Privacy Policy

Last updated: 2026-09-29

This Privacy Policy describes how Our Story (operating at our-story.ai, "we", "us") collects, uses, and shares information when you use the Service through our website, our iOS or Android app, or any other client we publish. By using the Service you agree to the practices described here.

1. Information we collect

Account information

When you create an account we collect:

• Username
• Email address
• Password (stored only in hashed form using Argon2id; we never store your plaintext password)
• First and last name
• Date of birth (used to verify the 18+ requirement)
• Country code (optional)
• Marketing opt-in preference
• Terms acceptance timestamp

Gameplay content you submit

The Service is a shared-pawn game, so most of the content you submit is, by design, visible to other players. We collect and store:

• Votes and commands you cast on a pawn (verb, target, free-form intent text)
• "After-bang" LLM context notes included in commands
• In-game speech (the say and tell commands). These are game commands: they resolve on the tick and become part of the story, so they persist in the shared world the way any other beat does.
• Viewer chat (the chat panel beside a hero). This is handled differently from everything else in this list: it is passed straight through to the people currently watching and is never written to a database. See Section 5.
• Pawn names, objective descriptions, skill implementation descriptions you create
• World seeds and world names you provide
• Pawn favorites you select
• The history of which user submitted which vote (used for vote attribution and abuse detection)

Anything in this category is treated as shared content: it is visible to other participants in the same world or pawn and persists in the shared world state.

Feedback and bug reports you send us

When you use the feedback form at /feedback we collect and store:

• What you wrote (the message itself, exactly as you typed it)
• Which kind of thing it is (something is broken, an idea, or something else)
• The page you came from, captured from the link you followed rather than typed. It is a path only, such as /guide, and anything after a ? or a # is cut off before it is stored, so a token or a campaign identifier in a link cannot be recorded.
• Your account, when you are signed in
• An email address, only when you are signed out and only if you choose to give one. It is there so we can reach you about that one message. It is never verified, it is never used to sign you in, and it is not added to any mailing list. Marketing consent is the separate preference described under Account information above.

You do not need an account to send feedback. When you are signed in we attach your account and do not ask you for an address.

This is not the same thing as a moderation report. A report is about a person or their content and goes to a moderator (Section 11); feedback is about the Service and goes to the people who build it. The two are stored separately and neither one reaches the other's queue.

AI generation inputs and outputs

When we generate narration, descriptions, or images on your behalf or on the shared world's behalf, we collect:

• Prompts and context sent to our LLM and image-generation providers (which can include any of the gameplay content above)
• The LLM/image responses themselves, including generated text, JSON metadata, and image URLs
• Logs of generation use cases, timing, and outcomes for debugging, abuse review, and quality improvement

Technical and session data

• Authentication session (JWT cookie)
• Approximate IP and user-agent from server logs
• GraphQL subscription connection state while you have the Service open

On-device storage

The web client stores some data in your browser's localStorage and sessionStorage, including a cached verb-catalog manifest, UI preferences, and tutorial dismissal flags. The iOS and Android apps may use the platform's equivalent local-storage mechanism for the same purposes. This local data is not transmitted to our servers unless an action requires it.

2. How we use your information

We use the information we collect to:

• Operate the Service: authenticate you, run the shared simulation, deliver subscriptions, resolve votes, and run the game world tick-by-tick.
• Generate AI content: produce narration, descriptions, dialogue, and imagery using third-party LLM and image-generation providers (see Section 3).
• Moderate: detect abusive content, abusive prompts, and Terms violations, and take corrective action.
• Debug and improve: investigate incidents, fix bugs, and improve gameplay balance and AI prompt quality.
• Communicate with you: send account, security, and (if you have opted in) product-update emails.

We do not sell your personal information.

3. Third-party providers we share data with

To run the Service we share data with the following categories of provider. We minimize what is shared and use providers only for the purpose listed.

LLM providers (OpenAI, TypeSafe)

Most prompts are routed through OpenRouter, an aggregator that forwards each prompt to an upstream model provider. The providers we send data to for generating and checking game content are OpenRouter, OpenAI, TypeSafe, and Replicate.

