Privacy Policy

1. Data controller

The data controller responsible for your personal data is:

2. What data we collect

• Account data: Your email address, collected when you register or log in via Supabase Auth.
• Subscription data: Your subscription tier and payment information, processed by Stripe. We do not store card numbers.
• Chat data: Messages you exchange with AI characters, stored in our database to enable conversation history and AI memory features.
• Usage data: Daily message count and reset timestamps, used to enforce plan limits.
• Analytics data: Anonymous page views and visitor counts via Vercel Analytics (only if you consent).

3. How we use your data

• To provide the chat and novel adventure services you sign up for.
• To manage your subscription and process payments through Stripe.
• To enforce usage limits based on your subscription tier.
• To personalise AI responses using your conversation history (memory feature, paid plans).
• To improve the service using anonymous, aggregated analytics (with your consent).

4. Legal basis (GDPR)

• Contract performance — processing your account and subscription data to deliver the service you paid for.
• Legitimate interests — basic security logging and fraud prevention.
• Consent — analytical cookies and non-essential tracking. You may withdraw consent at any time via the cookie banner.

5. Data sharing

We do not sell your personal data. We share data only with the following processors:

• Supabase — database and authentication hosting (EU/US)
• Groq — AI language model inference (your messages are sent to Groq for response generation)
• OpenAI — text embedding generation for the memory feature (paid plans)
• Stripe — payment processing
• Vercel — website hosting and anonymous analytics (with consent)

6. Data retention

Your account data and chat history are retained for as long as your account is active. You may delete your account and all associated data by contacting us at the address below. Payment records are kept for 7 years as required by Bulgarian and EU law.

7. Your rights

Under GDPR you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your data ("right to be forgotten")
• Object to or restrict processing
• Data portability
• Withdraw consent at any time (this does not affect the lawfulness of processing before withdrawal)

To exercise any of these rights, contact us at the address in section 9. We will respond within 30 days.

8. Cookies

For full details of the cookies and local storage items we use, see our Cookie Policy.

9. Contact

You also have the right to lodge a complaint with the Bulgarian Commission for Personal Data Protection (CPDP), 2 Prof. Tsvetan Lazarov Blvd., Sofia 1592, Bulgaria.