Privacy Policy

Effective 10 October 2026 · Version 2026-10-10 (replaces 2026-09-24)

This policy explains what personal data Ocranthor LLC ("we", "us") collects through the Loreglass app, why, who we share it with, and what rights you have. We are the data controller for that data.

Questions, or to exercise any right below: privacy@ocranthor.com.

1. Summary

• We collect the minimum needed to run your account and sync your campaigns.
• We have never sold personal information and we do not share it for advertising. We do not run ads, we do not use advertising identifiers, and we do not track you across other websites or apps.
• Your prompts are sent to AI providers so they can generate what you asked for.
• Loreglass is for ages 13 and over. We ask for your date of birth once, keep it encrypted, refuse anyone under 13, and erase the account that asked. Nothing is kept from a refused answer.
• The help assistant keeps your conversations with it for 90 days, so it can answer you and so we can improve the help. It is the only AI feature whose text we store.
• You can download everything we hold, or delete your account outright, yourself — in the app under Settings → Privacy, without asking us. Deleting is immediate and permanent.

2. What we collect

Account data. A user identifier we generate, plus your email address and display name. Sign-in is handled by Auth0 (see section 5): when you sign in with Google, Google gives Auth0 your Google account identifier, email address, whether that email is verified, and your name, and Auth0 passes those to us. When you sign up with an email and a password, Auth0 receives the email and password directly. We also record when the account was created, when it was last used, and the language you chose in Settings.

Your password. If you sign in with an email and a password, the password is held by Auth0, our sign-in provider, as an irreversible hash. We never see or store it. A small number of accounts made before 15 September 2026 hold a salted PBKDF2-SHA256 hash on our own servers instead; those, too, cannot be read or recovered, only reset.

Reset and confirmation links. Password reset and email verification links are sent by Auth0. Where our own servers still issue one (older accounts), we keep only a one-way hash of the token; a reset token is valid for one hour, a confirmation token for seven days, and both are destroyed once used. Resetting your password signs out every device.

Your content. Campaigns, characters, notes, session logs, generated images, and other material you create. This is synced so it follows your account across devices.

Prompts and generations. The text you send to AI features, and what comes back.

Age. The date of birth you give before first use, stored encrypted so that a copy of our database shows nobody's birthday, and the age group we derive from it. Never a verified identity document. We read the date for exactly three things: working out your age group on each request, so that a teen becomes an adult on their eighteenth birthday with nothing to do; refusing purchases under 18; and answering a lawful legal request. We never use it for advertising or profiling, never send it to an AI model, and the help assistant is told only "teen" or "adult". If you tell us you are under 13 we store none of it and erase the account — see section 10.

Help conversations. What you type to the help assistant and what it answers, with the page you were on, the language of your app, the app version, the last error message shown to you, and the id of the campaign you had open, which the assistant uses to understand your question. Also your thumbs-up or thumbs-down on an answer and any note you add, and a record of each question the assistant could not answer. When you ask the assistant to do something on your account, a log of the action: which action, what you asked for, the result and the time. When a conversation is sent to a person at Loreglass (an escalation), the summary and the full conversation are emailed to our support mailbox and a ticket is kept with a reference number. If a conversation is flagged for a safety reason, or you report one, the full conversation is emailed to our abuse mailbox for review. We also keep a count of conversations paused for swearing or abusive language, and whether the help window is closed for your account because of it, so that the rule in the Terms can be applied.

Usage counters. Counts of messages, images, and speech characters per month, to enforce plan limits and control costs.

Subscription status. Whether you have an active entitlement, and an identifier linking your account to your payment processor record. Payment card details never reach us — they are handled entirely by Stripe. We can see that a payment succeeded, not the card that made it.

Policy-block records. When the content filter blocks something, we record the category, the matched term, and the time — with no user identifier attached, deliberately, so the log cannot be traced back to a person. We keep this to tune the filter, not to watch anyone.

Safety records. Separately, and against your account, we count how many times an image description you asked for was refused, in which category, and when it last happened. Counts and dates only — never the description itself. A help conversation that is flagged for a safety review is kept in full until the review is closed; see section 9. This exists because the anonymous log above cannot tell one person trying repeatedly from many people trying once, and we need to be able to act on the first. It is what lets us suspend an account that persistently attempts prohibited material, and it is what we would produce if we were required by law to do so. It is deleted with your account.

Server error logs. When a request to our servers fails, Cloudflare records the error message, the route, and the time in our Worker logs. These logs are not linked to your account by us and are kept by Cloudflare for a short period (currently up to seven days).

Your IP address, briefly. When you sign in, our servers read the IP address your connection arrives from in order to count sign-in attempts and refuse a flood of them. It is used for that check and then discarded — we do not store it, log it, or link it to your account. Cloudflare, who serve our site, keep their own short-lived request logs as any host does.

