Privacy Policy

Who We Are

Gokart is operated by Stapski Media Kft., a company registered in Hungary under company registration number 01-09-453774, with its registered seat at 1134 Budapest, Váci út 45. G. ép. VII. em., Hungary ("Gokart," "we," "us," or "our"). We are the "data controller" responsible for your personal data under the EU General Data Protection Regulation ("GDPR") and Hungary's Act CXII of 2011 on the Right of Informational Self-Determination and Freedom of Information ("Infotv.").

Gokart is not affiliated with, endorsed by, or sponsored by Roblox Corporation.

What Gokart Does With Your Data

In plain terms, before the detail below: you type a description of a game, and we send that description to an AI provider, which returns code and instructions. Our Roblox Studio plugin applies them to your place, then runs an automated playtest and sends us the errors and screenshots from it so the AI can fix its own mistakes.

To do that well, the plugin also reads what is already in your place — including the source code of scripts you or others wrote — and sends it to us and on to the AI provider. We store your prompts, chat history, generated code, generated images and 3D models, and playtest screenshots on our servers. If any of that is something you would rather not share, do not use Gokart on that place.

Information We Collect

Account information (when you sign in)

Sign-in is handled for us by Clerk. The default is signing in with Google, in which case Google shares with us, based on the permissions you approve:

• Your name
• Your email address
• Your Google profile picture
• A unique account identifier

We store your email address on your Gokart account. We use it to identify your account, to contact you about your account or the Service, and — where you have a paid plan — for billing and receipts.

Your Roblox account (optional, linked later)

Gokart does not require a Roblox account to sign up. You are asked to connect one only when you first use a Roblox feature — pairing the Gokart plugin in Roblox Studio with a project. When you connect it, Roblox shares with us, based on the permissions you approve:

• Your Roblox user ID
• Your Roblox username and display name
• Your Roblox avatar / profile picture

We request only the sign-in scopes needed to identify you. We do not receive your Roblox password, Robux balance, payment details, friends list, or private messages. Once connected, Gokart shows your Roblox username and avatar in the app instead of your Google name and picture.

Accounts created before Google sign-in existed on Gokart signed up through Roblox directly, and can still sign in that way.

Content you give us

• The prompts you type, and the full chat history of each project
• Images you upload, paste, or drag into a prompt
• Drawings you make on the Asset Creator sketch canvas
• The names you give projects and assets
• Ratings and written feedback you submit about a generation or a session

Content Gokart generates for you

• The build specifications and Luau source code the AI produces for your game
• Images generated in the Asset Creator
• 3D models, and rigged versions of them, generated from those images
• Rendered thumbnails of your 3D models

Data from Roblox Studio — see "The Roblox Studio Plugin" below.

Usage and technical information

• A record of every generation you run: which AI model was used, how many tokens it consumed, what it cost, and how many credits were deducted. This is the audit trail behind usage-based billing, and it is what lets you and us check that a charge was correct.
• Server logs produced by our hosting provider and by Clerk in the ordinary course of serving requests, which include IP addresses, and which we use for security and debugging.

The Roblox Studio Plugin

The Gokart plugin runs inside Roblox Studio on your computer. While it is connected to a project, it sends us the following:

• Your Roblox user ID, which is how the plugin is paired with your Gokart account and your project.
• A snapshot of the place you have open. Before the AI plans, builds, or fixes anything, the plugin reads through your place and sends us a description of it: the name, class, and position of the objects in it, and the source code of the scripts inside it. This includes scripts you wrote yourself and scripts that came with models you imported or took from the Creator Store. Without this the AI cannot edit what is already there, and would overwrite or duplicate it. The snapshot is capped in size, and script code inside imported models is reduced to an outline rather than sent in full unless your request is about that model.
• Playtest results. After applying a build, the plugin runs an automated Play Mode test. It sends us the runtime errors and warnings produced during that test, the results of the checks the AI asked it to measure, and screenshots of the running game. Screenshots are captured with Roblox's own screenshot service and only ever show the Roblox viewport of the test session — not your desktop, and not the rest of Studio.

