Privacy Policy

What this covers

How RPG Furnace collects, uses and stores personal data, and what you can do about it.

Who is responsible

RPG Furnace is operated by Allan Leslie, who is the data controller for the personal information described here. Reach us through the contact page with any question about this policy, including a request to see or to delete what we hold about you.

What we collect

Because you gave it to us. Your email address, username, display name, and the password you chose — stored only as a hash, never as text we could read. Optionally a profile picture and a biography.

Because you used the Service. The characters, campaigns, chats, worlds and books you create. Images, audio and video you generate or upload. Which campaigns you joined and when.

Because the Service has to work. Sign-in sessions, security events such as failed sign-in attempts, and the record of what you spent Coins on. Two-factor secrets, encrypted.

Because things cost money. If you buy Coins, our payment provider handles the card details — we never see or store them. We keep a record that a purchase happened, what it was for and what it cost.

What we do with it

• Run the Service and keep your account working.
• Send AI providers what is needed to generate what you asked for.
• Bill you accurately, and be able to show why you were billed.
• Keep the Service secure, and investigate abuse.
• Meet legal obligations, including keeping financial records.

We do not sell personal data. We do not use your content to train AI models of our own.

AI providers

Generating something means sending the relevant prompt and context to a third-party AI provider. Those providers process it under their own terms. You can supply your own provider key, in which case that provider's relationship is with you.

We use three third parties, and only these three:

• Venice AI — the language and image models behind chat, Dungeon Master narration and generated artwork. Their privacy policy.
• Fal.ai — further image, video and model-training work. Their privacy policy.
• Stripe — payments. Card details go to Stripe and never reach us. Their privacy policy.

What reaches a model is the text and the images of the thing you are making — your prompt, your character, the scene. Your email address, your password and your payment details never do.

Where it is kept

On servers operated for the Service. Backups are taken nightly and tested.

The Service runs on a dedicated server operated on our behalf, and its database and media are stored there. The three providers named above are in the United States, so the content you send to a model, and your payment details when you buy Coins, are processed there. That transfer is necessary to give you the Service you asked for; if you would rather it did not happen, do not use the generative features or buy Coins.

How long we keep it

Set out in the Data Retention and Deletion policy, which forms part of this one. In short: your content stays until you delete it or close your account; financial records are kept as long as the law requires; security logs are kept for a limited period and then discarded.

Your rights

Depending on where you live, you may have the right to see the personal data we hold about you, correct it, delete it, object to how it is used, or take it elsewhere in a portable form. You can exercise any of these through the contact page, and you do not need an account in good standing to do so.

If you think we have handled your data badly, you can complain to us and to your local data protection authority.

Cookies

The Service sets a cookie so you stay signed in, and one to remember interface preferences such as theme. It does not use advertising cookies or third-party trackers.

Children

The Service is not for people under the age stated in the Terms. If we learn that an account belongs to someone below it, we will close the account and delete the data.

Changes

If this policy changes materially, you will be asked to accept the new version, and the version and date are recorded.