We do not collect precise location, contacts, health data, or advertising identifiers, and we do not use cookies to track you. The only cookies involved are strictly necessary ones set by Auth0 during sign-in and by Cloudflare to protect the site from automated abuse.

3. Why we use it, and our lawful basis

For users in the EU and UK, the GDPR requires a lawful basis for each purpose:

Where we rely on legitimate interests, we have considered the impact on you and you may object — see section 8.

We do not use your content to train AI models, and we do not permit our providers to use it to train theirs where their terms give us that choice. Each provider's own policy governs their processing; links are in section 5.

4. Who can see your content

Your campaigns are private to your account unless you share them.

When you share a campaign, users who join with your code receive a player-safe copy — campaign framing, revealed characters and locations, session recaps. DM-only material (secrets, hidden characters, DM notes) is held in a separate record that our servers serve only to you and to co-Game-Masters you promote.

When you cast a live map, every member of that campaign can see the map image, the grid and weather you set, pings and reveals, and the tokens on it, including token names and art. Players can move tokens assigned to them, and those moves are visible to everyone at the table. Map and token images you upload are served to members through time-limited links that expire within 24 hours.

Members of a shared campaign do not see each other's email address or account details.

We do not otherwise disclose your content, except as in section 5 or 6.

5. Processors and third parties

We use these providers. Each acts on our instructions as a processor, or as an independent controller where noted.

Content you send to an AI provider is used by that provider to generate the output you asked for. We do not permit providers to train models on it where their terms give us that choice.

Provider terms and privacy policies are on their own websites. We review them, but we are not responsible for their content.

6. When we may disclose data otherwise

• To comply with a law, court order, or valid legal request.
• To report suspected child sexual abuse material to the relevant authorities. This is not optional and not subject to your consent.
• To protect the rights, safety, or property of users, the public, or us.
• To a buyer, in a merger or sale of assets, with notice to you.

7. Where your data is held, and transfers

Our infrastructure and most providers are in the United States. If you are in the EU or UK, your data will be transferred outside your country.

For those transfers we rely on the European Commission's Standard Contractual Clauses (and the UK Addendum where applicable), or on an adequacy decision where one applies. You may request a copy of the relevant safeguards from privacy@ocranthor.com.

8. Your rights

These rights apply to everyone, wherever you live. We do not ask where you are before honouring them.

You may:

• access the personal data we hold about you;
• correct it if it is inaccurate;
• delete it, including the whole account;
• export it in a portable format;
• restrict or object to processing based on legitimate interests;
• withdraw consent where we rely on it, without affecting past lawful processing;
• not be subject to solely automated decisions with legal or similarly significant effects. Our content filtering is automated but affects only whether a piece of content is generated; you can contact us to have a block reviewed by a person.

Doing it yourself, now

Two of these don't need us at all. In the app, go to Settings → Privacy:

• Download my data gives you a single JSON file containing everything we hold about your account — your campaigns, characters, notes and session logs with their full contents, your plan, your usage counters, and a list of every file you have uploaded. Live sign-in credentials are the only thing left out, because they are stored as irreversible hashes and would be a security risk to hand over.
• Delete my account erases it. Not a flag or a queue: your records, your uploaded maps and PDFs, your usage history, your help conversations and action log, your purchased campaign slots, your sign-in credentials and the account row itself are removed as you watch, and any subscription is cancelled immediately. We then re-check the account is empty and show you what was removed. It cannot be undone, and there is no export afterwards — take a copy first if you want one.

What deletion cannot reach, and why:

• Anonymous policy-block counts. These carry no user identifier by design, so they cannot be linked to you or picked out for removal.
• Stripe's payment and invoice records. Our payment processor must keep these for as long as tax and financial law requires. We cancel your subscription and unlink you from the customer record, but we cannot order Stripe to destroy an invoice.
• Your Auth0 sign-in record is deleted at the same moment, by our servers asking Auth0 to remove it. In the rare case that Auth0 cannot be reached during your deletion, we finish it by hand within 30 days; write to privacy@ocranthor.com if you want that confirmed.
• Encrypted backups, which roll off within 30 days and are then gone.
• Escalation emails already sent to our support mailbox, which we delete by hand when the case is closed.
• A help conversation under an open safety review is kept until the review is closed, then deleted.

Asking us instead

Write to privacy@ocranthor.com for anything else, including correction, restriction, and objection. We respond within 30 days and will tell you if we need longer. We may ask you to confirm control of the account's email address before acting — not to obstruct you, but because handing someone's campaign notes to the wrong person is itself a breach.

Authorised agents. You may use an agent to make a request on your behalf. We will ask for written permission signed by you and may still ask you to confirm the request directly.

