Overview
Project Karma is a productivity game available at projectkarma.me and karma-test.pages.dev. We collect only what is needed to run accounts, sync your game, and process payments. We do not sell your data.
Data we collect
We collect account data through Clerk, which includes your email address, Clerk user ID, and display name or avatar if you provide them through Google OAuth. We do not receive your Google password. We also store game data such as karma, lifeform, quests, chronicle entries and blessing state. This data is stored locally on your device and, if you subscribe to Guru, synced to Supabase so it is available across devices.
Payment information is handled by Dodo Payments as merchant of record. Dodo processes your payment details and invoices. We receive only subscription status, current period end, and a Dodo customer ID. We do not receive full card numbers. We also collect basic technical logs such as IP address, user agent and timestamps through Cloudflare for security and operational purposes.
How we use data
We use your data to provide and sync the game, including offline first sync when you are subscribed to Guru. We use it to manage subscriptions and premium access, to prevent fraud, and to provide support. We do not use your data for advertising and we do not sell it.
Service providers
We share data only with providers required to run the service. Clerk provides authentication. Supabase provides database storage for synced game state. Dodo Payments processes payments, invoicing and tax. Cloudflare provides hosting and API delivery. Each provider acts under its own privacy policy. We do not share data beyond these providers except where required by law.
Cookies and storage
We use essential cookies and local storage for authentication, PWA caching, and local game state. Clerk may set cookies on accounts.projectkarma.me for sign in. We do not use advertising cookies. We currently do not use third party analytics.
Retention
We retain account and game data while your account exists. You may delete your account in the app or by contacting us, and we will delete your data from Supabase and request deletion from our providers where applicable. Server logs are retained for up to thirty days. Invoices are retained as required by tax law through Dodo.
Your rights
Depending on your jurisdiction, including where GDPR applies, you may have rights to access, correct, delete or export your data and to object to certain processing. To exercise these rights, contact us at the email above. We will respond within thirty days.
Security
All data is transmitted over HTTPS. Direct database access requires a service role and is not exposed to the public. We do not store card data. No system is completely secure. Please report any security concerns to the contact address above.
Children
Project Karma is not directed to children under thirteen. Do not create an account if you are under thirteen.
International transfers
Our providers may store and process data in multiple regions, including the United States and the European Union. By using Project Karma, you consent to such transfer and processing.
Changes
We may update this policy from time to time. When we do, we will update the effective date on this page. Material changes will be notified in the app or by email.
Contact
If you have questions or requests regarding this policy, contact us at harsh.malhotra.tech@proton.me. For billing issues, please include the email address used at checkout.