The plugin does not read places you do not have open in Studio, does not read your Roblox account settings, and does not upload anything to Roblox on your behalf. It does write into your place: it creates, edits, and deletes objects and scripts there as part of building what you asked for.

If a future feature needs additional permissions on your Roblox account — for example, uploading a generated 3D model to your own Roblox account as an asset — we will ask you for that permission separately, at the time, and you will be able to decline and keep using everything else.

AI Providers

Generating anything on Gokart means sending content to a third-party AI provider on our behalf:

• Game generation runs on GLM 5.3 Flash, an AI model developed by Z.ai, hosted for us by Pareto Inference, with OpenRouter as a backup when Pareto is unavailable (OpenRouter passes the request to an underlying hosting provider). They receive your prompts, the chat history of that project, the place snapshot described above (including script source code), any images you attached, the playtest screenshots that are reviewed after a build, and the text used to name your projects and 3D models. Pareto keeps no request content after a request finishes and does not use it to train or evaluate models, and we instruct OpenRouter to use only hosting providers that neither collect nor retain it.
• OpenAI and Google receive the same content when an account is set to use one of their models. This is currently limited to specific staff accounts and to accounts on an invitation-only plan.
• Your own AI assistant, if you connect one. When you connect Claude, ChatGPT or another assistant to your Gokart account, Gokart sends it what it asks for through that connection: your project names, the place snapshot (including script source code), playtest results and playtest screenshots. That assistant is run by its own provider under your own account with them, and their terms and privacy policy apply to it, not ours. You can disconnect it at any time in that assistant's settings.
• fal.ai receives the prompts, sketches, and reference images you use in the Asset Creator, and runs the third-party image and 3D models behind it to generate pictures, 3D meshes, and rigs.

We use these providers' commercial API tiers, under which your content is processed to return a result to us. We do not control their terms, and we encourage you to read them; where we have a choice, we select the option that does not use your content to train models. We do not use your prompts, generated code, or generated assets to train models of our own.

Because your prompts and the contents of your place are sent to these providers, do not put passwords, API keys, personal data about other people, or confidential material into a prompt, or into a place you build on with Gokart.

How Your Content Is Stored

Your account, projects, chat history, build specifications, generated code, playtest results, and credit records are stored in a Postgres database hosted by Supabase. All access is server-side under a single service key; the database is not reachable from your browser.

Files — generated images, 3D model files, and playtest screenshots — are stored in Supabase Storage. These files are served from public buckets at long, randomly generated URLs. They are not listed anywhere and are not labelled with your identity, but anyone who has the exact URL of a file can open it without signing in. Treat the URL of a generated asset as the thing that protects it, and do not share it if you do not want the file seen.

Gokart does not store a copy of your Roblox place. Your place file lives on Roblox. What we store is what the plugin sent us, described above: the place snapshot, the builds we generated for it, and the playtest screenshots.

Payment Information

When you subscribe to a paid plan or buy a one-time credit pack, payment is processed by Whop. Whop collects and processes your payment details — such as your card number and billing address — directly. We never receive or store your full payment card details.

Whop shares with us the email address used for the purchase and the status of your subscription (active, trialling, cancelled, ended). We link that to your Gokart account so we can grant your credits, apply your plan, issue receipts, and provide billing support. Unlike an email you add yourself, we collect this because it is necessary to provide the plan you purchased.

We also keep our own record of each credit grant and each credit spend on your account, as described above.

Cookies and Local Storage

Cookies. Clerk, our authentication provider, sets first-party cookies to keep you signed in and to protect your session. These are strictly necessary for the Service to work and cannot be switched off while you are signed in.

