1. Information we collect
We collect information you provide, information generated when you use authenticated services, and limited technical information needed to operate and protect the site.
| Category | Examples | Primary purpose |
|---|---|---|
| Account & identity | Email address, display name, Firebase user ID, role, permissions, verification status, MFA enrollment metadata. | Authentication, account administration, role-based access, fraud prevention, and security. |
| Portal & business records | Projects, documents, reports, communications, employee/partner/investor/supporter records made available to an authorized account. | Provide the portal functionality a user is authorized to access. |
| Website management | Drafts, published changes, revision notes, page scopes, publisher identity, timestamps, audit events. | Operate Website Studio, review changes, publish safely, investigate misuse, and roll back changes. |
| Commerce | Product or plan identifier, order/payment status, transaction identifiers, saved shipping addresses you choose to store, fulfillment/tracking details, and billing contact information supplied to a payment provider. | Checkout, payment confirmation, shipping, order tracking, refunds, accounting, fraud prevention, and support. |
| Customer preferences | Saved products/favorites, default shipping address, and confirmed public-updates subscription status. | Provide customer account conveniences and preferences you request. |
| Device & technical | IP address, browser/device type, request timestamps, security logs, App Check/reCAPTCHA signals, error and rate-limit events. | Deliver the site, prevent abuse, diagnose failures, and protect accounts. |
| Communications | Messages, support requests, privacy requests, security reports, transactional order/account email, and optional newsletter consent. | Respond to requests, deliver account/order notices, and send public updates only after confirmation. |
2. Information we intentionally do not ask the browser to store
Unity's portal is designed so Firebase ID tokens, access tokens, and refresh tokens are not copied into ordinary localStorage or sessionStorage by Unity application code. Browser storage may still be used for non-secret UI state, such as an optional remembered email address or a temporary marketplace cart.
3. How we use information
- Authenticate users and enforce verified-email, MFA, session, role, and page-scope rules.
- Provide website, portal, software-release, marketplace, store, and Website Studio functions.
- Detect, investigate, and prevent abuse, unauthorized access, fraud, and security incidents.
- Process purchases, subscriptions, refunds, and payment-related support.
- Maintain audit and revision history for privileged actions.
- Respond to support, privacy, accessibility, and security requests.
- Comply with legal obligations and enforce our agreements.
4. Service providers and disclosures
Unity uses service providers to operate the site. Depending on the feature you use, information may be processed by:
- Google Firebase for Authentication, Firestore, Admin authentication functions, and optionally App Check / reCAPTCHA Enterprise.
- Netlify for website hosting, serverless functions, deployment, request routing, and related operational logs.
- Stripe for payment processing. Unity's server controls approved Stripe price identifiers; payment card details are handled through Stripe's payment flow rather than being intentionally stored in Unity's public website code.
- S3-compatible storage providers when Unity uses managed release storage for downloadable software.
- Merchandise or fulfillment providers if you choose a third-party provider storefront or a physical order is fulfilled by that provider.
- Resend when configured for transactional customer email, account messages, support acknowledgements, and confirmed public-update subscriptions.
- Google Fonts or similar content delivery services where the public site loads web assets from those providers.
We may also disclose information when reasonably necessary to comply with law, protect rights or safety, investigate fraud or security incidents, or complete a business transaction subject to appropriate safeguards.
5. Sale, targeted advertising, and profiling
Unity does not currently sell personal data or use personal data for cross-context behavioral or targeted advertising through this website. Unity does not currently use automated profiling through this website to make decisions that produce legal or similarly significant effects. If these practices change, this policy and any required controls will be updated before or when the new processing begins.
6. Cookies, local storage, and similar technologies
See the Cookie & Storage Notice. The current build uses browser storage primarily for authentication/session operation, an optional remembered email address, a temporary cart, and security/anti-abuse functions. The marketplace may load Stripe technology, and Firebase App Check may use Google/reCAPTCHA technology when enabled.
7. Data retention
We retain information only for as long as reasonably necessary for the purpose collected, to provide an active account or service, maintain required business and security records, resolve disputes, enforce agreements, and meet legal obligations. Different records have different retention needs. Privileged security/audit records may be retained longer than ordinary UI state because they can be necessary to investigate misuse or demonstrate account activity.
Unity should periodically review retention settings and delete or de-identify records that no longer have a legitimate operational, contractual, security, or legal purpose.
8. Security
Unity uses layered safeguards described on the Security page, including server-side authorization for protected actions, role-based access, MFA capability, verified-email requirements, session controls, audit events, and rate limiting on sensitive routes. No website, network, or storage system can be guaranteed 100% secure.
9. Email choices
Transactional messages about account security, purchases, refunds, software access, shipping, or support are service messages. Public Unity update emails are optional and use email confirmation before activation. Public-update emails include an unsubscribe mechanism; unsubscribing from public updates does not suppress necessary transactional messages.
10. Your privacy choices and rights
Depending on where you live and whether a particular privacy law applies to Unity's processing, you may have rights to request access, correction, deletion, or portability of personal data and to opt out of certain sales, targeted advertising, or qualifying profiling. Colorado residents may have these rights under the Colorado Privacy Act when its requirements apply.
Unity will also process legally recognized universal opt-out signals, such as Global Privacy Control, for processing to which the signal legally applies. Because this website does not currently sell personal data or use it for targeted advertising, such a signal does not currently change service-essential processing.
Submit requests through Privacy Requests. We may need to authenticate a request before acting on account data. If applicable law provides an appeal right after a denied privacy request, you may submit an appeal through the same channel and clearly label it “Privacy Appeal.”
11. Children and minors
The public website and commercial portal are not directed to children under 13. Unity does not knowingly use this website to collect personal information from children under 13 without appropriate authorization. Additional protections may apply to minors under state law. If you believe a minor's information was submitted improperly, contact us so the matter can be reviewed.
12. International users
Unity and its service providers may process information in the United States and other locations where they operate. If additional international privacy requirements apply to a future Unity service, Unity should add the required transfer and regional disclosures before offering that service in the affected jurisdiction.
13. Changes to this policy
We may update this policy as the website, products, providers, or legal requirements change. The effective date at the top identifies the current version. Material changes should be communicated in a manner appropriate to the change.
14. Contact
For privacy questions or requests, use Privacy Requests or the contact page.