No penalty for asking. We will not deny you service, charge you a different price, or give you a worse experience because you exercised any of these rights.

If you are unhappy with our response, you may complain to your data protection authority. In the UK that is the Information Commissioner's Office (ico.org.uk); in the EU, your national authority. In California, the Attorney General or the California Privacy Protection Agency.

9. How long we keep data

Sign-in sessions expire automatically; refresh credentials are valid for 60 days and are revoked when you sign out, and all of them are revoked when you reset your password.

10. Children

Loreglass is for ages 13 and over. Before you can use the Service we ask for your date of birth. If that puts you under 13 we refuse the account, erase it, and go no further.

Three details matter about how that works:

• A refused answer is stored nowhere, and the account that asked is erased in the same moment. The account was created when you signed in, before we could ask; we do not keep a record that someone told us they were 11, and we do not keep the email address they signed in with, because keeping either would mean knowingly holding a child's personal information — the very thing this gate exists to prevent.
• An accepted answer is recorded against the account, encrypted, not in your browser. Clearing your browser data or reinstalling will not reopen the question.
• We use the date for your age group and for purchases, and for nothing else except a lawful legal request. See section 2.

If you tell the help assistant that you are under 13, the account is flagged for a person at Loreglass to review; it is not deleted automatically, because a mistyped number should not cost someone their campaigns.

If you believe a child under 13 has an account, write to privacy@ocranthor.com and we will delete the account and its data. A parent or guardian may make that request, and we will not require the child's involvement.

Users aged 13 to 17 may use the whole Service, but cannot buy a subscription or extra campaign slots — we check the date of birth on the account and refuse checkout. A parent or guardian may subscribe on their own account. The help assistant runs in a stricter mode for users under 18: it keeps to Loreglass questions, asks nothing personal beyond what a support question needs, does not help with purchases, and a conversation that turns to distress or harm is flagged for a person at Loreglass to review. We recommend that anyone under 18 uses the Service with a parent or guardian's involvement.

11. California privacy rights

This section is for California residents and explains our practices in the terms the California Consumer Privacy Act, as amended by the CPRA, uses. The rights it describes are extended to everyone, so nothing here is available only to Californians.

Notice at collection

We collect all of it from you, directly, and from Google when you sign in. We do not buy personal information from data brokers or anyone else.

We do not sell or share your personal information

We have never sold personal information, and we do not share it for cross-context behavioural advertising — in the twelve months before this policy's effective date, or ever. We do not run ads. There is therefore no "Do Not Sell or Share My Personal Information" link to offer you, and a Global Privacy Control signal has nothing to act on here. If that ever changes, this policy changes first.

We do disclose personal information to service providers who work on our instructions — the ones named in section 5, under contracts that forbid them from using it for their own purposes. Under the CCPA that is a business purpose, not a sale.

We do not knowingly sell or share the personal information of anyone under 16. Loreglass is 13+ and we do not sell anyone's information at any age.

Your California rights

• Know what we collect, why, who we disclose it to, and how long we keep it — set out above and in sections 2, 5 and 9.
• Access a copy of the specific pieces of personal information we hold.
• Delete your personal information.
• Correct anything inaccurate.
• Opt out of sale or sharing — nothing to opt out of, as above.
• Limit the use of sensitive personal information — none collected, as above.
• Not be discriminated against for exercising any of these.

How to exercise them. Access and deletion are buttons, not requests: Settings → Privacy → Download my data and Delete my account. Both act immediately, and deletion tells you what it removed. For anything else, write to privacy@ocranthor.com. We verify a request by confirming control of the account, and we answer within 45 days, extendable once to 90 with notice to you.

Authorised agents may act for you with written permission signed by you; we may still confirm the request with you directly.

Under-18 users: see section 20 of the Terms of Service for the right to remove content you posted.

Shine the Light (Civil Code §1798.83): we do not disclose personal information to third parties for their own direct marketing, so there is nothing to request under that law.

12. Security

We protect data in transit with TLS. In the web app your session credential is kept in your browser's local storage for this site only, and is revoked when you sign out. Refresh credentials are stored only as irreversible hashes on our servers and rotated each time they are used. Passwords are held by Auth0 as irreversible hashes. Access to production systems is limited to those who need it.

No system is perfectly secure. If a breach affects your personal data and is likely to present a risk to you, we will notify you and the relevant authority as the law requires.

13. Changes

We will update this policy as the Service changes. If a change is material we will notify you in the app and, where the law requires, ask for your consent again. The version and effective date are at the top.

14. Contact

Ocranthor LLC Privacy and data requests: privacy@ocranthor.com Abuse, safety and content reports: abuse@ocranthor.com General support: support@ocranthor.com