++ Legal ++

Privacy Policy

1. Who is responsible

The data controller is [COMPANY NAME] LTD, company number [COMPANY NUMBER], registered in England and Wales. Contact: richard.a.d.smith@gmail.com.

2. What we collect

Account details (when accounts launch): email address, display name, and sign-in identifiers from any provider you choose (e.g. Google).
Content you submit: army lists, unit and faction names, battle results and scores, notes, tournament names and other free text.
Generated content: the tales and narration audio the Service creates from your battles.
Payment data (when paid plans launch): handled by our payment provider; we never see full card details, only subscription status.
Technical data: server logs (IP address, request metadata) for security and abuse prevention, and aggregate, cookieless page analytics.

3. How we use it

To operate the Service: storing your battles, generating tales and narration, and serving pages you choose to share.
To meter usage allowances and, when paid plans launch, manage subscriptions.
To secure the Service, enforce our terms, and prevent abuse.
To understand aggregate usage and improve the product.

Legal bases under UK GDPR: performance of a contract (running the Service for you), legitimate interests (security, abuse prevention, product analytics), and consent where we ask for it. We do not sell personal data, and we do not use your content to train AI models.

4. Who processes it for us

Vercel — application hosting and cookieless analytics.
Supabase — database and file storage (including narration audio).
Anthropic — AI text generation: your list text, battle details and notes are sent to generate tales, under API terms that do not permit training on your data.
ElevenLabs — voice synthesis: the text of a tale is sent to generate narration audio.
Stripe (when paid plans launch) — payment processing.
Google (when accounts launch) — optional sign-in provider.

Some of these providers process data outside the UK, including in the United States. Where that happens, transfers are safeguarded by the UK International Data Transfer Agreement or Addendum, or another lawful transfer mechanism.

5. How long we keep it

Content is kept while your account (or the tournament/share link it belongs to) exists. When you delete content, your account, or ask us to, we delete the associated personal data, subject to short backup-retention windows and records we must keep by law. Server logs are retained for a limited period for security purposes.

6. Your rights

Under UK GDPR you can ask us for access to, correction of, deletion of, or a portable copy of your personal data; you can object to or ask us to restrict certain processing; and you can withdraw consent where processing is based on it. Email richard.a.d.smith@gmail.comto exercise any of these. You can also complain to the Information Commissioner’s Office (ico.org.uk).

7. Children

The Service is not intended for children under 13. If we learn that we hold personal data of a child under 13, we will delete it.

8. Cookies

We use only what is strictly necessary to run the Service (such as session state once accounts launch). Our analytics are cookieless. We will update this policy and ask for consent before introducing any non-essential cookies.

9. Changes

We will post any changes to this policy here and, for material changes, notify you in the app or by email.