Privacy Policy
Last updated:
MiraDock is a place where Creators build Games with an AI agent over MCP and Players play them in the browser. This page lists the information MiraDock keeps in its own database, the service providers that process it, and what MiraDock deliberately does not store.
What MiraDock stores
Table names are included so this list can be checked against the service's database schema.
Account and profile
Your email address and sign-in credentials (passwords are stored by Supabase Auth as hashes; Google sign-in stores the linked Google identity). Your display name, bio, onboarding progress and account status, including any suspension and its reason. If you publish a public profile: its URL, headline, bio, website and social handles. The Creators you follow, the Game genres you pick, and genre preferences calculated from what you play.
Tables: auth.users (Supabase Auth), profiles, public_profiles, follows, onboarding_funnel_events, player_genre_choices, player_genre_affinity
Games you create
Each Game's title, description, cover image address, genre tags, status and settings, and the Game's HTML file with its version history. Store items and prices you define, leaderboard definitions, and aggregate per-Game statistics such as plays, unique Players, session length and likes.
Tables: games, game_skus, game_leaderboards, game_metrics, admin_game_metric_history
Playing Games
When a Game starts and ends, how long it ran and whether it loaded, linked to your account or, if you are not signed in, to a random guest identifier. First and last play time and play count per Game. Save data a Game writes for you, scores you submit to leaderboards, and Games you like.
Tables: play_sessions, game_play_loads, game_players, player_saves, leaderboard_entries, likes
Multiplayer rooms
Room codes, hosts and membership, including the display name shown to other Players in the room. When Players in a room connect directly to each other, each Player's device can see the others' network addresses; MiraDock does not store them. Messages MiraDock relays between Players are kept only while the room is open (at most the latest 200) and are deleted when the room closes; idle rooms close after 30 minutes.
Tables: game_rooms, game_room_members, game_room_messages
Balance, Store purchases and tips
Your balance and whether it is frozen, each top-up's amount and status with its Stripe Checkout Session and PaymentIntent IDs, refund and dispute state, what you own in each Game, and an append-only ledger of every purchase, tip, refund and fee, including which Game each tip was for and how it was split between the Creator and MiraDock. Your Stripe customer ID and the status of any earlier paid subscription. Stripe event IDs and processing status. MiraDock does not store card numbers.
Tables: wallets, wallet_topups, economy_topup_events, economy_topup_disputes, entitlements, ledger_entries, platform_fees, user_subscriptions, stripe_webhook_events, billing_audit_log, economy_reconcile_runs
Creator payouts
Your Stripe Connect account ID, whether it can accept charges and receive payouts, the names of any onboarding requirements Stripe reports as outstanding, and any payout hold. Pending and available earnings, and each payout's amount, status and Stripe transfer ID. Bank account, tax and identity details you give during onboarding are collected and held by Stripe, not by MiraDock.
Tables: creator_payout_accounts, creator_balances, payouts
Agent access and MCP
Agent access tokens are stored as one-way hashes with a short display prefix, name, scopes and last-used time; OAuth client secrets and tokens are stored as hashes. Agent sign-up and claim records, including the email address you ask to claim with and a hash of the one-time code. A per-request log of MCP calls: tool name, success, error code, latency, the token and account used, and a keyed hash of the requesting network address, deleted after 30 days. Hourly call counts per tool.
Tables: mcp_auth_tokens, mcp_write_tokens, oauth_clients, oauth_consents, oauth_authorization_codes, oauth_tokens, anonymous_agent_registrations, agent_registration_claims, anonymous_sandbox_write_events, mcp_request_log, mcp_write_request_log, mcp_call_stats
Reports, moderation and audit
Reports and issue reports you file, including the category, text, any related Game or Player, and context such as the page address and, for reports filed from the web form, your browser family and major version, operating system family and device type (the full user-agent string is not kept). An append-only audit log of security, money and moderation actions (IP address and user-agent fields are removed before an entry is stored). Moderation notes, rate-limit overrides, short-lived rate-limit counters keyed by a keyed hash and deleted when their window ends, and the list of administrator email addresses.
Tables: bug_reports, audit_events, admin_audit_log, admin_events, user_rate_limit_overrides, auth_rate_limit_buckets, admin_emails
Aggregate site metrics
Daily page-view counts per page group with no user, device or request identifier, and daily platform totals computed from the tables above.
