Privacy Policy

1. Information We Collect

Account information: Email address and optional display name, collected during registration.

Shipping address: Name, street address, city, state, zip code, and country, provided voluntarily for merchandise orders.

Campaign content: Session notes, audio recordings, character descriptions, world lore, and other content you provide to the Service. Audio recordings are used only to produce a transcript. A recording is deleted from our storage as soon as its transcription succeeds, and the short clips the live-session listener sends for voice commands are deleted as soon as they have been transcribed. If a transcription fails, we keep the recording so you can retry it; it is deleted when you delete the journal or the campaign. The transcript itself is part of your campaign content.

Recording consent: If you use our audio recording feature, you are responsible for obtaining consent from all participants before recording, as required by applicable laws in your jurisdiction.

Generated content: AI-generated images, journal entries, scene descriptions, and merchandise mockups created through the Service.

Usage data: API usage metrics, generation costs, and feature usage for billing and service improvement.

2. How We Use Your Information

• Authenticate your account and provide access to the Service
• Generate AI art and process campaign content as requested
• Process and fulfill merchandise orders
• Send transactional emails (magic link login, order confirmations)
• Track usage for cost management and rate limiting

3. Third-Party Services

We share specific data with these third-party services as necessary to provide the Service:

• Google (Gemini): Campaign context, character descriptions, and scene prompts — for AI image generation
• OpenAI (GPT): Session text, entity descriptions, and review content — for AI text processing and art direction
• AssemblyAI: Audio recordings — for transcription
• Stripe: Email, shipping address — for payment processing
• Production Partners: Shipping address, product art — for merchandise production and fulfillment
• Cloudflare R2: Generated images and uploaded files — for storage and CDN delivery

4. Data Storage & Security

Account and campaign data is stored in a PostgreSQL database hosted on Neon. Files and images are stored on Cloudflare R2. All data is transmitted over HTTPS. Authentication uses JWT tokens stored in httpOnly cookies with 7-day expiration.

5. Cookies

We use a single authentication cookie (rpgsage-auth) containing a JWT token. This is essential for the Service to function and cannot be opted out of. We do not use tracking cookies, analytics scripts, or advertising cookies.

6. Data Retention

Your account data, campaign content, and generated images are kept for as long as your account or campaign exists. You can delete them yourself at any time from Account & Data (in the “More” menu, also linked from Billing):

• Delete a campaign (campaign admins): cancels the campaign's subscription immediately, then permanently deletes everything in it for all members: art, battlemaps, characters and sheets, journals and transcripts, audio, lore, chat, and dice history. Its stored files are removed from our storage within minutes.
• Delete your account: deletes the campaigns where you are the only member (as above), removes you from campaigns you joined, deletes your comments, and deletes your login, profile, and saved shipping address. If you are the only admin of a campaign other people are in, you will be asked to make someone else an admin or delete that campaign first.

We email you a confirmation when a deletion completes. Payment records (invoices, receipts, and payment history) are kept by our payment processor, Stripe, for legal and accounting purposes. Merchandise orders that are still being paid for, printed, or shipped must finish (or be cancelled through support) before their campaign can be deleted. Deleted data may remain in short-term database backups until they expire on our hosting provider's schedule. Anonymous product feedback you sent us may be kept without any link to your account.

7. Your Rights

You have the right to:

• Access the personal data we hold about you
• Request correction of inaccurate data
• Delete your data: delete a campaign or your whole account yourself from Account & Data, at any time, with no need to contact us (see Data Retention above)
• Export your campaign content and generated images

For anything else, or if you can't sign in to delete your account yourself, contact us at the email below and we will handle it.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes via email or in-app notification.

9. Contact

Questions about privacy? Contact us at support@rpgsage.ai.