Privacy Policy

Information We Collect

We collect account information such as email address, display name, profile photo, authentication identifiers, email verification status, subscription tier, and account timestamps.

We store campaign and character content you create or import, including characters, campaign metadata, maps, VTT sessions, tokens, props, fog state, story nodes, extracted locations, relationships, encounters, notes, chat messages, assistant responses, prompts, generated images, and uploaded or generated media.

If you upload a campaign source PDF, we may store the original file, filename, page count, storage location, extraction jobs, progress, results, generated map assets, and extracted campaign content.

Payments are processed by Stripe or another payment processor. We do not store full card numbers. We may store subscription tier, payment identifiers, cancellation status, credit balance, credit transaction records, and checkout or subscription event metadata.

Usage, Analytics, and Logs

We may collect technical and usage information such as pages and features used, product events, error logs, diagnostics, device and browser metadata, approximate location, IP-derived metadata, and timestamps.

Frontend analytics and session recording run only after analytics consent where consent is required. Backend analytics and exception diagnostics may also be captured when configured; these do not depend on browser cookies, but they may still process personal data if event payloads identify users or accounts.

How We Use Information

• Create and manage accounts.
• Authenticate users and keep sessions secure.
• Provide campaigns, characters, VTT, chat, extraction, and generation features.
• Process subscriptions, credits, refunds, and billing state.
• Store and deliver user-created content.
• Run AI, OCR, image generation, and placement features requested by users.
• Debug, secure, monitor, and improve the service.
• Detect abuse, fraud, and policy violations.
• Comply with legal, accounting, tax, and payment obligations.

AI and OCR Processing

Some One Realm features use AI or OCR providers. When you request those features, we may send relevant prompts, uploaded pages, images, extracted text, campaign context, map images, chat messages, or generated assets to providers such as OpenAI, Mistral AI, DeepSeek, or other listed subprocessors, depending on the providers configured for that feature.

We do not use your private campaign content or uploaded PDFs to train our own foundation models. Third-party provider handling is described in our Subprocessors page and the providers' terms and privacy documentation.

Legal Bases for EU and UK Users

• Contract: to provide One Realm features, accounts, subscriptions, credits, support, and requested AI processing.
• Legitimate interests: to secure, debug, maintain, and improve the service, prevent abuse, and keep operational records.
• Consent: for optional browser analytics, tracking, marketing communications, or other optional processing where consent is required.
• Legal obligation: for accounting, tax, payment, fraud, and compliance records.

Sharing and Subprocessors

We share information with subprocessors that help us operate One Realm, including authentication, hosting, storage, payments, analytics, AI/OCR processing, support, and security providers. See the Subprocessors page for the current list.

We may disclose information if required by law, to protect rights and safety, in connection with a merger or sale of assets, or with your direction or consent. We do not sell your uploaded PDFs, campaign content, or character data.

Retention and Deletion

We retain information for as long as needed to provide One Realm, comply with legal obligations, resolve disputes, enforce agreements, prevent abuse, and maintain security.

Account deletion may not remove records we must retain for billing, tax, security, fraud prevention, or legal reasons. Backups are deleted on normal backup rotation.

Your Rights and Choices

Depending on where you live, you may have rights to access, correct, delete, export, object to, restrict processing, withdraw consent, opt out of tracking or marketing, and lodge a complaint with a data protection authority.

To make a privacy, data export, or deletion request, email privacy@one-realm.com. We may need to verify your identity before fulfilling a request.

Security and Transfers

We use technical and organizational measures designed to protect information, including authenticated access controls, httpOnly session cookies, provider security controls, and limited access to production systems. No service can guarantee perfect security.

We and our subprocessors may process information in countries other than where you live. Where required, we rely on appropriate safeguards such as contractual protections or other lawful transfer mechanisms.

Contact

Privacy and data requests: privacy@one-realm.com.

General support: support@one-realm.com.