Privacy Policy

Realm is a platform for building games, organizing groups, hosting live sessions, and tracking participant progress. This Privacy Policy applies to the Realm websites, applications, and related services operated by Bisaic, Inc. (collectively, “Realm,” “we,” “us,” or “our”).

When an organization, employer, school, or other workspace customer provides access to Realm, that organization may decide why and how information in its workspace is used. In that situation, the organization is responsible for its own notices, permissions, and instructions, and we process workspace information on its behalf. Questions about an organization-controlled workspace should be directed to its administrator first.

We use information to:

• provide accounts, workspaces, games, live sessions, submissions, and results;
• authenticate users, maintain sessions, and prevent abuse or unauthorized access;
• process subscriptions, administer plans, and measure plan usage;
• verify optional location gates when a participant requests a location check;
• grade eligible submissions, including optional AI-assisted grading, and draft game content when a creator requests AI generation;
• send service, security, account-deletion, and newsletter or marketing communications you request;
• maintain, troubleshoot, analyze, and improve Realm; and
• comply with law, enforce our terms, and protect users, Realm, and others.

Where data-protection law requires a legal basis, we rely on performance of our contract, our legitimate interests in operating and protecting Realm, consent where requested (for example, device location permission), and compliance with legal obligations. Where an organization controls workspace information, its legal basis may also apply.

When a workspace’s plan includes AI-assisted grading, a creator can turn it on for individual short-answer or photo tasks. For a short answer that Realm cannot match directly to an accepted answer, Realm sends the task prompt and instructions, the accepted answers, and the submitted answer. For a photo task, Realm sends the task prompt and instructions, the submitted photo, and the task’s reference image if the creator added one. Your browser uploads the original photo file, including any embedded metadata such as camera location, to private temporary upload storage. Realm then converts it to a new image file that does not keep that metadata, stores only the converted file for the game and AI grading, and deletes the original after processing succeeds. If an upload is abandoned, processing fails, or that deletion fails, the original can stay in that private temporary storage until it is cleaned up. These requests go through Vercel AI Gateway to the configured model provider. We request a grading verdict, confidence score, and concise rationale, and store that result with the submission.

A creator on an eligible plan may ask Realm to draft a game. For that request, Realm sends the following through Vercel AI Gateway to the configured model provider: the creator’s written brief; the venue boundary the creator drew and any labeled pins the creator placed, including their map coordinates; a satellite image of the venue with that boundary and those pins drawn on it; and the names, categories, and map coordinates of public points of interest found inside the venue, plus, when the model asks about a place, public details recorded for it in OpenStreetMap, such as opening hours, a website, or an inscription. While drafting, the model also receives preview images of its proposed checkpoint areas drawn over the satellite image. Realm requests the satellite image from Esri, which receives the map tile locations that cover the venue, and looks up points of interest through the OpenStreetMap Overpass API described above. Realm stores the resulting draft in the creator’s workspace for review. Realm does not add participant information to generation requests.

A creator on an eligible plan may also ask Realm’s assistant to edit a draft game. For each request, Realm sends the creator’s message, recent earlier messages and replies about that draft, the draft’s content, including the game title and description, mission and task text and settings, points, answer choices, correct answers, and checkpoint names, and Realm’s validation findings for the draft through Vercel AI Gateway to the configured model provider. Realm does not add map coordinates, images, or participant information to these requests.

Realm does not add an account email, username, or participant display name to an AI request, and does not send a participant’s device location to an AI model provider. The only map coordinates Realm itself adds to an AI request describe the venue, pins, points of interest, and proposed checkpoint areas used for AI game generation. Realm does not redact content included in the AI requests described above, so personal or location information that someone writes in a brief, message, draft, or answer, or that is visible in a photo, reaches the model provider. Embedded photo metadata is removed before a photo is used for AI grading. Realm does not use your content to train AI models. AI output can be wrong. Low-confidence and uncertain results remain available for human review, and organizers should not use Realm’s AI grading for employment, education admission, credit, housing, healthcare, or other decisions that produce legal or similarly significant effects.

