Privacy

Effective date: 2026-11-15

This notice describes the reference application. The operator who deploys it
is the data controller for that deployment and must replace this notice with
terms appropriate to its jurisdiction, contact details, retention schedule,
and legal obligations before inviting real users.

Data the application stores

The SQLite database can contain account usernames and password hashes, session
and recovery-token hashes, forum posts and reports, subscriptions and
notifications, lobby membership and invitation hashes, match inputs and public
records, private story progress, creator submissions, release credits, and
deployment listings and domain-verification metadata. IP addresses are used
for process-local rate limits; the application does not provide an analytics
or advertising system.

Backups may contain the same private data, including active match state. Keep
the database, backups, logs, and container volumes access-controlled and
encrypted according to the operator's policy. Do not place them in `public/`
or a web-accessible object store.

Cookies and browser storage

The browser uses a session cookie (`sid`, up to 30 days) and a request-forgery
protection cookie (`csrf`, up to one year). They are necessary for sign-in and
safe writes. Browser clients also use session storage for temporary invitation
handoffs and local storage for story display preferences. No advertising or
cross-site tracking cookies are configured.

Optional services

If `ANTHROPIC_API_KEY` is configured, the server may send the explicitly
constructed public wording context for an act to Anthropic. Private hidden
state is excluded by the wording boundary, but operators must review the
provider's current terms and configure an appropriate disclosure or disable
the provider by leaving the key unset. Template mode is the default.

Account closure and retention

Closing an account removes login credentials, sessions, subscriptions,
maintainer assignments, private story progress, and recovery data. Public
posts and match records remain for moderation and game-integrity reasons and
are relabeled as a deleted account where structured attribution is available.
Existing backups are not rewritten. This behavior is a product policy, not a
promise of complete erasure in every jurisdiction.

The operator must publish its own contact address, legal basis, retention
periods, international-transfer information, and user-rights process before
production use. This repository does not collect consent, provide email
recovery, or select a governing jurisdiction for an operator.