Privacy Policy

People design, vote on and back products in the Demoverse app. Brands see what people make and like, so they can make things people actually want. Some designs get made for real ("Made real"), and the people behind them can win prizes and earn money.

You give us

• Account details: your email, and your name if your sign-in shares it (Google or Apple sign-in, or an email code). A username we pick at random, and any display name, photo or avatar you choose. • Date of birth, and gender if you add it. We ask for your date of birth the first time you edit your account in Settings. • What you make: designs, prompts, the words you type or say to make a design, votes, likes, saves, comments and backings. • Photos you upload, for example a photo you start your own challenge with, or a photo of a Made real product you received. • Made real orders and prizes: your name, phone number and delivery address, what you ordered or won, and order status. For payouts, your UPI ID. Card and bank details go straight to our payment provider, Razorpay; we never see or store them. • Contacts, only if you ask us to find friends. We match email addresses on our servers to show who is already here, then throw the list away at once. We do not keep your contacts. • Messages you send us.

We collect when you use Demoverse

• Your time zone and language settings, read from your phone or browser, so we can show times in your own local time (for example "Results at 9:30 AM" in New York and "7 PM" in Mumbai). This needs no permission. • Your rough location: country, region and city, worked out from your internet connection (your IP address) on our own servers. We never use GPS and never ask for location permission. We keep only the area, never the IP address itself (section 6). • App and device details: app version, device type and operating system, a device identifier, and the push notification token your phone gives us. • How you use the app (which screens you open, what you tap), so we can improve it. In the EU, the EEA and the UK this is off until you say yes (section 5). • Crash and performance reports, not linked to your account.

From others

• Sign-in providers: Google or Apple tell us your email and that you signed in. • Brands and challenge hosts, about a challenge you joined, such as which design they chose. • Public posts: for some brand challenges we read public replies on X to a challenge post, as X allows.

• Running your account and the app (designs, votes, reveals, crews, streaks, rewards): our contract with you. • Showing times in your local time and sending pushes at sensible hours: our contract with you. • Made real prizes, orders, delivery and payouts: our contract with you, and legal duties such as tax and consumer law. • Checking your age: a legal duty. • Keeping Demoverse safe from fraud, abuse, spam and security threats: our legitimate interest in a safe service, and legal duties. • Understanding and improving the app: our legitimate interest, and your consent in the EU, the EEA and the UK. • Telling brands what people like, as totals only (section 4): our legitimate interest. • News and offers by email: our legitimate interest. You can unsubscribe in any of those emails.

We use AI services to turn your prompts, words and photos into designs and to keep content safe. What you send them is used to make your design and is handled under their terms for business customers.

Other people on Demoverse

Your username, avatar, and the designs, votes and comments you post in shared places (a challenge, your crew, the feed). Your email, phone, address, date of birth and location are never shown to other users.

Brands see totals, never people

• Totals only, for example "2,400 designers in Mumbai, 18 to 24". • No small groups: any group under 50 people goes into "Other", so a total cannot point to one person. • No lists: we never give a brand a list of people, user IDs, emails, IP addresses or anyone's location. • People we know or think are under 18 are left out of brand targeting and brand reports. • A brand sees the design you made for its challenge, with your username. If it makes your design for real, it gets only what it needs to make and send your order.

Companies that work for us

They process data only to run Demoverse, under contract: • Google (Firebase, Google Cloud, Gemini and Vertex AI): sign-in, push notifications, app analytics, crash reports, AI design generation and safety checks. • Supabase: our database, file storage and servers. • Netlify: hosting the website. • FAL.ai: making images and turning speech into text. • Sarvam AI: turning speech into text. • Resend: sending email. • Razorpay: payments and payouts for Made real (India). • Stripe: payments for brands. • Apple: Sign in with Apple and app distribution. • Apollo.io: understanding which businesses visit our website (website only, not the app).

When the law requires it

We share data with authorities when a valid legal request requires it, or to protect people's safety.

If Demoverse changes hands

If Demoverse is merged or sold, your data moves with it under this policy, and we will tell you.

We do not sell your personal data, we do not share it for cross-company advertising, and we do not track you across other companies' apps or websites.

• In the EU, the EEA and the UK, app analytics stay off until you tap "Allow". You can change this any time in Settings, Privacy, Analytics. • Everywhere else, app analytics are on, so we can see how Demoverse is used and fix what does not work. • Marketing emails have an unsubscribe link. Tap it and we stop. Emails about your account, orders and prizes still go out. • Push notifications can be turned off in your phone's settings.

• Your account, designs and what you make: until you delete your account. • App-open records (time, rough area, app version): 13 months. After that we keep only totals with no user ID, such as daily designers per country. • Security logs, which may include IP addresses: 12 months, then deleted. • Made real orders, payments and payouts: as long as tax and consumer law require. • Contacts you match: not kept. • Raw IP addresses: never stored outside security logs.

When you delete your account we delete your profile, what you made, your location and time zone, and your app-open records. We keep only what the law makes us keep, such as order and payment records.

You can: • See and get a copy of your data. • Correct it; most things can be changed in Settings. • Delete your account and your data, in the app (Settings, Delete account), on the website, or by writing to us. • Say no to analytics (EU, EEA and UK) and unsubscribe from marketing emails. • Object to or limit how we use your data, and withdraw any consent you gave. • Complain to your data protection authority.

Write to privacy@demoverse.ai. We answer within 30 days, and may need to confirm it is you first.

India

Our Grievance Officer can be reached at privacy@demoverse.ai. If we do not resolve your complaint, you can go to the Data Protection Board of India.

California and other US states

We do not sell or share personal information as those laws define it. City-level location is not "precise" location. You will not be treated differently for using your rights.

• You must be at least 13 to use Demoverse, or 16 in the EEA. • Until you tell us your age, we treat you as 18 or older. • We ask for your date of birth the first time you edit your account in Settings. • Under 18: you are left out of brand targeting and brand reports, and we do not send you marketing. Prizes and payouts need a parent or guardian; write to us before claiming. • Under 13: if we learn someone under 13 has an account, we pause it and delete its data, unless they show us the age was wrong. Parents can write to privacy@demoverse.ai.

We encrypt data in transit and limit who can access it. Payment card and bank details are handled only by our payment providers. No system is perfectly secure; if a breach affects you, we will tell you and the authorities as the law requires.

Demoverse is run from the United States and India, and our service providers process data in several countries. When data leaves your country, we use the protections the law asks for, such as the European Commission's standard contractual clauses.

When we change this policy we update the date at the top, and if a change matters we email you before it takes effect.

• privacy-2026-10: October 2026 (this version) • Previous policy: 22 February 2026

Email privacy@demoverse.ai, or write to Demoverse, 131 Continental Dr, Suite 305, City of Newark, County of New Castle, Delaware 19713, USA.