The fine print

Privacy policy

Last updated: 11 October 2026

ELSEWHERE is a camera puzzle game: you photograph a place, and AI paints a level from your photo. This policy explains, in plain words, what that means for your data. It also covers our website, elsewhere.gazum.ai, and its launch waitlist.

The short version

Your photos are sent to OpenAI to paint your levels. OpenAI does not use them to train its models.
Location is removed. We strip location (GPS) and all other metadata from every photo before it is stored or sent anywhere.
No name, no ads. The game gives you an anonymous player id and never asks for your email; only the waitlist on our website does, if you join it. We don't sell your data.
Private unless you share. Anyone you send a level's link to can play it; it joins the community feed only if you choose.
Delete everything, any time, from Settings in the app.

Who we are

GAZUM, Corp., 7345 W Sand Lake Rd, Ste 210, Orlando, FL 32819-5280, United States ("we", "us"). Contact: support@gazum.ai.

What we collect, and why

Your photos and the levels made from them

When you take a photo in the game, it is uploaded to our servers, cropped to the game's portrait format, stripped of its metadata (including location) and stored. It is then sent to OpenAI's API, which reads the scene and paints the six hidden things, the Elsewhere (your place repainted) and the Stray (its creature). We store the painted images with the level, along with the words written about your place, in English and Spanish: its name, the Cartographer's line, and the Stray's name and story.

We use them to make and run your level. Legal basis (EEA and UK): the performance of our contract with you, and your consent to send your photos to OpenAI, which the game asks for before your first photo.

Your player account

a random player id, and a random access key kept on your device (we store only a one-way hash of the key);
a random device id made by the app, used only to limit how many accounts one device can create in a day;
when you joined and last played, your consent to AI processing, your play streak, and whether you have made your first level;
the language you chose for the game (English or Spanish);
a short public id shown on levels you share, so other players can block you.

Your play

The levels you play, when, your time, stars and the things you found; your film balance and every change to it; the levels you report and the players you block.

Purchases

Purchases are made through Apple or Google and verified by RevenueCat, our purchases provider. We receive what you bought, the store's transaction id, when, and whether it was refunded. We never see your payment details. Your player id is also your id at RevenueCat.

Network data

Your IP address is used to protect the service from abuse, for example to limit how many new accounts, or waitlist sign-ups, one network can make. We keep only a hash of it, for a few days. A waitlist sign-up keeps, until you unsubscribe, only a keyed hash of the network part of it (the address without its last part), and, once you confirm your address, a keyed hash of the IP address you confirmed from. A keyed hash isn't the address itself: only we, holding the key, can check it against an IP address someone gives us. Our hosting provider keeps standard server logs for 30 days.

The launch waitlist

If you join the waitlist on our website, we keep your email address, the page you joined from (English or Spanish), the language we will write to you in, when you joined, the version of the consent line you saw, a keyed hash of the network part of your IP address and a random unsubscribe key. We use your address only to tell you about ELSEWHERE's launch, and the hash only to spot sign-ups made in bulk. Legal basis (EEA and UK): your consent, given when you join and confirmed by email.

Before anything is sent, we check that your address's domain can receive email (its public DNS records), so a mistyped address is caught at once.
The confirmation email. When you join, we send one email to the address you gave, in the language of the page you joined from, asking you to confirm that the address is yours and that you want to hear from us. Its link works once, within 7 days; if it fades, the page it opens can send you a fresh one. Until you confirm, we send you nothing but confirmation emails. If someone else entered your address, ignore the email, or use its link to tell us it wasn't you, and we'll never write to that address again.
Limits that protect you. Anyone can type anyone's address, so however often yours is entered, it gets at most a few confirmation emails, and only when it is entered again: one every 10 minutes, 3 a day and 5 in all (a fresh link you ask for from an earlier email doesn't count toward the 5). Addresses that differ only by a +tag, or at Gmail only by dots, count as one for these limits, and unsubscribing one of them unsubscribes them all. We send none to an address that unsubscribed, bounced, or marked our email as spam.
When you confirm, we record when, and a keyed hash of the IP address you confirmed from, as proof of your consent. We delete it when you unsubscribe.
What our email provider tells us: whether each email was delivered, bounced or marked as spam. We keep that with the email's record, and stop writing to an address that bounces or marks us as spam.
No tracking in our emails: no tracking pixels, and no links that report your clicks. They show one image, a strip of a painting from our website: when your mail app loads it, our website sees the request as it sees any visit, but the image is the same for everyone and doesn't tell us who opened an email.
Unsubscribe with the link in any of our emails, or with your mail app's unsubscribe button. We stop writing to you and delete the hashes of your IP addresses; we keep your address, marked as unsubscribed, so that we never write to you again, even if someone signs up with it later. To join again, write to us at support@gazum.ai.
Have your address deleted completely by writing to support@gazum.ai.

Moderation and safety

Every photo is checked by OpenAI's moderation service before anything is painted, and a level's photo and painted images are checked again before it can be shared with everyone. Photos with sexual content, violence or self-harm are refused. Players can report levels and block other players. Every report reaches our team for review: a level reported as offensive or as showing a person is hidden at once until it has been reviewed, and we may remove a level, stop an account sharing with everyone, or suspend an account that breaks our Terms.

