Privacy Policy

1. Information We Collect

Account Information

• Email address — collected during sign-up via magic link authentication (Supabase Auth). This is the only personally identifiable information we require.

Gameplay Data

• Character data (name, race, class, stats, inventory, spells, level)
• Campaign data (game state, story progress, quest status)
• Chat messages (your messages to the AI and AI responses)
• Quest and objective progress
• World knowledge extracted from gameplay (characters, locations, events encountered)

Usage Data

• Session information (start time, last active time, message count)
• Credit balance and usage

Technical Data

• Standard server logs (IP address, browser type, access times) as collected by our hosting provider

2. How We Use Your Information

• Provide the Service — Your gameplay data is used to maintain your game state, enable multiplayer, and generate AI responses
• AI processing — Your chat messages, character data, and game state are sent to AI providers to generate dungeon master responses and extract world knowledge
• Voice narration — Message text may be sent to generate voice narration at key story moments (when enabled)
• Analytics — Aggregated, non-identifying usage data is used via an internal developer dashboard to understand engagement and improve the Service
• Account management — Email is used for authentication and account recovery

3. Multiplayer Data Visibility

When you join a multiplayer campaign, certain information is visible to other players in your party:

• Character information — Your character name, race, class, and level
• Chat messages — All messages you send in the campaign are visible to every player in the party
• Online status — Other players can see whether you are currently online or offline

Your email address and account details are never shared with other players. Only the information listed above is visible within the game. Campaign hosts can see the same information as any other party member — they do not have access to your email or account data.

4. Third-Party Services

We share data with the following third-party services to operate Voidspark:

5. Data Retention

Your data is retained for as long as your account is active. You may request deletion of your account and all associated data at any time by contacting us. Upon account deletion, we will remove your personal data from our systems within 30 days, except where retention is required by law.

6. Data Security

We use industry-standard security measures to protect your data, including encrypted connections (HTTPS), Row-Level Security (RLS) policies on our database, and secure authentication via Supabase. However, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

7. Your Rights (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following rights under the General Data Protection Regulation (GDPR):

• Right of access — Request a copy of the personal data we hold about you
• Right to rectification — Request correction of inaccurate personal data
• Right to erasure — Request deletion of your personal data
• Right to data portability — Request a machine-readable copy of your data
• Right to object — Object to processing of your personal data
• Right to restrict processing — Request that we limit how we use your data

Lawful basis for processing: We process your data based on (a) your consent, provided when you create an account and use the Service, and (b) our legitimate interest in operating and improving the Service.

International data transfers: Your data is processed by US-based services (Supabase, Anthropic, OpenAI, Vercel). By using the Service, you consent to the transfer of your data to the United States.

To exercise any of these rights, contact us at team@playvoidspark.com.

8. Children's Privacy (COPPA)

Voidspark is intended for users aged 13 and older. We do not knowingly collect personal information from children under 13. If we become aware that we have collected data from a child under 13, we will promptly delete their account and associated data. If you believe a child under 13 has provided us with personal information, please contact us immediately.

9. Cookies

Voidspark uses only functional cookies required for authentication (Supabase Auth session cookies). We do not use tracking cookies, advertising cookies, or analytics cookies. Game preferences (TTS settings, seen notifications) are stored in your browser's localStorage and are not transmitted to our servers.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. Your continued use of the Service after changes are posted constitutes acceptance of the updated policy.