Last updated: 8 October 2026
This Privacy Policy explains how MB Muzė LT (“we”, “us”, “our”) handles personal data when you use the Maze AI app for iOS (the “App”) and the website mazeai.app (the “Website”). It applies together with our Terms and Conditions.
1. Who we are
The controller of your personal data is:
MB Muzė LT
Company code: 306876836
Chemijos g. 27C-62, LT-51332 Kaunas, Lithuania
Email: info@muze.lt
For any privacy question or request, email us at info@muze.lt.
2. Summary
- No account. You don’t sign up, and the App never asks for your name or email address.
- Your saved games stay on your device. They are not synced to our servers or to iCloud.
- The story is written by third-party AI. Every turn, what you choose or type and the recent story are sent to our server and then to AI providers (section 5). Please don’t type real personal information into your stories.
- We use analytics, crash reporting, advertising and attribution services. They work with device and app identifiers, not your name. Your advertising identifier (IDFA) is only used if you allow tracking when iOS asks.
- You have rights over your data. These include the right to object and the right to complain to the Lithuanian data protection authority (section 10).
3. What data we process
3.1 Data stored only on your device
The following are stored only on your device:
- your games, characters, story history, inventory and settings;
- photos you choose for avatars or scenario covers.
Story narration (text-to-speech) also runs on your device. Deleting a game removes it, and deleting the App removes all of this data.
3.2 Story content sent for AI generation
When you take a turn, the App sends our server:
- the action you chose, or the text you typed;
- the scenario and the most recent turns of the story;
- the story memory: a running summary of places, people and events;
- your character’s name, description, backstory and inventory.
Content is sent the same way when you:
- create a custom scenario (your scenario idea);
- generate a character avatar (the avatar description);
- create a story image (the relevant story context).
Our server passes this content to AI providers (section 5) and returns the result to the App. We don’t save your stories on our servers, apart from the short excerpt in our server logs (section 3.6).
3.3 Identifiers
We and our service providers use these identifiers:
- an anonymous user ID, created by Firebase Authentication when you first open the App;
- the RevenueCat app user ID, used for purchases;
- installation and instance IDs, created by Firebase, PostHog and Sentry;
- the identifier for vendor (IDFV);
- your IP address;
- your advertising identifier (IDFA), only if you allow tracking.
None of these contain your name. They still count as personal data, because they can be used to recognise a device.
3.4 Usage data (analytics)
We record events about how the App is used, such as:
- starting a game, making a choice or finishing the introduction;
- opening the subscription screen, or starting or completing a purchase;
- generating or sharing a story image.
Each event comes with technical details: device model, iOS version, language, App version, and approximate location (country or city) derived from your IP address. Some events include the title of the scenario you’re playing. For a custom scenario, that’s the title you wrote.
3.5 Diagnostics
When the App crashes or hits an error, we receive:
- crash and error reports;
- performance data: device and system state, timings and network request information;
- the game ID, scenario ID and turn number.
When an error is reported to Sentry, a screenshot of your screen at that moment is attached, and it may show story text.
3.6 Server logs
Our server runs on Google Cloud. For each request it records technical logs:
- the time, IP address and request details;
- game and scenario IDs and error messages;
- the first 240 characters of the action you chose or typed.
We use these logs to fix problems and to prevent abuse.
3.7 Purchases
Apple processes all payments, and we never see your payment card details. Through RevenueCat we receive:
- your subscription status, product, price and currency;
- purchase and renewal dates, and whether you’re in a trial;
- transaction IDs.
3.8 Advertising, attribution and cross-promotion
- Rewarded ads. If you don’t have a subscription, you can choose to watch a video ad from Google AdMob in exchange for an in-game reward. AdMob receives device information, your IP address and your interactions with the ad. It also receives your IDFA if you allow tracking.
- Attribution. AppsFlyer, Singular, Meta (Facebook SDK) and Apple (AdServices and SKAdNetwork) help us learn which ads and campaigns bring in new players. Depending on the partner, they receive:
- install and app-open events;
- certain in-app events, such as finishing the tutorial, starting a game (including the scenario title) and purchases;
- device information, your IP address, the IDFV, their own app IDs, and your IDFA if you allow tracking.
- Cross-promotion. If you don’t have a subscription, you may see banners for other apps, provided by Kickstart (kickstart.tools). Kickstart receives device information and data about which banners were shown and tapped.
3.9 Feedback and support
- Feature requests. If you post an idea on the in-app feature board (WishKit), WishKit receives what you write together with your anonymous user ID. Other players can see your posts, so don’t include personal information.
- Support emails. If you email us, we receive your email address and your message. The support email that opens from the App is pre-filled with your RevenueCat app user ID, so we can find your purchase.
