Privacy Policy

1. Information we collect

Account information

• Your username (which you choose and which other players can see), your account ID and the date you created your account.
• Your sign-in details, which are handled by Google Firebase Authentication:
  • Email and password: your email address and password. Firebase stores your password in a securely hashed form. We never see or store it.
  • Continue with Google: your name, email address and profile picture from your Google Account (see section 3).
  • Sign in with Apple: your name and email address, or an Apple private relay address if you choose to hide your email.
• Your email address is kept by Firebase Authentication, not in our game database. It is used for sign-in, email verification and password resets.
• Session tokens that keep you signed in.

Games and content you create

• Adventures you create or edit, including worlds, story blurbs, characters, items, maps, story events and game settings.
• Your gameplay: the actions and messages you type, the AI-generated narration, images and audio, and your game state (such as health, inventory and locations).
• Games you publish and games you like. Published games can be viewed and played by anyone using Fantasy Forge. Unpublished games are visible only to you and the players you invite.
• Reports you submit about games or AI-generated content.

Friends and multiplayer

• Your friends list, friend requests and game invitations.
• The games you have joined. Other players in a game can see your username and the messages and actions you post in that game.

Live voice chat

• If you use live voice chat and grant microphone permission, the app records your voice only while you are talking to a character. The recording is sent to our server, converted to text and then discarded. We do not store your voice recordings.
• The transcript, the character's reply and a short summary of the conversation become part of your game's story.
• We never use your voice to identify you, create voiceprints or clone your voice.

Purchases

• Payments for tokens and memberships are processed by Google Play, the Apple App Store, or on the web by RevenueCat and Stripe. We never receive your full card number.
• We receive and keep a record of each purchase (store, product, transaction ID, status and subscription dates), along with your token balance and token history.

Settings stored on your device

• Preferences such as sound settings and whether mature themes are enabled are stored locally on your device or in your browser, together with the information needed to keep you signed in.

Technical information

• Like any online service, our servers receive your device's IP address and basic request information when the app connects. We use this only to deliver the service and keep it secure. We do not store IP addresses in our database or use them to track you.
• Our server logs may briefly contain usernames and fragments of game or voice-chat text. We use these logs only to troubleshoot problems.

What we don't collect: advertising IDs, precise location, your contacts, or photos and files from your device. We do not use analytics, advertising or crash-reporting SDKs.

2. How we use information

• To provide the service: accounts and sign-in, creating and playing games, multiplayer lobbies, friends, and publishing.
• To generate AI content: we send your prompts and the relevant game context to AI providers to generate narration, images, speech and transcriptions.
• To process purchases: we use purchase records to manage your token balance and membership.
• To keep the service safe: preventing abuse, reviewing reported content, enforcing our rules and fixing bugs.
• To communicate with you: essential account emails (such as verification and password resets), sent through Firebase Authentication, and replies to your support requests.
• To comply with the law and respond to lawful requests.

We do not use your information for advertising, we do not sell it, and we do not use your content to train AI models. We do not send marketing emails or push notifications.

3. Google user data

When you choose Continue with Google, you authorise Google to share your basic profile with Fantasy Forge through Firebase Authentication.

• What we access: your name, email address and profile picture, which are the standard openid, email and profile permissions. We do not request access to Gmail, Google Drive, Contacts, Calendar or any other Google service or data.
• How we use it: only to create your account, sign you in, keep your account secure and confirm that your email address is verified. In game, other players know you by the username you choose, not your Google name or picture.
• How it is stored: your Google profile is held by Google Firebase Authentication. We do not copy your Google name, email address or picture into our game database.
• Sharing: we do not sell, rent or share your Google user data. We do not use it for advertising or to train AI models, and we do not send it to our AI providers.
• Deletion: deleting your Fantasy Forge account deletes your Firebase Authentication record. You can also remove Fantasy Forge's access at any time from your Google Account permissions page.

Fantasy Forge's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

4. Sharing

We do not sell or rent your personal information, and we do not share it for advertising. We share information only:

• With service providers that process it on our behalf to run Fantasy Forge (see section 5).
• With other players, as part of how the game works: your username, the games you publish, and your messages and actions in games you share with others.
• When required by law, or when needed to protect the rights, safety or security of our users, the public or Fantasy Forge.
• If Fantasy Forge is sold or transferred to a new owner. In that case, this policy would continue to apply to your information.

