Skip to main content
CurfluffleGRUNTS
Skip to content
Curfluffle

Security

Last updated: August 23, 2026

Your game is your IP. Curfluffle is built so the work you create stays yours and stays private. This page is a plain-language summary of how we handle it; email curflufflehq@gmail.com with anything deeper.

Never trained on your game

Your prompts, assets, and designs are never used to train AI models. Inputs you submit are used only to produce the output you asked for.

Private by default

Projects and drafts are scoped to your account. During the beta your studio data is stored in your browser, namespaced to your user id, so it isn't shared with other users. Team sharing is opt-in.

Encryption & access

  • Traffic is encrypted in transit (HTTPS/TLS).
  • Authentication is handled by Clerk; the studio requires sign-in.
  • The public API is gated by a server-side key and is server-to-server only.

On the roadmap

As we move out of beta we're adding a hosted database with encryption at rest, isolated storage for enterprise assets and prompts, SSO, configurable data-retention SLAs, and are pursuing SOC 2. These are in progress, not yet certified — we'll say so plainly here as each lands.

Subprocessors

We use a small set of trusted providers to run the service:

  • Clerk — authentication.
  • Vercel — hosting + delivery.
  • AI model providers (e.g. Anthropic) — only the inputs you submit for a generation, to produce that output.
  • Solana / Metaplex — only when you choose to mint an NFT drop.

We'll keep this list current as the stack evolves (a hosted database lands as we leave beta).

What we log

Standard operational + security logs (request metadata, errors) needed to run and protect the service. Runtime errors are reported for reliability; we don't log your generated content for analytics.

Data retention & deletion

  • Beta studio data lives in your browser — clearing site data removes it; export first.
  • Account data is retained while your account is active.
  • To delete your account + the data we hold, email curflufflehq@gmail.com and we'll action it.

Your control

You own everything you create and can export it at any time. You can delete your account and the account data we hold on request.

Report an issue

Found a vulnerability? Please email curflufflehq@gmail.com — we appreciate responsible disclosure and will respond quickly.