We retain information for as long as needed to provide Realm, maintain workspace history, comply with contracts and law, resolve disputes, and protect the service. Retention varies by record: account information is generally kept while an account is active; workspace and gameplay records may remain under the workspace customer’s control; temporary uploads generally expire or are cleaned up; billing and security records may be kept longer where required.

Guest reconnect information stored in the browser does not currently have a time-based expiry. Realm clears it when the guest leaves or is removed, or when credential validation fails. A guest can also remove it by clearing this site’s browser storage.

Account holders can start deletion from Account settings. Deletion begins immediately and cannot be undone: Realm disables account access right away, deletes the sign-in identity held with our authentication provider (WorkOS), removes or de-identifies profile information, and revokes active workspace, group, invitation, and session access. This is not a cascading deletion of shared content: games, runs, scores, billing records, and audit history may remain with their workspace for other members, contractual or legal obligations, fraud prevention, or a documented organizational purpose.

We use administrative, technical, and organizational safeguards designed to protect information, including access controls, scoped authorization, backend hashing of guest credentials, restricted media storage, and encrypted connections. No system is completely secure, so we cannot guarantee absolute security.

Depending on your relationship with Realm and where you live, you may be able to:

• access, correct, or update account information in Account settings;
• request deletion of your Realm account from Account settings;
• ask to access, correct, delete, restrict, or receive a copy of personal information;
• object to certain processing or withdraw consent where processing relies on consent;
• disable location access in your browser or device settings;
• manage locale, theme, cookie, and browser-storage settings through the Cookie Notice or Account settings;
• allow or withdraw PostHog analytics and session replay through Privacy choices;
• opt out of newsletter or marketing email by contacting us at the address below.

If your information belongs to an organization-controlled workspace, we may direct your request to that organization. We may need to verify your identity and authority before completing a request. You may also have the right to complain to your local privacy or data-protection authority, and you will not be discriminated against for exercising a privacy right.

In the preceding 12 months, Realm may have collected the categories described above: identifiers; customer and payment records; commercial information; internet or other electronic activity; precise geolocation used for a requested gate check; user-created content and photos; and inferences such as AI grading results and usage summaries. We use and disclose those categories for the business purposes described in this policy.

We have not sold personal information or shared it for cross-context behavioral advertising in the preceding 12 months, including personal information of people we know to be under 16. We use precise geolocation only to provide a location check requested by the participant and to detect duplicate submissions of that check, and do not use it for advertising or to build a profile. California residents may exercise rights to know, access, correct, delete, or limit eligible information and may use an authorized agent, subject to verification and applicable exceptions.

Realm and our providers may process information in the United States and other countries where privacy laws may differ from those where you live. Where required, we use approved contractual protections or other lawful transfer mechanisms. Contact us if you need more information about safeguards relevant to your information.

Realm is not directed to children under 13, and individuals under 13 may not create an account or provide personal information directly to Realm unless their organization has entered an appropriate agreement with us and obtained verifiable parental consent where required. Organizations using Realm with minors are responsible for age-appropriate notices, permissions, supervision, and configuration of location, photo, and AI features.

If you believe a child provided personal information in violation of this section, contact us so we can investigate and take appropriate action.

We may update this policy as Realm, our providers, or legal requirements change. We will post the revised policy with a new effective date and provide additional notice when a material change requires it. Continued use after an update means the revised policy applies to future processing, subject to any consent required by law.

Bisaic, Inc. is the operator of Realm. For privacy questions or requests, email privacy@playonrealm.com. For organization-controlled data, include the workspace or organization name so we can route the request appropriately. Please do not send passwords, payment card numbers, or sensitive submission content by email.

Formal legal notices may be sent by mail to our registered agent at the address below. Privacy requests are handled by email, and mail sent to this address will not be forwarded to our privacy team.