Privacy

Last updated 2 Oct 2026

Seedha baat: we collect what we need to run the Arena, we don't sell your data or show ads, and the gameplay we use for research is anonymised first. Here is the full picture, in plain English.

Who we are

26 Labs (26labs.fun) is a small, early-stage home for Indian AI builders, run from India. We decide how your data is used, so under the Digital Personal Data Protection Act, 2023 and the DPDP Rules, 2025 we are the “Data Fiduciary”. Reach us at vk@26labs.fun.

What we collect

  • Sign-in. Your email address. If you use Google or GitHub, also your name, profile photo link, account ID and the sign-in tokens they return (from GitHub we ask only for your email). Email sign-in gives us just your email.
  • Profile. Your handle, display name, city (optional) and bio, plus your previous handles (used to hold them and redirect old links).
  • Consent record. The version of this notice you agreed to, when, and your 18+ confirmation, with a one-way hash of your IP address (never the IP itself) and your browser's user agent.
  • Sessions. For each signed-in device: the IP address, browser user agent and expiry, so we can keep you signed in and spot misuse.
  • Follows. Who you follow and who follows you.
  • Email choices. Which kinds of email you've turned on or off, and a record of each unsubscribe (which kind, when, and whether it came from an email link, your mail app or your settings).
  • Notify-me sign-ups. The email you enter to hear when something launches.
  • Gameplay, once games launch. Human or AI? guesses and timing; Jailbreak Tower messages, bot replies, guesses, hints and outcomes (stored to run the game and show you replays); Prompt Wars prompts, generated outputs and likes, all with timestamps. If you add your own AI key for extra Prompt Wars runs, we store it encrypted, use it only for those runs and never log it.
  • Technical. Server logs (which can include IP addresses and error details) and short-lived rate-limit counters keyed by IP address or account.

Invite-only beta

While the Arena is invite-only, you get in with an invite code or by joining the waitlist. That adds a little data:

  • Waitlist. We keep your join order, whether you were referred and by whom, and the friends who joined with your link. Your handle is visible in your referral link (26labs.fun/w/your-handle), and the friends who join with it appear by handle on your waitlist page.
  • College or work email (optional). Used once, to confirm the address and move you up. It is stored to stop one address boosting two accounts, and deleted with your account. We never use it to sign you in or send you anything else.
  • Invite codes. We record who redeemed which code and when, and how you got in (code, waitlist batch or added by us). The person who invited you sees your handle, and you see theirs.

We email you about your place in line: a confirmation when you join, the link to confirm a college or work email, and a note when you're in. These are service emails. The join confirmation and the you're-in note are sent once; the confirm link is sent each time you ask for it.

Why we use it

  • To sign you in, send sign-in links and keep your account and public profile running.
  • To send you email: sign-in emails whenever you ask for one (always), and, unless you turn them off, product emails such as a welcome note and game updates. Every product email has a one-click unsubscribe, and you can change them all in email settings.
  • To run the games, scores, leaderboards and badges.
  • To prevent cheating, spam and abuse, including rate limits.
  • To build research and datasets from anonymised gameplay (next section).
  • To answer you when you write to us, and to meet legal obligations.

Our legal basis is your consent, which you give with the two boxes before signing in. We don't sell personal data, run ads or use third-party trackers.

Research and datasets

Gameplay is also a dataset source, and you agree to that when you sign up. Before any gameplay enters our dataset store, we strip phone numbers, email addresses, handles and names from chat text. That store is kept separate from the tables that run the site and holds only scrubbed, anonymised records that are not linked to your account. We may use these datasets for our own research and share or publish them. Because they can't be traced back to you, records already anonymised can't be removed later.

What others can see

Your profile at 26labs.fun/u/your-handle is public: handle, name, photo, city, bio, join date and follower counts, and later your game stats, badges and leaderboard positions. Prompt Wars prompts stay hidden until the event closes, then they are revealed with the entries. In Jailbreak Tower, after midnight IST the Daily transcript that cleared each floor in the fewest messages is shown to everyone with your handle (messages and the floor's secret included); your Endless transcripts are never shown to others. A shared run card shows only floor, points and message count. Your email is never shown. Profile photos from Google or GitHub load from their servers.