3.10 What we don’t collect
In the App we don’t collect:
- your name, email address or phone number (unless you email us);
- your precise location;
- your contacts;
- your payment card details.
Photos you pick stay on your device.
4. Why we use your data and our legal bases
| Purpose | Legal basis (GDPR) |
|---|---|
| Running the game and generating stories, images and scenarios with AI (sections 3.1, 3.2) | Performance of our contract with you (Art. 6(1)(b)) |
| Purchases, subscriptions, restoring purchases and support (sections 3.7, 3.9) | Performance of our contract (Art. 6(1)(b)); legal obligations, such as accounting (Art. 6(1)(c)) |
| Analytics, remote configuration and testing new features (section 3.4) | Our legitimate interest in understanding and improving the App (Art. 6(1)(f)) |
| Crash reports, diagnostics, server logs, security and abuse prevention (sections 3.5, 3.6) | Our legitimate interest in keeping the App working and secure (Art. 6(1)(f)) |
| Rewarded ads and cross-promotion for free users (section 3.8) | Our legitimate interest in funding the free version of the App (Art. 6(1)(f)) |
| Measuring our ad campaigns (section 3.8) | Our legitimate interest in measuring our marketing (Art. 6(1)(f)) |
| Using your IDFA for advertising and measurement | Your consent, given through the iOS tracking prompt (Art. 6(1)(a)) |
| Feature board (section 3.9) | Our legitimate interest in collecting feedback (Art. 6(1)(f)) |
| Meeting legal requirements and handling legal claims | Legal obligation (Art. 6(1)(c)); legitimate interests (Art. 6(1)(f)) |
You can object at any time to processing based on our legitimate interests (section 10). We don’t make decisions about you that have legal or similarly significant effects based solely on automated processing.
5. AI providers
Maze AI’s stories are written by AI models run by third parties. When you play, the content described in section 3.2 is processed as follows:
- Text. Our server sends story requests to OpenRouter (USA), which routes them to AI model providers. We currently use models from DeepSeek as the main model and Google (Gemini) as a backup. We may change models over time and will keep this list up to date.
- Images. Avatar and story images are generated by fal.ai (USA). fal.ai keeps each generated image for up to 1 hour so the App can download it.
- What providers receive. The requests come from our server, not from your device. AI providers therefore receive the story content, but not your IP address, your device identifiers or your name.
- Location. Depending on how OpenRouter routes a request, it may be processed in the United States or in China.
- Training. We don’t use your stories to train AI models. AI providers process requests under their own terms and may keep them for a limited time, for example to monitor for abuse.
- Your part. Don’t type real personal information about yourself or anyone else into your stories, such as full names, addresses, or health or financial details.
AI output is generated automatically, and we don’t review it before you see it. It may be inaccurate or unsuitable. Please report anything inappropriate to info@muze.lt.
6. Who we share data with
We use the service providers below. Most act on our behalf as processors. Apple, Google (AdMob) and Meta may also act as independent controllers under their own privacy policies.
| Provider | What for | What they receive |
|---|---|---|
| Google Firebase and Google Cloud (Authentication, Cloud Functions, Cloud Logging, Firestore, Remote Config, Analytics, Crashlytics) | Our server, anonymous sign-in, logs, App configuration, analytics, crash reports | Identifiers, story content in transit (3.2), server logs (3.6), usage data (3.4), diagnostics (3.5) |
| OpenRouter, DeepSeek, Google (Gemini) | AI story generation | Story content (3.2) |
| fal.ai | AI image generation | Image descriptions based on your character or story |
| PostHog (EU) | Analytics and feature flags | Usage data (3.4), PostHog ID, device information |
| Sentry | Error and performance monitoring | Diagnostics (3.5), including screenshots, installation ID |
| RevenueCat | Managing subscriptions | Purchase data (3.7), app user ID, IDFV, IP address, attribution IDs, IDFA if you allow tracking |
| Google AdMob | Rewarded ads | Device information, IP address, ad interactions, IDFA if you allow tracking |
| AppsFlyer, Singular | Install and campaign attribution | Install and event data, device identifiers, IP address, IDFA if you allow tracking |
| Meta (Facebook SDK) | Measuring Meta ad campaigns | Install and app-open events, device information, IDFA if you allow tracking |
| Apple | Payments, ad attribution (AdServices, SKAdNetwork) | As described in Apple’s privacy policy |
| WishKit | In-app feature board | Your feature requests, anonymous user ID |
| Kickstart | Cross-promotion banners | Device information, banner views and taps |
| Supabase | Hosting icon images | Your IP address when images load |
We may also disclose personal data:
- if the law requires it, or to respond to a valid request from a public authority;
- to establish, exercise or defend legal claims, or to protect the safety of players or others;
- to a buyer or successor if the App or our business is sold, merged or transferred. That party must continue to protect your data in line with this policy.