• Data shared: prompts and context (which may include your gameplay-content submissions, pawn state, and world state) required to produce narration or AI decisions.
• Purpose: generate text completions, AI pawn decisions, and structured narration.

Image-generation providers (Replicate, running ByteDance's Seedream model)

• Data shared: text prompts describing pawns, scenes, or objectives.
• Purpose: generate avatar and scene imagery for the shared world.

Image moderation (OpenAI)

• Data shared: the image we just generated (a pawn portrait, a community founder's hero portrait, or an objective-completion image), sent as image data for a safety classification before it is stored or shown to anyone.
• Purpose: screen generated images for disallowed content before they are cached or served. World, region, node, mob, and boss imagery is never sent here: only images seeded by user- or LLM-authored free text are.

Cloud hosting and database providers (Google Cloud Platform)

• Data shared: all stored Service data (account records, hashed passwords, world state, generated images, logs).
• Purpose: host the database, Redis cache, object storage, and backend servers.

Bot-defence and image hosting (Cloudflare)

• Data shared: for the signup challenge, your IP address, browser characteristics, and the metadata of the challenge you solved. Separately, every image the Service generates is uploaded to Cloudflare Images and served to every visitor from Cloudflare's CDN.
• Purpose: Cloudflare Turnstile decides whether the visitor completing the signup form is a person. Cloudflare Images stores and delivers the pictures the Service generates.

Streaming platform account linking (Twitch)

• Data shared: when you link a Twitch account, from Account Settings or the streamer dashboard, we exchange the authorization code Twitch gives us for an access and refresh token, and Twitch returns your Twitch user ID and login name. The token is stored encrypted at rest.
• Purpose: identify which Twitch channel controls a streamer hero, and read that channel's chat so votes cast there can be counted.

Transactional email (Mailgun)

• Data shared: your email address and delivery metadata such as whether a message was delivered or bounced.
• Purpose: send the account emails you cannot opt out of, principally password resets. Marketing email, if you opted in, goes the same way.

On-device voice model hosts and content delivery networks (huggingface.co, cdn.jsdelivr.net)

This one works differently from the providers above: we do not send anything. When you turn on the optional narration voice, your browser downloads the speech model directly from these hosts, so they receive your connection details without our servers in the middle. It applies only while the voice is on. The narrator is off by default, nothing here is fetched until you turn it on with the Voice control in the audio settings, and every visit starts with it off again.

• Data shared: your IP address and browser user-agent, disclosed directly by your browser to the hosts serving the model files. No gameplay content, no account data, and none of the text being read aloud: speech synthesis runs on your device, so the words never leave your browser.
• Purpose: deliver the speech-synthesis model weights and voice embeddings (from huggingface.co, including the cdn-lfs file-delivery subdomains it redirects to) and the WebAssembly runtime that runs the model (from cdn.jsdelivr.net), so narration audio can be generated locally in your browser.

Payment processor (Stripe)

Stripe processes payments for subscriptions and community pools. Card details are entered on Stripe's own hosted checkout and billing pages, which means they go from your browser to Stripe directly. The Service never receives them and never stores them.

• Data shared: your email address, and the record of what was bought. The billing address and card details you enter go to Stripe, not to us.
• Purpose: take payment, run the hosted checkout and billing portal, and give us back a customer reference and a subscription status so the account knows what it is entitled to.

Mobile app stores (when iOS/Android clients ship)

• Data shared: as required by the store (anonymous device identifiers, crash reports, in-app purchase receipts if offered).
• Purpose: distribute the app, deliver updates, process platform-billed purchases.

4. Cookies and tokens

The auth_token cookie is essential; the Service will not function while signed in without it. It is HTTP-only (not readable by JavaScript) and transmitted only over HTTPS in production.

