Privacy Policy — The Lot

1. The short version

The Lot is a Windows application published by Wigley Studios LLC. It puts the software you already use — your logged-in Claude, ChatGPT, Cursor and anything else you name — onto screens inside a 3D world, with a secretary who runs your instructions on them. This policy covers the desktop application and the parts of wigleystudios.com/thelot that serve it.

Wigley Studios receives one thing from The Lot: a report. Usually a bug report you filled in and sent; it can also be an automatic error report, but only if you switched those on — they are off until you do (§5). There is no analytics service, no advertising and no profile of you. Everything else goes to the services in §3, and §3 says which of them are contacted without you asking at that moment.

Every honest description of this app reads a little like a description of malware, because putting your real software inside a game engine requires real access. The rest of this page is that access, itemised, with the limit on each one.

The Lot Privacy Terms Notices

2. What the application does on your computer

All of this happens locally. None of it produces data that reaches Wigley Studios.

Reads other windows' pixels That is the product: your apps, mirrored onto in-world screens. Only windows named in your own config\pinned_apps.json, and the image is handled on the GPU. Nothing is uploaded, ever — not to us, not to anyone.

Hooks three global keys F9 and F10 for push-to-talk, F8 to stand up from a screen. Keystrokes are not logged or recorded. F8 is the only key taken from other applications, because an escape hatch another app can swallow is not an escape hatch.

Captures the microphone Only while F9 or F10 is held down. Audio is transcribed on your machine (see §4) and is not stored or transmitted.

Takes the foreground, moves your mouse, moves your windows Only when you sit down at a screen — that is what sitting down means. Your original window position is restored exactly when you stand up, every failure path hands control back, and F8 always works.

Launches programs Only entries from your own config file. No web page and no AI can reach the launcher. Separately, when you give the secretary a coding job she can start the Claude Code or Cursor command-line agent, if it is installed.

Runs agents that read and write your files The point of an AI workspace. File edits inside the agent's working folder are pre-approved; anything it would have to ask permission for is refused, and refusals are shown rather than swallowed. What those agents send onward is covered in §3.

Can attach a virtual display driver Optional, and the app runs without it. It installs only if you accept the in-game offer, behind one Windows administrator prompt, and uninstalls with one script. It is a third-party, MIT-licensed, Microsoft-signed driver shipped unmodified — see the notices.

Runs a local bridge The world and its Python brain talk over localhost. That connection never leaves your machine and is not reachable from your network.

3. What leaves your machine

The complete list of services the app itself contacts. Four only exist if you set them up; Microsoft (the voice) and Wikipedia (search) need no setup; Wigley Studios receives only reports. Each row says when it is contacted, including the ones that happen without you asking at that moment.

Anthropic The secretary's thinking. Runs on either your own signed-in Claude session or an API key you paste in yourself. What you say to her, and the context she needs to act, goes to Anthropic under your account and Anthropic's privacy policy — not ours. We are not in the middle of it and we do not receive a copy. She also takes a turn unasked: to greet you after half an hour or more away, when a job you gave her finishes, and to write a handoff note at shutdown and at 4 a.m. Coding jobs you give her through Claude Code send your instructions and the files it works on to Anthropic too, and Claude Code may send Anthropic its own usage and error data.

OpenRouter The residents' voices. With an OpenRouter key, they make an unprompted remark every few minutes while the world is open and you are idle, and answer you when you speak to them (F10). Each request carries the character's persona, your name, the time, the office's state and short notes on jobs it finished. OpenRouter passes it to the model's maker (by default xAI, Anthropic and OpenAI), whose policies also apply, along with OpenRouter's privacy policy. Without a key the residents stay quiet, but in this build a line you speak to one with F10, or a request the secretary hands to them, is still sent to OpenRouter, which turns it away for lack of a key.

ElevenLabs A better voice for every character, only if you add a key and switch it on. The text of the lines to be spoken is sent there; if a request fails, that line goes to the Microsoft voice instead. Governed by ElevenLabs' privacy policy.

Microsoft The default voice. The text of every spoken line — the secretary's, the residents' and the first-run tour's — is sent to Microsoft's Edge text-to-speech service. No account, no key. There is currently no setting that turns voice off. Hearing you is not part of this — see §4.

Brave Search Web search, only if you add a Brave Search key to orchestrator\.env yourself. The secretary decides when a search would help and can open a result for you. The search terms go to Brave; the pages themselves are fetched by whichever browser opens them. Governed by Brave's privacy policy.

Wikipedia The search that needs no key. With no Brave key set, or when a Brave request fails, the secretary's searches go to Wikipedia's public API instead, and the answer says which of the two it used. The search terms go to the Wikimedia Foundation under their privacy policy. Nothing is sent unless a search is made.