5. Service providers, including AI providers

These providers process information on our behalf, only as needed to deliver their part of the service.

Important notes about AI providers:

• AI providers receive only the content needed for each request, such as your prompts, actions and the relevant game context. They do not receive your email address or Google profile information.
• Each provider handles this content under its own terms. Some keep request data for limited periods, for example to monitor abuse. See the links above for their retention and training practices.
• Please avoid entering sensitive personal information (such as health information or contact details) into prompts, chats or game content.

6. Storage, security and international transfers

• Where your data is stored: game data is stored by us on a secured, encrypted system located in Queensland, Australia. Authentication data is stored by Google Firebase Authentication in Google's cloud infrastructure.
• International transfers: our service providers may process your information outside Australia. This includes the United States (Google, Apple, RevenueCat, Stripe, xAI, OpenAI and Replicate), China (DeepSeek) and Singapore (Alibaba Cloud). Privacy laws in those countries may differ from Australia's. We send providers only what each request needs.
• How we protect it:
  • Encryption in transit (TLS) and encryption at rest.
  • Access controls and least-privilege access.
  • Regular updates, patching and monitoring.
  • Incident-response procedures, including notifying affected users and regulators of data breaches where the law requires it.

No online service can be perfectly secure, but we work hard to protect your information.

7. Data retention and deletion

• We keep your account and content for as long as your account is active.
• Deleting your account (Profile → Account Settings → Delete Account) immediately and permanently deletes your Firebase Authentication account. It also removes from our database your profile, the games you created (including their chat history), your published games, friendships, invitations, likes, and your token and subscription records. We do not keep backups.
• Messages you posted in games owned by other players stay in those games' story history so the story still makes sense for them, but they are no longer linked to your account.
• Deleting your account does not cancel an active subscription. Please cancel it first in Google Play, the App Store, or the subscription settings in the web app.
• Google, Apple, RevenueCat and Stripe keep their own purchase records as required for tax, accounting and legal purposes.
• Voice-chat recordings are discarded as soon as they have been transcribed.
• AI providers may keep request logs for a limited time, as described in their policies.
• If others have viewed, copied or shared your published content outside Fantasy Forge, we cannot remove those independent copies.

See step-by-step instructions: How to delete your Fantasy Forge account.

8. Your rights and choices

• Deletion: delete your account in the app at any time.
• Access, correction and export: email thatmewh@gmail.com to request a copy of your data or ask us to correct it. We don't yet offer a self-service export, so we handle these requests individually.
• Permissions: you can turn off microphone access in your device settings at any time. Voice chat simply won't be available. You can also remove Google or Apple sign-in access from your Google Account or Apple ID settings.
• Identity verification: we verify requests through your signed-in account or by email verification using Firebase Authentication.
• Response time: we aim to respond to privacy requests within 30 days.
• Where you live: depending on your location (for example the EU, the UK or California), you may have additional rights, such as the right to object to or restrict certain processing. We will respond to privacy requests wherever you live.

For Australian residents, you may also lodge a complaint with the Office of the Australian Information Commissioner (OAIC): oaic.gov.au/privacy/privacy-complaints. We appreciate the chance to resolve issues directly first.

9. Cookies and browser storage

• This website uses no cookies, analytics or tracking. Fonts and images are hosted with the site itself. The site is hosted on GitHub Pages, and GitHub may log visitors' IP addresses for security purposes (see the GitHub Privacy Statement).
• The web app uses browser storage to keep you signed in and remember your preferences. Firebase sign-in and the RevenueCat and Stripe checkout may set cookies that are strictly necessary for sign-in, fraud prevention and payment.
• We do not use advertising or tracking cookies.

10. Children and mature content

Fantasy Forge is intended for users aged 13 and over. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information, please contact us and we will delete it.

Mature themes are off by default. Only users who confirm they are 18 or older can turn them on, and that preference is stored on your device.

11. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will change the “Last updated” date above. For material changes, we will also let you know in the app or on this website.

12. Contact us

Email: thatmewh@gmail.com

Postal: Matthew Hinz, 75 Whitmore Street, Taringa QLD 4068, Brisbane, Australia