Privacy Notice
Version 2026-10-24 · Applies to MythosLoom
A first draft, written by the project rather than by a lawyer, and not legally reviewed. It describes what the software actually does today, which is the part worth getting right first.
What we hold
Everything below is listed because the software holds it. If something is not on this list, we are not keeping it.
| What | Why |
|---|---|
| Email address | Signing in, confirming the account, and resetting a forgotten password |
| Display name | What other players see instead of your email address |
| Password hash | Signing in. We never hold your password itself, only a hash of it |
| Authentication factors | Passkeys or two-factor secrets, if you set them up |
| Sign-in timestamps and failed attempt counts | Locking an account after repeated failures, so nobody can guess at your password indefinitely |
| Terms acceptance | Which version of the terms you accepted, and when |
| Sign-up date | When the account was created, so unconfirmed accounts can be tidied away and we can count how many people join |
| Roles | Whether the account is an administrator or a beta tester. Ordinary accounts hold neither |
| Network (IP) address | Recorded when you register, sign in, fail to sign in or reset your password, so we can recognise automated sign-ups and abuse coming from one place. Removed after 90 days |
| Your content | The characters, campaigns and notes you create |
| Story suggestions | Only if you ask for one while describing a character: what was sent (your character's choices, the story you had written so far, and any line or setting you added) and what came back, so we can judge how good suggestions are. Removed after 90 days, or with the character if you delete it first |
What we deliberately do not hold
- Your age or date of birth. The terms state a minimum age of 13 and accepting them is the declaration. We do not ask, and there is no field for it.
- Your real name, unless you choose to use it as your display name.
- Your postal address.
- Payment card details. Paid features arrive in a later phase and will use a payment provider; card numbers will not reach us.
Who else sees it
- An email delivery provider sends your confirmation and password-reset messages, and therefore handles your email address and the contents of those messages. (Which provider is a deployment setting and has not been chosen yet. It must be named here before the service is offered publicly — this notice is not finished until it is.)
- The hosting provider runs the servers and therefore holds the database and the logs.
- An AI model provider writes a story suggestion when you press Suggest. It receives your character's choices, what you have written of its story, and any line or setting you added — never your email address, display name or anything else about your account. Requests go through OpenRouter to the host of the model in use, and our account there refuses hosts that train on what they are sent. Suggestions are offered to beta testers only for now.
- Cloudflare Turnstile checks that a sign-up comes from a person rather than a program. When you open the registration form, Cloudflare's script runs in your browser and Cloudflare sees what any website sees of a visit — your network address and details of your browser — under Cloudflare's privacy policy. We send Cloudflare only the answer its script gave, never your email address.
- Other players, for content you deliberately share — the other people in a campaign you join see your characters in that campaign. They never see your email address.
We do not sell your data, and we do not use it to train models.
Logs
Application logs record what happened during a request, including the identifier of the signed-in account. They do not contain passwords, password-reset links, or email addresses that did not match an account.
Administrative actions against accounts are recorded in an audit log — who did what, to which account, and when. That record exists because it is evidence about how the service's operators behave, not only about users, and it is not editable from the console.
Audit entries about your own account — registering, signing in, a failed sign-in, a password reset — carry the network address they came from. That address is removed after 90 days, while the entry itself stays. The application logs never record it.
When something goes wrong, a record of the error is kept for 14 days so it can be fixed: what failed,
the page's address without anything after the ?, and the identifier of the account that was signed in.
Retention is not yet decided for anything else. Until it is, logs and audit entries are kept. This notice will state a period before the service is offered publicly.
Your account, in your hands
- See everything we hold: your profile has a download that gives you your personal data as a JSON file.
- Delete it: your profile can close your account. It is disabled immediately and permanently removed 30 days later, so a decision made in anger or by accident can still be undone — contact us before the date and we can put it back. After that date it cannot be recovered. The confirmation screen states the date before you commit to it.
- Correct it: your display name can be changed at any time from your profile.
Cookies
The only cookies are the ones that keep you signed in and protect forms against cross-site request forgery. There is no analytics, advertising or tracking cookie.
Changes
If this notice changes materially, we will tell the address on your account.
Getting in touch
Questions about your data, or a request to have it removed: use the contact address published on the site.