Wigley Studios Bug reports you send (F11, the pause menu or the crash offer), and automatic error reports if you switched them on. A report that could not be sent stays on your machine and is retried by itself about fifteen seconds after your next launch and every five minutes after that. The F11 form lists every attachment and lets you untick each one and preview the log; it does not display the screenshot, world-state or performance data. Itemised in §5.

Three more, only in particular cases: Cursor, if its command-line agent is installed and you give the secretary a Cursor job; Hugging Face, only if the speech model files are missing from your install; and the web address of any image you place on a media wall, which the app downloads itself. What happens without a fresh request from you: the residents' remarks (OpenRouter, with a key), the secretary's greeting, job check-ins and handoff notes (Anthropic), the voice for all of those (Microsoft or ElevenLabs), automatic error reports you switched on and retries of reports that failed to send (Wigley Studios), and the default web screens, which load when their room is built (below).

A link the app hands to your browser is not a connection the app makes, and is not an eighth host. The menus link to these policy pages; your Pal’s menu can open nupalz.com, the studio’s own site. In each case The Lot asks Windows to open your default browser and stops there — it never contacts those sites itself, and whatever happens next is an ordinary visit governed by that site. (The NuPalz Arcade is different: its screens are in-world browser panes that load nupalz.com pages when you enter it.)

The web screens are a real browser

Some in-world screens are web pages rather than mirrored applications, drawn by an embedded Chromium browser. When you use one it behaves exactly like a browser: it connects to whatever site you open, and that site sets cookies, keeps you signed in, and sees you the way it would in Chrome. Those connections are yours and are governed by the privacy policy of the site you visited. Your in-world browsing profile — cookies, sessions, local storage — is written to %USERPROFILE%\AppData\LocalLow\Wigley Studios\The Lot\Vuplex.WebView on your own disk and never transmitted to us.

A default set of screens ships with the app: claude.ai and chatgpt.com in the work room (two more for the staff), YouTube on the hall TV, and nupalz.com pages in the NuPalz Arcade. They load as soon as their room is built — for the main house, at startup — which is a normal visit to each site. Removing one stops that.

4. Your voice stays here

Speech-to-text runs entirely on your own CPU, using a local faster-whisper model. The model files ship inside the download, so the app has nothing to fetch and does not contact the model host at all in a released build. Audio captured while you hold F9 or F10 is transcribed in memory and discarded; it is not written to disk, and it is not sent anywhere.

One deliberate detail: the model loader is pinned to local files whenever the model is present, because the underlying library otherwise checks the model host for a newer revision on every single load — a network call nobody asked for, against a file already on disk. The host list above is a promise, and that was the one place it could have quietly become untrue.

5. Reports — the one thing we receive

Press F11 in the app, or accept the crash offer after a crash, and you get a form. Nothing is sent until you submit it. The form lists what will be attached, lets you untick any of it, and lets you preview the log. A report contains these fields:

What you wrote — a category, a one-line summary, and an optional longer description.
An email address, only if you type one. It is optional, it is used to reply to you about that report, and it is used for nothing else — no mailing list, ever.
Which build — version, commit and build date.
Where you were — the environment you were in and your position and camera angle in it, so the bug can be walked to.
What the app was doing — input mode, whether the world was idle, frame rate, how long the session had been running, and a small block of context and performance data.
What you were running it on — GPU model, Windows version and screen resolution.
A screenshot, rendered with the screen surfaces deliberately culled, so the contents of your actual applications are not in the picture.
Recent warnings and errors — the app's own log, its last 200 entries (a crash report carries the crashed session's log).
The world state — where objects, screens, residents and lights are, each pinned web screen's starting address and each captured window's program name; never the page a screen is on or a window's title.
Your IP address, recorded with the report and used to rate-limit abuse of the endpoint.

The screenshot, the world state, the performance data and the log are each a tick box, on by default.

There is also a report form on this website, for the case where the in-game one will not open. It reaches the same place, and it sends less: only the category, summary, description and email address you type, the build number if you fill it in, your browser's user agent, platform and screen size, a screenshot only if you attach one yourself, and your IP address for the same rate-limiting reason. A browser cannot see where you were standing, what the app was doing or how it was performing, and that page does not ask the app for any of it. A screenshot you attach there is one you chose and can look at first; unlike the in-game form, nothing culls it for you.

Automatic error reports are off unless you turn them on. First-run setup asks once, with the box unticked, and you can change the answer at any time in the pause menu (“Error reports”). With it on, and only when a session that closed normally logged at least one error, The Lot saves one report as it closes and sends it about fifteen seconds after you next open the app, retrying every five minutes until it goes. It contains the application's own log of up to 200 warnings and errors (press L in the app to read it), the build version, commit and date, your GPU model, Windows version and screen resolution, the name of the environment you were in, what the app was doing when it closed (input mode, whether the world was idle, and how long the session had been running; the frame-rate field is sent empty), and a small block of counts and settings (displays, open panes, memory, fullscreen mode, whether the app had focus, and similar). Our server also records your IP address. Nothing else.

