Privacy Policy
Last updated: 2026-08-09
This Privacy Policy explains what information RulesForge collects, how it is used, and the choices you have. We collect only what we need to run the service.
1. Information you give us
When you create an account we collect an email address (or a username on self-hosted installs), a display name, a unique @username, an optional date of birth (used to confirm you are 13+), and a password handled by our authentication provider (Clerk). You may add optional profile details like an avatar or bio.
2. Content you create
Your stories, characters, library entries, custom game systems, multiplayer messages, forum posts, and direct messages are stored so the service can work — for example, so the Game Master remembers your campaign and your library syncs across devices.
3. How AI processing works
To generate story content, the relevant parts of your story (your messages, characters, and story history) are sent to an AI model provider for processing. If you connect your own API key, that content goes to the provider you chose under your own account. We do not sell your content or use it to train models. To help the Game Master remember long campaigns, we may also store numeric “embeddings” of story messages (a mathematical representation used for memory search, not readable text on its own). Embeddings are part of your story data and are deleted along with it.
3a. Quality-control and troubleshooting logs
To keep stories working well, we keep temporary diagnostic logs for some accounts. New accounts are included in this logging for a limited period after signup (currently 14 days), and we may also enable it for an account while investigating a problem you report. These logs can include your requests to the service, your story turns — the actions you type and the AI storyteller's replies, recorded as written — and technical context such as your device platform and any error you hit. Passwords are never captured, and sensitive account fields (email addresses, dates of birth) are scrubbed from request logs before anything is written; story text itself is stored as-is, so anything you choose to type into a story may appear in these logs. They are used only for quality control and troubleshooting, are visible only to administrators, and are automatically deleted after 14 days.
4. Voice chat and voice messages
Real-time voice calls (in multiplayer rooms and 1:1 calls) use WebRTC: audio streams directly between participants' devices and is not recorded or stored on our servers. If your device requires a relay to connect, audio passes through a relay server in encrypted form without being stored. Voice messages are different: when you deliberately record and send a voice message in a multiplayer room, that recording is stored so recipients can play it, and is automatically deleted after a short retention period (7 days, unless a different window is shown in the app). Microphone access is used only while you are in a call or recording a voice message, and you can revoke it in your device settings.
5. Payments
If you buy a subscription or point pack, payment is processed by our payment provider (Stripe). We never see or store your full card details; we receive confirmation of the purchase and your plan status.
6. What other players can see
Your @username, display name, avatar, and bio are visible to other players. Optional details like your full name or date of birth are private unless you turn on their visibility in your profile settings. What you post in multiplayer rooms and forums is visible to the players in those spaces.
7. Cookies and sessions
We use the minimum technical storage needed to keep you signed in and remember device preferences (like your theme). We do not run third-party advertising trackers.
7a. Push notifications
If you turn on notifications (for example, alerts about events involving your character), the app stores a push notification token for your device along with your notification preferences, and uses it only to deliver the notifications you asked for. Turning notifications off, or removing the app, stops this; you can also revoke notification permission in your device settings.
7b. Referrals
If you join using another player's referral code (or share yours), we record the referral connection and any rewards earned from it so referral bonuses can be granted and abuse prevented.
8. Data retention and deletion
Your data is kept while your account is active so it can sync across your devices. You can delete your account directly in the app. Deletion starts a 14-day grace period: your account is locked and hidden from other players immediately, and you can restore it by signing back in during that window (we send a reminder email shortly before the window ends). After the grace period, your data is permanently erased. A few things are kept longer: payment records held by our payment processor as required by law, moderation records where needed for safety, and a one-way scrambled (hashed) version of your email address used solely to prevent repeat free-trial abuse — it cannot be turned back into your email address. Diagnostic logs (section 3a) and voice messages (section 4) delete themselves on their own shorter schedules.
9. Children
RulesForge is not intended for children under 13, and we do not knowingly collect their data. If you believe a child under 13 has an account, contact us and we will delete it.
10. Security
We use reputable providers for authentication and payments, and we protect stored data with industry-standard measures. No online service can promise perfect security, so please use a strong, unique password.
11. Changes and contact
If this policy changes materially, we will let you know in the app. Questions or requests about your data can be sent through the app's support or forum channels.