Local storage. Gokart uses your browser's local storage to remember small, non-sensitive preferences and state: a prompt you typed before signing in, which AI model you last picked, which backdrop you last used in the 3D viewer, whether you have installed the Studio plugin, and whether you have already been shown a particular one-off prompt. This data stays in your browser.

We do not currently use analytics, advertising, or cross-site tracking cookies. If that changes, we will update this policy and ask for your consent where the law requires it.

Legal Basis & How We Use Your Information

We process your personal data on the following legal bases under Article 6 of the GDPR:

• Performance of a contract — to create and maintain your account, generate games and assets from your prompts, run and report playtests, store your projects so you can return to them, meter and deduct credits, and handle billing and receipts for a paid plan.
• Consent — for connecting your Roblox account, and for any optional permission we ask you for separately. You can withdraw consent at any time.
• Legitimate interests — to keep the Service secure and prevent abuse, to debug and improve generation quality, to review generations you rated so we can find out what went wrong, and to promote the Service using creations made with it (see the next section).
• Legal obligation — to comply with applicable Hungarian tax, accounting, and other law, for example by retaining billing records.

Concretely, we use the information we collect to:

• Create and maintain your account and your projects
• Generate game code, images, and 3D models from what you ask for
• Apply builds to your place through the Studio plugin and test them
• Calculate what a generation cost and deduct the right number of credits
• Communicate with you about your account, your billing, or the Service
• Investigate a rating or a bug report you sent us
• Detect and prevent fraud, abuse, and security incidents

Staff access. When you rate a generation or send feedback, our staff can open that project's chat history and the generated content alongside your rating, because a rating with no context cannot be acted on. Outside of that, and outside of investigating a support request or a suspected abuse or security incident, we do not read your projects.

Marketing Use of Your Creations

Under our Terms of Service, you grant us a licence to use content created with Gokart — games, 3D models, images, screenshots, and the prompts behind them — to demonstrate and promote the Service, for example on our landing page, in social media posts, in advertising, and in product demonstrations.

When we do this, we show the creation. We do not publish your email address, and we do not attach your Roblox or Google identity to a creation unless you have asked us to credit you. If you would rather a specific creation of yours was not used this way, email us at team@gokart.gg and we will stop using it going forward.

Data Retention

We keep your personal data only for as long as necessary for the purposes described in this policy:

• Account data (name, email, profile picture, Roblox ID and username, plan, credit balance): kept for as long as your account exists.
• Projects, chat history, and generated code: kept for as long as the project exists. Deleting a project deletes its chat history, its builds, its playtest results, and its place snapshot immediately.
• Playtest screenshots: deliberately short-lived. A project's screenshots are deleted when you leave its page, and anything older than 24 hours is swept regardless. The single most recent screenshot per project is kept as that project's thumbnail until the project or the account is deleted.
• Place snapshots: one per project, overwritten each time a new one is taken, and deleted with the project.
• Generated images and 3D models: kept until you delete them or delete your account.
• If a subscription or free trial ends: your projects are kept for 30 days and then deleted, unless you resubscribe within that window, which cancels the deletion.
• After account deletion: your account, projects, chat history, generated assets, and stored files are deleted immediately, except the records below.
• Billing records: invoices and payment records are retained for the period required by Hungarian accounting and tax law, which is currently 8 years, even after account deletion.
• Security and server logs: retained for a limited period for abuse prevention and debugging, and not kept longer than necessary.

Information Sharing

We do not sell your personal information. We share it only with:

• Service providers who process data on our behalf, currently: Clerk (authentication and sessions), Supabase (database and file storage), Vercel (hosting), Pareto Inference and OpenRouter (AI generation, running Z.ai's GLM model), OpenAI and Google (AI generation for specific staff accounts), fal.ai (image and 3D asset generation), Roblox (its Open Cloud API, used to fetch the Creator Store model files and animation data your build asked for), and Whop (payments). Each is bound to use your data only to provide their service to us.
• Publicly, where something has been made public — a file stored at a public asset URL is readable by anyone with that URL, and content used for marketing under the section above is shown publicly.
• When required by law — to comply with a legal obligation, court order, or valid governmental request.
• In a business transfer — if Gokart is acquired or merged, your data may be transferred to the acquiring entity, which would remain bound by this policy or give you notice of a replacement.
• With your consent — if you explicitly ask us to share specific information.