5. Data retention

• Account data: retained for as long as your account is active.
• Shared-world content (votes, in-game say and tell speech, generated narrative and images): retained as part of the shared world after your account is closed, because removing it would damage other players' story state. We will, on request, disassociate your account identifier from your past contributions where technically practical.
• AI request logs: 7 days. Every prompt we send to a model provider, for narration or for image generation, and every response we get back, is written to a request log we use for debugging and abuse review. A rolling delete removes each entry once it is more than 7 days old, and a size cap on each log file removes the oldest entries of a busy log sooner than that. These logs record which character a request was about and never who typed it. A character here is voted on by a crowd, so a single entry can hold several different people's words inside one prompt, and the record carries no account identifier to match on. They are therefore not attributable to an individual account, and we do not search them or delete from them in response to an individual request. The 7 day window is what limits them instead, and nothing in them outlives it.
• Prompts already sent to a model provider. Once a prompt has left us, what that provider keeps is governed by its own retention terms, which we do not control. We do not recall or delete individual prompts from a provider when an account is deleted, and we do not claim to. Section 3 lists the providers we send prompts to.
• Viewer chat: not retained at all. A message you send in the chat panel is delivered live to the people watching at that moment and is never written to a database. It is not replayed to somebody who joins afterwards, and there is no chat history for us to export, search, or hand over. The only durable trace it can leave is described in Section 11: if the moderation filter refuses it, we record the reason code and who sent it, and never the text. This does not cover the in-game say and tell commands, which are moves in the game rather than chat, and which persist with the rest of the shared story under the bullet above.
• Billing records: kept after your account is deleted. Tax and accounting law requires the operator to keep the financial record of a payment, so the billing customer record and the subscription history are retained for 7 years from the transaction and are not removed by an account deletion request. This is the Article 17(3)(b) exemption to erasure, and Section 12 sets out exactly which rows are kept and what they contain.
• Operational backups: up to 7 days. The database is backed up once a day, and point-in-time recovery keeps transaction logs for 7 days, so the Service can be restored if it fails or its data is corrupted. Backups exist only for that purpose. They are never queried, never used to build a profile of you, and never consulted to answer a question about your account. When an account deletion is carried out it takes effect immediately in the live database, and your data then ages out of the backups as they cycle, within 7 days. The in-memory game store is snapshotted hourly and each snapshot replaces the one before it, so its window is one hour rather than seven days. If we ever restore from a backup, we re-apply any account deletions that happened after the moment that backup was taken, so a restore cannot bring a deleted account back.
• Feedback and bug reports: kept while they are still useful, and deleted with your account. A message you send through /feedback is kept so it can be read and acted on, and there is no fixed expiry on it, because a bug report stays relevant until the bug is gone. If you sent it while signed in, it is deleted when your account is deleted, along with your account: it is text you wrote, not a record we are obliged to keep, so an erasure takes it. If you sent it while signed out, there is no account for a deletion to reach, so write to the address in Section 14 and name what you sent and we will remove it.
• Server logs: retained for a limited window for security and incident response.
• Local-storage data: persists on your device until you clear it.

6. Data security

We implement reasonable security measures, including:

• Password hashing using Argon2id.
• HTTPS for all data in transit between client and server in production.
• HTTP-only Secure SameSite cookies for authentication tokens.
• JWT session tokens signed and validated on every request.
• Redis and Postgres access scoped to the backend service.

No system is 100% secure. We cannot guarantee absolute security and you use the Service at your own risk.

7. Your rights

Depending on your jurisdiction you may have the right to:

• Access a copy of the personal information we hold about you.
• Correct inaccurate or incomplete information.
• Delete your account; see Section 5 for what happens to shared-world contributions you have already made.
• Withdraw consent for marketing communications at any time.
• Object to certain processing.
• Export your account data in a machine-readable format (data portability).

To exercise these rights, contact us at sam@itsmystory.ai.

8. Children's privacy

The Service is not intended for anyone under 18. We collect date of birth at signup and reject accounts that fail the 18+ check. If we learn we have collected personal information from someone under 18, we will delete it. If you believe we have collected information from a minor, please email us.

9. International users

The Service is operated from the United States and data is processed in the United States and in the regions our cloud providers operate. By using the Service from outside the United States you consent to this transfer.

10. Mobile platforms

If you access the Service through our iOS or Android app, the platform you use (Apple iOS or Google Android) may collect its own diagnostic, crash, and purchase data subject to that platform's own privacy policy. We receive only the aggregate or pseudonymous data the platform forwards to us (for example, anonymous crash traces or in-app-purchase receipts).