In particular an automatic report does not contain a screenshot, your position in the world, anything you typed, or any of the performance and world data the F11 form offers — and it never contains Windows' own Player.log, which can carry window titles and the addresses of pages you opened. The application's error log is narrower than Player.log, but a warning can still name the address of a page that failed to load, a window's title or a file path on your computer, so press L to read it before you decide. The difference matters because nobody chooses what is on screen at the moment they close a program, which is why this route sends no picture at all.

Reports are stored on our server in a location the web server cannot serve, and are readable only through an authenticated administrative view. They are used to fix the software and for nothing else. They are not sold, not shared, not used for advertising, and not fed to any third party. Each new report is also emailed to our own admin inbox (its summary, category, build, environment, position, your email if you gave one, and the start of the description). There is no automatic deletion yet: we delete reports by hand, and yours on request, and backup copies expire within 30 days.

The screenshot is culled on your machine before it is sent, not on ours. That is the honest version: our server stores what it is handed and does not attempt to verify what is in it. If a report would embarrass you, don't send it — describe the bug in words instead. The form's whole purpose is to let you see that decision before you make it.

6. The download page

The playtest build is behind a password. When you submit it, our server checks the password and records your IP address in its logs, whether the password was right or not; guessing is rate-limited. The web server keeps that log for 12 months (see the site privacy policy, section 7). No account is created, no cookie is set for the download itself, and nothing about your machine is collected.

The rest of wigleystudios.com — including this page — is covered by the site-wide privacy policy and the cookie policy, which describe the site's analytics and your consent controls. The application itself uses none of that.

7. What is stored on your own machine

The app keeps what it remembers in three places on your computer, all of them yours to read, edit or delete. Next to the executable:

config\ Which apps exist and where they sit, which world you are in, where you were standing, your key bindings and preferences. Delete a file to reset that part; it is written fresh on the next launch.

orchestrator\.env Your API keys. Pasted by you, stored in one plain file on your own disk, sent only to the provider each key belongs to. Wigley Studios never receives them and has no mechanism that could.

orchestrator\data\ The secretary's memory of your conversations, so she is not a stranger every morning, plus the residents' histories, the task list, handoff notes, a spending log (model, tokens and cost, no text), voice audio files and logs. Local, and yours to delete.

Screenshots\, Logs\ Your own captures, and diagnostics.

And elsewhere:

AppData\LocalLow\Wigley Studios\The Lot Reports waiting to be sent (with their screenshots), the app's log of recent warnings and errors, Windows' Player.log, the window positions it restores, and the in-world browser's profile (cookies and signed-in sessions). The log rides on an F11 report unless you untick it, and on automatic reports if you switched those on; nothing else here is sent.

The Windows registry Small settings: your answer about error reports, your first-run answers, volumes and the last environment.

%USERPROFILE%\.claude Claude Code's own sign-in, if you use your Claude account for the secretary.

Uninstalling with the installer removes the application and its Logs folder. It deliberately leaves config in place, so an upgrade does not throw away your room, and it also leaves orchestrator\.env (your keys), orchestrator\data, Screenshots, everything in AppData\LocalLow\Wigley Studios\The Lot (including signed-in browser sessions) and the registry settings. To remove everything, delete those too.

8. Your rights, and how to use them

Because the only records we hold are the reports you sent or switched on, exercising your rights is unusually simple: email support@wigleystudios.com and say what you want.

Access — we will send you every report we hold that is linked to you.
Deletion — we will delete them, including screenshots.
Correction — we will fix anything inaccurate.
Objection and restriction — you can tell us to stop using a report at any time.

These apply whether or not the law where you live grants them; the GDPR (where our lawful basis is legitimate interest in fixing the software you are testing, and consent for the optional email address) and the CCPA/CPRA both do. We do not sell or share personal information. We respond within 30 days.

The Lot is not for children. It is a developer tool that installs system-level components and drives your real accounts; it is not directed at anyone under 16, and we do not knowingly collect anything from them. If a report reaches us from a child, tell us and it will be deleted.

9. This is a playtest build

The Lot is pre-release software distributed to a small invited group. Two consequences worth stating plainly:

Behaviour changes between builds. This page carries the build number it was written against, and is updated when the answer changes — not when the wording could be nicer.
If a future build ever adds a host to §3, that is a change to this policy and it will be announced in the release notes and the in-app README, not slipped in. The commitment is specifically that the list stays checkable.

10. Contact

Wigley Studios LLC, 8735 Dunwoody Place #12345, Atlanta, GA 30350, United States — support@wigleystudios.com.

If something in this policy does not match what the application actually does, that is a bug in the policy and it is worth reporting like any other. It will be fixed and the change noted.

The Lot Terms and licence Third-party notices

The Lot — Privacy Policy