In line with Roblox's Creator Third Party App Policy, we do not track you across other platforms using your Roblox identity, and we do not share your Roblox user ID, username, or other identifying information with other creators or third parties for their own purposes.

International Data Transfers

Most of our service providers — including Clerk, Supabase, Vercel, Pareto Inference, OpenRouter, OpenAI, Google, fal.ai, Roblox, and Whop — process data outside the European Economic Area (EEA), including in the United States. Where this happens, we rely on appropriate safeguards — such as the European Commission's Standard Contractual Clauses, or a provider's certification under the EU-US Data Privacy Framework — so your data continues to receive a level of protection consistent with the GDPR.

Your Rights

Under the GDPR and Hungary's Infotv., you have the right to:

• Access the personal data we hold about you
• Rectify inaccurate or incomplete data
• Erase your data ("right to be forgotten"), subject to our legal retention requirements above
• Restrict or object to certain processing, including our use of legitimate interests
• Receive your data in a structured, machine-readable format ("data portability")
• Withdraw your consent at any time, without affecting the lawfulness of processing before withdrawal

To exercise any of these rights, contact us at team@gokart.gg. We will respond within one month, as required by the GDPR.

You also have the right to lodge a complaint with Hungary's data protection authority:

Nemzeti Adatvédelmi és Információszabadság Hatóság (NAIH)
Address: 1055 Budapest, Falk Miksa utca 9-11, Hungary
Website: naih.hu

or with the supervisory authority in your own EU member state of residence.

Deleting Your Account

You can have your account deleted at any time: email team@gokart.gg from the address you signed in with, and we will complete the deletion within 30 days. Deleting it permanently removes your account record, every project and its chat history, your builds and playtest results, your generated images and 3D models and the files behind them, your playtest screenshots, and your sign-in. It cannot be undone, and any remaining credits are lost.

Two things are not removed, for reasons outside our control: billing records we must keep under Hungarian tax and accounting law, and anything the Gokart plugin already built into your Roblox place — that lives on Roblox, in your own place file, and only you can remove it.

Children's Privacy

Gokart is not directed at children under the age of 16, and our Terms of Service require you to be at least 16 years old to use the Service. We do not knowingly collect personal data from children under 16. If we become aware that we have collected personal data from a child under 16 without appropriate parental consent, we will delete that data and, where applicable, disable the associated account.

We are aware that Roblox itself permits account holders aged 13 and older to authorize third-party sign-in. Gokart's own age requirement is stricter than Roblox's — being able to complete Roblox's sign-in flow does not by itself satisfy Gokart's eligibility requirement, and you remain responsible for independently meeting the age requirement in our Terms of Service.

Data Security

We implement appropriate technical and organizational security measures to protect your data. Our database is reachable only server-side under a single service key, with row-level security enabled; authentication and session handling are delegated to Clerk; payment card details never reach our servers; and access to production data is limited to the people who need it.

As noted above, generated files are served from public storage URLs, which is a deliberate trade-off for performance and is why those URLs are long and unguessable. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a data breach affecting your personal data, we will notify you and the relevant supervisory authority as required by the GDPR.

Changes to This Policy

We may update this Privacy Policy from time to time — Gokart is under active development, and new features can mean new data. We will notify you of material changes by posting the revised policy on the Service and updating the "Last Updated" date. Your continued use of the Service after any such changes constitutes acceptance of the revised policy.

Contact Us

For any questions please contact us at team@gokart.gg