Where it lives, who helps

Everything we run is hosted on Amazon Web Services in Mumbai, India (ap-south-1). We use these service providers, each only for its job:

  • Amazon Web Services: servers, database, backups, logs and sending our emails (sign-in and product).
  • Google and GitHub: sign-in, only if you choose them.
  • ImprovMX: forwards mail sent to our 26labs.fun address to our inbox.
  • Google (Gemini API): when you play a game that uses AI, the text you type is sent to Google's Gemini models to generate the reply. We use Google's paid service, where your text is not used to train or improve their products. Google may process it outside India. We keep a record of each call (time, model, cost) but not what you typed. If we add another AI provider, we'll name it here first.

Some of these providers may process data outside India. We only use providers the law allows and never send more than the job needs.

How long we keep it

Account and profile
Until you delete your account.
Sessions
Deleted when you sign out; otherwise kept no longer than your account.
Gameplay
With your account, until you delete it. Anonymised dataset records are kept.
Email choices
Your preferences go with your account. The unsubscribe history is kept after account deletion, no longer linked to you, as a record that we stopped.
Waitlist and work email
With your account, until you delete it. If someone you referred deletes their account, they drop off your list.
Invite codes
Code records stay after account deletion, no longer linked to you, so a used code can't be reused.
Notify-me emails
Until you ask us to remove them.
Consent record
Kept after account deletion as proof of consent, as the law expects. It holds no raw IP.
Server logs
14 days.
Database backups
Up to 7 days, then overwritten.
Rate-limit counters
Minutes, at most an hour.

Your rights

Under the DPDP Act you can:

  • get a summary of the personal data we hold about you and who we've shared it with;
  • correct or update it (you can edit your name, city and bio on your profile now);
  • erase it, by deleting your account;
  • withdraw consent, as easily as you gave it (the Arena needs consent, so this means closing your account);
  • nominate someone to use these rights if you die or can't act yourself;
  • raise a grievance with us, and then with the Data Protection Board of India.

For now, email vk@26labs.fun from the address on your account. Self-serve account settings are coming. We confirm it's you before acting, and act within the timelines below.

18+ only

The Arena is for adults. You confirm you're 18 or older when you sign up. We don't run a parental consent process, so anyone under 18 must not create an account. If we learn one exists, we delete it.

Cookies and storage

We only use cookies the site needs to work:

  • Session cookies (26l.session_token and a 5-minute 26l.session_data cache) keep you signed in.
  • lab_consent lasts 30 minutes and carries your two ticked boxes through sign-in.
  • A short-lived cookie protects the Google or GitHub sign-in redirect.
  • 26l_invite holds an invite code you typed for up to a day, until you finish signing up.
  • 26l_ref remembers whose referral link you opened for 30 days, so the right friend gets the credit when you join.

Your browser's local storage remembers small interface choices, like a Prompt Wars reminder. No analytics, advertising or tracking cookies. Unsubscribe links in our emails work without signing in and set no cookies; they carry a signed code instead, so nobody else can change your choices.

Security

Traffic is encrypted with HTTPS, the database is encrypted at rest and reached only over verified TLS, sign-in links expire in 10 minutes, and only the 26 Labs team can reach production systems. No system is perfectly secure. If a breach affects your data, we will tell you and the Data Protection Board as the law requires.

Changes

We'll update this page when our practices change and move the date above. If the change affects what you agreed to, we bump the consent version and ask you again the next time you visit before you can keep playing.

Questions or complaints

Write to vk@26labs.fun. We acknowledge within 48 hours and aim to resolve within 30 days. If you're not satisfied with our answer, you can approach the Data Protection Board of India. More ways to reach us are on the contact page.