By link (the default). Anyone you send a level's link to can play it and see its photo and its Elsewhere. Links are long and random, but they work for anyone who has one.
With everyone. If you choose, a finished level appears in the game's feed of community levels, with your short public id. Levels where a person is visible can't be shared with everyone.
Today's Seam is made by us, from our own photos.

Who processes your data for us

OpenAI (United States) reads your photos, paints the levels and moderates photos and images. Under OpenAI's API terms, data sent through its API is not used to train its models. OpenAI may keep API data for up to 30 days to detect abuse, then deletes it.
Amazon Web Services (United States, us-east-1) hosts the game and its website, its database (the waitlist too) and the levels' images.
RevenueCat (United States) verifies purchases and manages the Cartographer's Pass.
Resend (United States) sends our emails: the waitlist's confirmation email now, the launch email later. It receives your email address and each email's content to deliver it, sends them from its servers in São Paulo, Brazil (AWS sa-east-1), keeps a record of each email and whether it was delivered, for a limited time under its own retention policy, and tells us whether it was delivered, bounced or marked as spam. We have turned off its open and click tracking.
Apple and Google run the app stores, under their own privacy policies.

Each of these providers processes your data only to provide its service to us, under its data processing terms. When your data leaves the EEA or the UK, it is protected by the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

How long we keep it

Photos, levels and play: until you delete them or your account.
When you delete your account, your photos, levels, plays, reports and blocks are removed from our database and storage at once. Copies cached by our content delivery network expire within 24 hours, and backup copies (of the database and of stored images) are deleted within 7 days.
Purchase and film records are kept, linked only to your random player id, for as long as tax and accounting law requires (up to 10 years).
The waitlist: until you unsubscribe or ask us to delete your address, and no longer than 12 months after the game's public launch. An address that is never confirmed is deleted 30 days after its last confirmation email.
Hashed IP addresses: a few days; the hashed network of a waitlist sign-up, and the hashed IP address a confirmation came from, until you unsubscribe or your address is deleted.
The record of each email we sent you (when, its language, whether it was delivered, and a one-way hash of its link): as long as your address is on the list.

Deleting your account

In the app, open Settings → Delete my account and confirm. It takes effect at once and can't be undone: your levels stop working for everyone, including people you sent links to, and any film you have left is lost. Deleting your account does not cancel a Cartographer's Pass: cancel it in your App Store or Google Play subscription settings.

If you no longer have the app, write to support@gazum.ai. Because accounts are anonymous, we can only find yours if you send your player id, shown at the bottom of Settings (“Player …”).

Your rights

Depending on where you live (for example in the EEA, the UK or California), you can ask to access, correct, delete or receive a copy of your data, object to how we use it, and withdraw your consent. You can withdraw consent to AI processing at any time: you'll still be able to play, but not to make new levels from your photos. Write to support@gazum.ai; we answer within one month. You can also complain to your data protection authority.

Children

ELSEWHERE is not meant for children under 13, or under the age of digital consent where they live (up to 16 in some EEA countries). We don't knowingly collect their data. If you believe a child is using the game, tell us and we will delete the account.

Security

Connections to the game are encrypted (HTTPS), data is encrypted at rest by our hosting provider, access keys are stored only as hashes, and access to our systems is limited to the people who run them.

Changes

We will post any change here. If a change is significant, we will tell you in the game before it applies.

Notifications, and what the app tells us about how it's used

Added with version 1.1.

Notifications

The app never asks on its first start. After you've sealed your first place, it asks whether you'd like to hear from the game, and only if you say yes does your phone ask for permission. You can turn each kind off in Settings → Notifications, or all of them in your phone's settings.

What we keep: your phone's push token (a random address that Apple's or Google's push service gives the app on this phone), your phone's time zone, the game's language, whether the app is a test build, and which kinds you want to hear: Today's Seam, your streak, your rooms played (and a friend you invited sealing their first place), gifts and swaps, new story pages.
What we use it for: only to send those notifications, in your language, never between 10 pm and 9 am in your time zone, and never more than three a day. We keep a record of each one (its kind, when, and whether it was delivered) for 90 days; the names of other players are removed from it once it has been sent.
Who delivers them: Apple Push Notification service on iPhone, and Firebase Cloud Messaging, a Google service, on Android. They receive the token and the notification's words to deliver it. Firebase is used only to deliver notifications, with no analytics.
Tokens that stop working (Apple or Google tell us when) are deleted, and so is a token we haven't seen for nine months.

Legal basis (EEA and UK): your consent, which you can withdraw at any time in Settings or in your phone's settings.

What the app tells us about how it's used

The game keeps its own small record of a few things our servers can't see, so we can tell what works: when the app is opened, when a share sheet is opened and used (and for which picture or format), when a video is saved or shared, when the prologue is finished, how you answered the question about notifications, and when a notification is opened. Each record holds only that event, a few fixed values, your player id, the platform (iPhone, Android or web), the app's version and the time: no text you typed, no device identifiers, no location, no advertising id.

We don't use any third-party analytics or advertising service, and these records are never shared or sold. We look at them only added up (for example, how many new players seal a first place), on a private page for the people who run the game, and keep them for 13 months.

Legal basis (EEA and UK): our legitimate interest in understanding and improving the game, kept to these few events.

Deleting

Deleting your account deletes your push tokens, your notification settings, the record of your notifications and these usage records, at once.