Privacy policy

Everything we hold on you, in one list:

a) Account

• Your name, email address and profile picture, from the Google account you sign in with
• A user ID that identifies your account

b) Game data

• The characters you create (name, description, world, style)
• Your play history and the choices you made along the way
• The story text generated during your sessions

c) Payments

• Order ID, amount and status for each purchase
• Your credits purchase history
• We never see or store your card details — checkout is handled entirely by Polar, our merchant of record

d) Technical

• IP address and browser user agent
• Server logs of requests to the service

e) Referral anti-abuse

• A random identifier for your browser, kept in a cookie
• A one-way hash of your IP address — we do not keep the raw IP for this purpose
• Both exist only to catch one person farming referral rewards with extra accounts, and are used for nothing else

f) Product analytics

• Which pages you viewed, when, and on what kind of device, tied to a random ID stored in your browser
• Where you arrived from (referrer, ad campaign parameters) and which country you played from
• Milestones in the product: character created, out of credits, checkout started
• This is only ever read in aggregate to improve the game, and is never sold or shared with third parties for advertising

• Running the game and keeping your progress
• Signing you in and keeping your account secure
• Processing purchases and keeping your credits balance correct
• Generating story content that fits your character
• Improving the product and fixing what is broken
• Measuring, in aggregate, which channels bring players in
• Detecting fraud, abuse and terms violations
• Emailing you about the service when something matters

We do not sell your personal information. We share it only with the companies that make the game run:

• Google — sign-in (OAuth)
• Polar — checkout and payment. Polar Software, Inc. is the merchant of record for every purchase and holds the card details; we receive only the order ID, amount and status
• AI providers — your story text goes to a language model to write the next chapter. It does not carry your email or your real name
• Supabase — database and file storage
• Law enforcement — when a valid legal request requires it

What Polar being the merchant of record means for your money — receipts, the name on your card statement, and what happens to an order that is refunded — is set out in our store policies.

What we have in place:

• TLS on everything in transit
• Row Level Security on the database, so one account cannot read another's data
• Authentication and authorization checks on every request for data
• Rate limiting to blunt abuse

No system is perfectly safe and we will not pretend otherwise. If you find a vulnerability, email us before you tell anyone else and we will fix it.

• Account data stays until you ask us to delete your account
• Game data (characters, play history) stays while the account is active
• Payment records are kept for as long as tax and accounting law requires
• Technical logs are deleted automatically after 90 days

Wherever you play from, you can ask us to:

• Access — send you a copy of what we hold on you
• Correct — fix anything that is wrong
• Delete — erase your account and your personal data
• Export — hand you your data in a portable file

California residents have these rights under the CCPA/CPRA, and we will never charge you or degrade the service for using them. Email us and we will respond within 30 days.

Plotwarp is for players 13 and over, and players under 18 should have a parent's permission. We do not knowingly collect data from children under 13 — if you believe a child under 13 has an account, email us and we will delete it and its data.

We may update this policy. Anything material will be announced on the site, and continuing to play after an update means you accept it.