We process account details, email address, campaign content, character and world data, purchase records, support messages, security logs, and technical information needed to provide and protect the service.

We use this information to perform our contract with you, secure accounts, prevent abuse, process purchases, maintain campaign continuity, answer support requests, comply with legal obligations, and pursue legitimate interests in operating and improving the service.

Campaign prompts and relevant saved context are sent to our AI service providers to generate requested story content, narration, world material, and images. Do not submit highly sensitive personal information that is unnecessary for your story.

We use Supabase for authentication and data infrastructure, Stripe for payments, OpenAI for AI generation, and Resend for transactional email. Each provider processes information for the service it supplies and under its own legal and security obligations.

Campaign and account data is retained while your account is active and removed or anonymised when no longer needed, subject to backups, fraud prevention, disputes, tax, accounting, and other legal retention duties. Payment records may therefore outlive an account.

Under the GDPR and applicable Irish data-protection law, you may request access, correction, deletion, restriction, portability, or objection, subject to applicable limits. You may delete your account in the app or contact us. You may also complain to Ireland's Data Protection Commission or the supervisory authority where you live.

Our providers may process information outside your country. Where required, transfers are protected by recognised safeguards or adequacy arrangements.

We use access controls, private storage, encrypted transport, and restricted server credentials. No system is perfectly secure. We will update this notice when our practices materially change.