11. Who can read what you submit

Nothing you submit inside the game is private from the other people playing it. That is the design rather than a limitation, and Section 2 of the Terms says the same thing. Votes, command text, "after !" context notes, say, tell and viewer chat are all readable by the other participants sharing that character, and the free text among them is also sent to our LLM providers as prompt context.

Moderators can see that content too. Three kinds of person hold moderation authority, and their powers differ:

• Us, as operator. We can reach stored account and world data for support, security, abuse investigation and legal compliance.
• The streamer a hero is bound to, for that hero only, and with the power to remove somebody from that hero and nothing else. A streamer can never suspend an account.
• Approved community moderators for public characters, with the same remove-only power.

What a moderator's view actually shows is deliberately narrow. The moderator panel renders a display name and a platform handle, and nothing else. It does not show your email address, your IP address, or your account identifier, and it is built that way because the view is meant to be safe if it appears on a live stream. The list of who recently took part in a character is kept only for a limited time and is capped per character; it is not a permanent record of who played with whom.

When the moderation filter refuses something you submitted, we record the category of rule that refused it, the character it was aimed at, and your account, so that repeated attempts can be acted on. We do not record the text that was refused. The one deliberate exception is our own generated narration: when the consistency checker rejects a line the model wrote, that line and its prompt are stored so the failure can be debugged. That is text the Service produced, not text you submitted.

We do not use silent removal of accounts. If you are suspended or removed from a character you are told, without being shown a moderator's private notes.

Moderation actions are recorded and kept. Separately from the refusals above, we keep one record of every moderation action taken against a person, whether a moderator took it or the Service took it automatically. It holds the action, who it was against, where it happened, a reason code from a fixed list, and, for a human action, that moderator's stated reason. It does not hold what you wrote and does not name the rule that matched. These records do not expire, and lifting a suspension does not delete them, because the case where somebody asks what happened to their account is precisely the case where the enforcement is already over. See the Moderation Policy for how to ask.

Feedback you send us is read by us and by nobody else. A message sent through /feedback goes to an internal page only the operator can open. It is not shown to other players, it is not shown to a streamer or a community moderator, it is not published anywhere, and it is not sent to an LLM provider as prompt context. Nothing in the Service replies to it automatically, so if you want to be reachable about it, leave an address.

How we moderate, and what the filters actually do, is set out in full in the Moderation Policy. What is expected of you is in the Community Guidelines.

12. Payments and billing records

This section applies only if you have paid for something. It is separate from Section 5 because the retention rule is different, and because the difference is one people are entitled to know about before they buy.

What we store. A customer reference issued by Stripe, the email address the payment was made under, and one record per subscription: which product, its status, the billing period it runs to, and whether it is set to cancel.

We also store one record per purchase of what you agreed to, taken at the moment you agreed: the wording that was on the screen, verbatim, the version of the Terms in force at the time, and when you accepted. It is stored verbatim rather than as a version number so that the record answers the question by itself, instead of pointing at wording somebody would have to go and reconstruct. Nothing in the Service ever edits or deletes one of these rows, because a record that could be rewritten is not a record.

What we never store. Card numbers, expiry dates, security codes, or any other payment credential. Those are entered on Stripe's pages and held by Stripe. They are never sent to the Service.

Deletion does not remove billing records. When you delete your account we remove everything the law allows us to remove, and we keep the records it does not. The financial record of a payment is one that tax and accounting law requires us to retain, so the billing customer record and the subscription history survive for 7 years from the transaction. The legal basis is compliance with a legal obligation under Article 6(1)(c), retained under the Article 17(3)(b) exemption to the right to erasure.

Your data export says exactly this. The export you can download from your account settings includes the billing records we hold and a retention notice listing every category that an account deletion would keep, what it contains, the legal basis, and the retention period. A record kept without telling you is not an exemption we are willing to rely on, so the notice is in the export whether or not you have ever paid.

Stripe holds its own copy of the payment data it processed, under its own privacy policy and its own retention rules. To exercise a right against that copy, contact Stripe directly. Section 3 lists it as a sub-processor for exactly this reason.

13. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top reflects the most recent revision. Material changes will be announced in-product or by email where we have a verified address on file.

14. Contact

If you have questions, concerns, or requests regarding this Privacy Policy or your personal data, email us at sam@itsmystory.ai.