Legal
Privacy Policy
Last updated: June 2026 · Applies to all users of Aethrym
This Privacy Policy complies with the EU General Data Protection Regulation (GDPR). As a user based in the EU, you have specific rights regarding your personal data described in Section 8.
1. Data Controller
The data controller for Aethrym is:
[YOUR FULL NAME]
Email: [YOUR EMAIL]
2. What Data We Collect
We collect the following personal data:
- Account data: Email address, name (if provided via Google OAuth), hashed password
- Game data: Character names, classes, races, and the content of your game sessions (messages between you and the AI Game Master)
- Usage data: Session timestamps, IP address, browser type
- Payment data: If you subscribe to a paid plan, payment is processed by Stripe. We do not store card details — Stripe handles all payment data under their own privacy policy.
3. Why We Collect It (Legal Basis)
- Contract performance: To provide the game service you signed up for (account, characters, sessions)
- Legitimate interests: To improve the service, prevent abuse, and maintain security
- Legal obligation: To comply with applicable laws
- Consent: For any marketing emails — you can withdraw consent at any time
4. How We Use Your Data
- To create and manage your account
- To save your characters and game history
- To process your subscription payments via Stripe
- To send transactional emails (account confirmation, password reset)
- To detect and prevent fraud or abuse
- To improve the AI Game Master experience
We do not sell your personal data to third parties.
5. AI Processing
Aethrym uses Anthropic's Claude API to power the AI Game Master. Your game session messages are sent to Anthropic's API for processing. Anthropic processes this data under their own Privacy Policy and Usage Policy.
We do not use your game content to train AI models.
6. Data Storage and Retention
Your data is stored in a SQLite database hosted on [YOUR HOSTING PROVIDER — e.g. Railway]. We retain your data for as long as your account is active. If you delete your account, your data is permanently deleted within 30 days.
Session backups may be retained for up to 90 days for security purposes.
7. Content Moderation and Review
To keep Aethrym safe and fair, authorized members of our team may access and review the content of your game sessions (messages between you and the AI Game Master). We do this to:
- Detect and investigate cheating, exploits, or attempts to manipulate the AI (e.g. prompt injection)
- Enforce our Terms of Service and investigate reported violations
- Resolve technical issues and player disputes
- Analyze how players interact with the game to improve the AI Game Master
Access is limited to authorized personnel and used only for the purposes above. We do not review session content for advertising, and we do not share it with third parties except as described in this policy (see AI Processing and Third-Party Services).
9. Your Rights (GDPR)
As an EU resident, you have the right to:
- Access — Request a copy of your personal data
- Rectification — Correct inaccurate data
- Erasure — Request deletion of your data ("right to be forgotten")
- Portability — Receive your data in a machine-readable format
- Restriction — Limit how we process your data
- Objection — Object to processing based on legitimate interests
- Withdraw consent — At any time, for consent-based processing
To exercise any of these rights, contact us at [YOUR EMAIL]. We will respond within 30 days.
You also have the right to lodge a complaint with your local data protection authority.
10. Cookies
Aethrym uses only essential cookies required for authentication (session token). We do not use tracking cookies or third-party advertising cookies.
11. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you by email or via the Service before material changes take effect. The date at the top of this page indicates when it was last revised.
12. Contact
For any privacy-related questions or requests:
[YOUR EMAIL]