Tables: daily_page_views, admin_metric_rollups
Content from the earlier version of MiraDock
Accounts created before Games launched may still have workspace content from the earlier product: pages and their version history, search-index chunks, small structured data tables, workspace messages and read markers, access grants, share links (with hashed passwords), activity logs, content reports, and topic interests. This content stays in MiraDock's database until it is removed.
What MiraDock does not store
MiraDock's own tables do not store IP addresses or browser user-agent strings, and they do not store device fingerprints. An issue report you file from the web form records only your browser family and major version, operating system family and device type, so the problem can be reproduced.
Where a network address is needed to prevent abuse or enforce rate limits, it is reduced to a keyed one-way hash (HMAC-SHA256 with a secret server key) before it is written; IPv6 addresses are first shortened to their /64 network. Each use (rate limits, MCP request logs, agent sign-ups) has its own hash, so the tables cannot be joined on it. These hashes are held for at most 30 days: MCP request logs are deleted after 30 days, rate-limit counters are deleted when their window ends, and agent sign-up records drop the hash once the sign-up is claimed or expires. A daily job removes them. Some rate limits are kept only in server memory. The hashes are pseudonymous rather than anonymous: someone holding the server key who already knows an address could check whether it matches.
Page-view counting reads the user-agent only to skip known bots and keeps no identifier. MiraDock does not use advertising or third-party analytics trackers, and it does not store card numbers or bank account details.
Cookies
MiraDock sets sign-in session cookies through Supabase Auth, a random guest identifier cookie so Players who are not signed in get a consistent Games feed, and a short notice cookie when a suspended account is signed out.
What others can see
Published Games, their Creator's display name, and any public profile you publish are visible to everyone. Leaderboards and multiplayer rooms show your display name to other Players of that Game. A Game receives a player identifier that is unique to that Game and your display name, not your email address. Creators see aggregate statistics about their Games.
How the information is used
To run your account and Games, save progress, rank scores and host rooms; to process top-ups, purchases, tips, refunds and Creator payouts; to recommend Games; to investigate reports, enforce the Terms of Service and prevent abuse; and to keep an audit trail of money and moderation actions. See the Balance terms for how balances and payouts work.
Service providers
These providers process MiraDock data on its behalf. MiraDock's servers do not send your information to any other third party.
- Supabase — Hosts MiraDock's database and runs sign-in (Supabase Auth). Every table listed above is stored with Supabase, and Supabase Auth sends account emails such as email verification and password reset.
- Vercel — Hosts the MiraDock website and API and runs its scheduled jobs. As the web host, Vercel receives each request, including its IP address and headers, in order to serve it.
- Stripe — Processes balance top-ups through Stripe Checkout (card details go to Stripe, never to MiraDock), handles refunds and card disputes on top-ups, and runs Creator payouts through Stripe Connect Express accounts. Stripe collects and holds the identity, tax and bank details a Creator gives during onboarding, and the card and billing details a Player gives at checkout, under its own privacy policy. MiraDock receives only the IDs and statuses listed above.
- Resend — Sends the one-time code email when you claim an agent registration with an email address.
- Google — Only if you choose Sign in with Google: Google shares your email address and basic profile with MiraDock through Supabase Auth.
- OpenAI — Only when the operator has configured it, and only for workspace content from the earlier version of MiraDock: page text is sent to OpenAI to build search embeddings. Games, play data and payment data are not sent.
Retention
Ledger entries and audit events are append-only and are kept to account for money movements and administrative actions. Unclaimed anonymous agent sign-ups expire after 14 days by default and are cleaned up by a scheduled job. Hashes of network addresses are kept for at most 30 days, as described above. Room messages are deleted when a room closes. Game reports are deleted with the Game or the reporting account. Other records are kept while your account exists.
Your rights
You can ask MiraDock for a copy of the information it holds about you, ask it to correct something that is wrong, or ask it to delete your account and data. You can edit your public profile yourself in your settings. Some records are kept after a deletion request where MiraDock needs them to account for money or to meet legal obligations: the money ledger and audit log are append-only, and Stripe keeps its own payment and payout records. Depending on where you live, you may have further rights, such as to object to or restrict processing or to complain to a data protection authority.
MiraDock does not sell your information or share it for advertising.
Contact
To make a request or ask a question about your information, email support@miradock.com from the address on your account. MiraDock may need to confirm it is you before acting on a request.