We don’t sell your personal data for money. Some US state laws treat sharing device identifiers with advertising partners as “selling” or “sharing”. You can limit this by choosing “Ask App Not to Track” and by contacting us.
7. Tracking and your choices
- Tracking prompt. iOS asks whether Maze AI may track you.
- If you allow it, your IDFA is shared with the advertising and attribution partners in section 6 to measure and personalise ads.
- If you choose “Ask App Not to Track”, the App can’t access your IDFA. Partners still receive the other data described above, without the IDFA.
- You can change your choice at any time in Settings > Privacy & Security > Tracking.
- Analytics and crash reporting. The App currently has no in-app switch for these. To object, email us (section 10).
- Feature board. Posting is optional.
8. International transfers
PostHog stores our analytics data in the EU. Our server runs on Google Cloud in the United States. Most of our other providers process data in the United States, and AI requests may be processed in the United States or China (section 5).
When personal data leaves the European Economic Area, we rely on one of two safeguards:
- an adequacy decision of the European Commission, including the EU–US Data Privacy Framework where the recipient is certified;
- otherwise, the European Commission’s Standard Contractual Clauses in our providers’ data processing terms.
You can ask us for more information about these safeguards.
9. How long we keep data
| Data | How long |
|---|---|
| Games and stories on your device | Until you delete them or the App |
| Story content sent for AI generation | Not stored by us after the response is returned, apart from server logs (below). AI providers keep it under their own terms (section 5). |
| Generated images at fal.ai | Up to 1 hour |
| Server logs, including the action excerpt | 30 days |
| Crash and error reports (Crashlytics, Sentry) | Up to 90 days |
| Analytics and attribution data | Kept in pseudonymous form for up to 2 years, then deleted or aggregated |
| Purchase records (RevenueCat) | While your subscription is active, then as long as needed for accounting obligations and legal claims |
| Support emails | Until your request is resolved, then up to 2 years |
| Feature requests | Until you ask us to delete them, or we remove them from the board |
10. Your rights
Under the GDPR you have the right to:
- access your personal data and get a copy of it;
- rectify inaccurate data;
- erase your data;
- restrict how we use it;
- data portability;
- object to processing based on our legitimate interests, such as analytics, ads and attribution;
- withdraw your consent at any time, for example in the iOS tracking settings. Withdrawing consent doesn’t affect processing that happened before.
To use any of these rights, email info@muze.lt. You don’t have an account, so we can only find your data if you send your app user ID. The support email that opens from the App includes it automatically. We’ll reply within one month, free of charge.
To delete the data stored on your device, delete the App. Deleting the App doesn’t cancel a subscription. To cancel, go to your Apple ID subscription settings.
You also have the right to complain to the Lithuanian data protection authority, the State Data Protection Inspectorate (Valstybinė duomenų apsaugos inspekcija, vdai.lrv.lt), or to the authority in the EU country where you live.
11. Children
Maze AI is intended for players aged 13 and over. It isn’t directed at children under 13, and we don’t knowingly collect their data. If you believe a child under 13 has used the App, contact us and we’ll delete any data we can link to them.
In some countries you must be older to consent to data processing on your own: for example, 14 in Lithuania and 16 in Germany. If you’re under that age, ask a parent or guardian before allowing tracking, or choose “Ask App Not to Track”.
12. Security
We protect personal data with these measures:
- all data is encrypted in transit;
- your stories aren’t stored on our servers, apart from the short log excerpt described in section 3.6;
- access to our server and service dashboards is limited to our team;
- our providers are bound by data processing terms.
No system is completely secure. If a breach affects your personal data, we’ll notify the authority and, where required, you, as the law requires.
13. The Website (mazeai.app)
The Website is hosted on Firebase Hosting (Google), which records technical logs, including IP addresses, to deliver and protect the site.
We use Google Analytics only if you click “Allow analytics” in the consent banner. Until you do, Google Analytics isn’t loaded. If you allow it, Google Analytics records:
- the pages you visit and the page that referred you;
- your device and browser;
- your approximate location;
- an analytics cookie ID.
The legal basis is your consent (Art. 6(1)(a)). Analytics data is kept for no more than 14 months. To withdraw your consent, clear the mazeai.app site data in your browser and choose “Decline” when the banner appears again.
14. Changes to this policy
We’ll update this policy when our practices change and revise the “Last updated” date at the top. For significant changes, where possible, we’ll also let you know in the App or on the Website before they take effect.
15. Contact
MB Muzė LT
Chemijos g. 27C-62, LT-51332 Kaunas, Lithuania
Email: info@muze.lt