answers once committed, the score you give yourselves, and when the copy was first opened. It holds no name or email address. Anyone with the copy's link can see and change that progress, which is how the people you play with share it, so share the link only with them
• Bought on the site: the copy is linked to your purchase. Deleting your account deletes it, and your data download includes its progress (without the link's key)
• Bought on Etsy: you open your copy with your Etsy order number. We ask Etsy, through its API, whether that number is a paid order for a digital edition in our shop, and for about three months afterwards whether the order has since been canceled or refunded, which closes the copy. We keep only the order number, linked to your copy, and the date a closed copy was closed. Nothing else from the order is stored, and none of it is used for marketing. To have an Etsy copy deleted, write to us with its order number
• On your device: the page remembers, in your browser, which exhibits you have read, the tab you were on and an answer draft you have not committed yet
• Rooms (The Hundredth Episode): the host's copy starts rooms, one per night. A room keeps its join code, which case of the four it is playing (never shown to anyone), its phase and clock, and each player's chosen display name, their character, their vote and when their phone last checked in. Players give a display name and nothing else, and are not asked to buy, sign in or give an email address; the player's link opens only their own seat. Rooms are deleted sixty days after they are made or a fortnight after their night ends, whichever is first, and with the host's account. The player's phone keeps, in its browser, its own link and private notes typed on it

11. US State Privacy Rights

If you live in California or another US state with a privacy law, you can ask to know what personal information we hold about you and how we use it, to correct it, to delete it, and not to be treated differently for asking. The categories we collect are listed in section 2 (identifiers such as your name, email and IP address; commercial information about your purchases; internet activity on our sites; an approximate location from your IP address; and professional details you choose to give), for the purposes in section 3, shared with the providers in section 4.

We don't sell personal information for money. Some state laws treat the Google and TikTok advertising tags as "sharing" personal information for targeted advertising. To opt out, choose Decline under Cookie Settings in the footer, or turn on Global Privacy Control in your browser (we honour it automatically), or email us. To make any other request, email support@wigleystudios.com.

12. European and UK Privacy Rights (GDPR)

If you are in the European Economic Area, the United Kingdom or Switzerland, data protection law gives you the rights in section 6, and the following apply.

12.1 Legal Bases for Processing

• Contract: to give you your account and what you bought (accounts, delivery, licences, payments, support)
• Legitimate interests: security and fraud prevention, our own site analytics, product improvement, and review requests after a purchase. We weigh these against your rights, and you can object
• Consent: the advertising and analytics tags (you're asked first), and marketing emails where the law requires consent
• Legal obligation: tax and accounting records, and responding to lawful requests

12.2 Your GDPR Rights

In addition to the rights in section 6, you can:

• Object: to processing based on legitimate interests, or to direct marketing
• Withdraw consent: at any time, using Cookie Settings or the unsubscribe links
• Restrict processing: in certain circumstances
• Complain: to your local data protection authority. A list of EU authorities is at edpb.europa.eu; in the UK it is the ICO

We will respond within one month of receiving your request. That period may be extended by two further months where necessary, taking into account the complexity and number of requests.

13. Changes to This Privacy Policy

We update this policy when our practices change. For material changes we'll let you know by:

• Email notification: sent to registered users' email addresses
• Website notice: a notice on wigleystudios.com
• In-product alert: within the products it affects

Material changes take effect 30 days after notice. The "Last Updated" date at the top of this page shows when it was last revised.