Privacy Policy

We collect only what we need to run the game and your account:

• Account data — your email address, a password (stored only as a secure hash by our authentication provider), and any display name or username you choose, plus your plan and onboarding status.
• Gameplay content — the characters, campaigns, choices, story entries and epilogues you create while playing, so we can save and continue your games.
• Story submissions — if you submit a story, the text you send and the account name it is published under (see our submission & publishing terms).
• Support & contact data — if you email us or contact support, we keep your messages and contact details so we can respond and keep a record.
• Payment data — if you subscribe, payments are processed by Stripe. We store your subscription status, plan and Stripe customer/subscription identifiers. We do not receive or store your full card number.
• AI narration data — the actions, messages and character details you enter during play are sent to our AI provider to generate the story narration in real time.
• Analytics — aggregate, anonymous usage statistics (see section 4).
• Technical data — standard server logs (e.g. IP address, browser type, timestamps) used for security, debugging and operating the Service.

We do not knowingly collect special-category (sensitive) personal data.

Under the UK GDPR / EU GDPR we rely on the following legal bases:

• To provide the Service — creating your account, saving your games, generating AI narration and delivering the features of your plan. (Legal basis: performance of a contract.)
• Payments & records — processing subscriptions and keeping the records we are legally required to keep. (Legal bases: contract; legal obligation.)
• Security, operation & improvement — keeping the Service safe, preventing abuse, and understanding aggregate usage via cookieless analytics. (Legal basis: legitimate interests.)
• Service emails — account, security and submission-status emails. Any optional marketing email would be sent only with your consent. (Legal bases: contract; consent where applicable.)

We do not sell your personal data. We share it only with the service providers that help us run AnyVerse, each acting as our processor under a data-processing agreement:

• Supabase — database, authentication and storage (your account and gameplay data).
• Stripe — payment processing and subscription management.
• OpenRouter (and the underlying AI model provider it routes to) — generates the AI narration from your gameplay input. We do not use your content to train our own models.
• Plausible Analytics — privacy-friendly, cookieless usage statistics.
• Our hosting, CDN & email providers — to serve and deliver the site and send account/service emails.

We may also disclose data if required by law, or to protect the rights, safety and security of our users or the Service.

We use essential cookies and browser local/session storage only — used to keep you signed in and to operate the Service (for example, your language choice or an unsent draft). We do not use advertising or cross-site tracking cookies.

For analytics we use Plausible, which is cookieless and does not collect personal data or track you across sites. Because it stores no cookies and no personal data, it does not require a consent banner. Metrics are aggregate only (e.g. page views, referrers, country at a coarse level), and we do not run analytics on the authenticated in-app pages (/app) — only on the public marketing pages.

Some of our processors may process data outside your country (for example in the EU, the UK or the US). Where personal data is transferred internationally, it is protected by appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision. Plausible is EU-hosted.

We keep account and gameplay data while your account is active and for a reasonable period afterwards. Payment and tax records are kept for as long as the law requires (typically up to 6 years in the UK). Published story submissions remain available under the submission terms until you ask us to take them down. When data is no longer needed, we delete or anonymise it.

When you delete your account or content, we remove it from the live Service. Residual copies may remain for a limited time in encrypted backups and in security/operational logs before they are overwritten in the ordinary course — these are not used for any other purpose.

Depending on your location, you have the right to: access your data; correct it; erase it; restrict or object to its processing; receive a portable copy; and withdraw consent where processing is based on consent. To exercise any of these, email marek@nex41.io.

You can also complain to a data-protection authority — in the UK, the Information Commissioner’s Office (ICO); in Poland, the Urząd Ochrony Danych Osobowych (UODO); or your local EU/EEA authority.

We protect your data with encryption in transit (HTTPS), hashed passwords, row-level access controls on your data, and access limited to what is necessary to operate the Service. No system is perfectly secure, but we take reasonable measures to keep your data safe.

AnyVerse is intended for users aged 16 or older. We do not knowingly collect personal data from children under 16. If you believe a child has provided us data, contact us and we will delete it.

We may update this policy as the Service evolves. We will change the “Last updated” date above and, for material changes, take reasonable steps to notify you.

Nex41 Ltd (Company No. 17479698), registered in England and Wales. Privacy questions and requests: marek@nex41.io. See also our Terms of Service.