Privacy Policy

Last updated: August 2026

Introduction

WorldMaster RPG ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web application and related services.

Data Controller

WorldMaster RPG is operated by Tomas Jakovlevas, based in Vilnius, Republic of Lithuania. For any data-related inquiries, you may contact us at [email protected] or through the application's feedback system.

Supervisory Authority

You have the right to lodge a complaint with the Lithuanian State Data Protection Inspectorate (VDAI): Valstybinė duomenų apsaugos inspekcija, L. Sapiegos st. 17, LT-10312 Vilnius, Lithuania - https://vdai.lrv.lt

Information We Collect and Why

We only collect data we need to operate the Service. Below we set out each category of data, its purpose, and the legal basis under GDPR Article 6.

Account Data

When you create an account, we collect your email address and username. If you register or sign in through OAuth providers (Google or Discord), we receive your basic profile information (name, email, and profile picture) from those services. We sign Data Processing Agreements with Google and Discord as required under GDPR Article 28. Legal basis: Art. 6(1)(b) - performance of contract.

User-Generated Content

We store content you create within the platform, including campaigns, characters, locations, events, legendarium entries, and other game-related data. You retain full ownership of all content you upload or create. We will never use your content - including stories, images, characters, and other creative works - for marketing, promotional, or any other purpose beyond providing the Service to you. Legal basis: Art. 6(1)(b) - performance of contract.

Chat Messages

Chat messages are transmitted in real-time through WebSocket connections and are NOT stored on our servers. Once a message is delivered, it is not retained by us. Chat history is only available during your active session and is stored on your device.

File Uploads

We store files you upload, such as images for campaigns, characters, and maps. These files are stored securely in Cloudflare R2 object storage (see Third-Party Services below), served through our API with access controls, and associated with your account. You retain full ownership of all uploaded files. We will not use your uploaded content for marketing, promotional, or any purpose other than providing the Service to you. For technical delivery purposes (including CDN caching, thumbnail generation, and backup), we may create technical copies or reformatted versions of your files solely as necessary to operate the Service. Legal basis: Art. 6(1)(b) - performance of contract.

AI Services

AI-powered features in WorldMaster RPG are processed by a locally hosted language model running entirely on our own servers. When you use AI features, your prompts and the content generated are processed within our infrastructure and are not transmitted to, shared with, or processed by any external AI service provider. We do not use your prompts or AI-generated content to train, fine-tune, or improve any AI model. This data is processed solely to deliver the AI feature to you in real time and is not retained beyond the duration of your session unless you explicitly save generated content to your account. If we introduce additional AI providers in the future, we will update this policy and notify you in advance of those changes. Legal basis: Art. 6(1)(b) - performance of contract.

Analytics Data

If you consent to analytics, Google Analytics collects anonymous usage data such as pages visited, session duration, and general location. This data is only collected after you explicitly opt in through our cookie consent banner. Legal basis: Art. 6(1)(a) - consent only.

Server & Security Logs

We maintain server and security logs to ensure the security and stability of our platform and to diagnose technical issues. Legal basis: Art. 6(1)(f) - legitimate interest (platform security and stability).

Cookies & Local Storage

We use browser local storage to persist essential session management and preferences. Local storage used for these purposes is strictly necessary to operate the Service and does not require your consent. This includes: authentication tokens (JWT) to keep you logged in, theme and display preferences for your visual settings, cookie consent choice to record your analytics preference, and application state such as sidebar positions, panel layouts, volume settings, and last-viewed items to restore your session. We also use IndexedDB to store chat message history locally on your device - chat messages are not stored on our servers. We do not use traditional tracking cookies for our own purposes. Third-party services like Google Analytics may set their own cookies only if you explicitly consent through our cookie consent banner.

Google Analytics

We use Google Analytics to understand how users interact with our application. This service is only activated if you explicitly consent through our cookie consent banner. Google Analytics collects anonymous usage data such as pages visited, session duration, and general location. You can withdraw your consent at any time through your profile settings. Withdrawing consent will disable Google Analytics collection immediately. Previously collected analytics data may be retained by Google for the retention period set in our GA4 configuration (maximum 14 months). We have signed a Data Processing Agreement with Google LLC as required under GDPR Article 28. Data processed by Google Analytics may be transferred to the United States under the EU-U.S. Data Privacy Framework (adequacy decision adopted July 2023). We implement Google Consent Mode to ensure no analytics data is collected prior to your consent.

Email Usage

We use your email address for account verification, password reset functionality, and important service-related communications. We do not send marketing emails or share your email with third parties for promotional purposes.

Data Storage & Security

Your data is stored in secure MongoDB databases hosted on our own infrastructure. We implement industry-standard security measures including encrypted connections (HTTPS/TLS), JWT-based authentication, and secure password hashing. Uploaded files are stored in Cloudflare R2 object storage and are only served through our API with access controls. All other data processing occurs within our own infrastructure, except where third-party services are explicitly identified in this policy.

Third-Party Services and Data Processors

We act as data controller. The following third parties act as data processors on our behalf, each bound by a Data Processing Agreement under GDPR Article 28: Google LLC (OAuth) for authentication via Google Sign-In, located in the United States, transfer mechanism: EU-U.S. Data Privacy Framework and SCCs; Google LLC (Analytics) for usage analytics (consent-only), located in the United States, transfer mechanism: EU-U.S. Data Privacy Framework and SCCs; Discord Inc. (OAuth) for authentication via Discord Sign-In, located in the United States, transfer mechanism: EU-U.S. Data Privacy Framework and SCCs; Cloudflare, Inc. (R2 object storage) for storing files you upload, located in the United States, transfer mechanism: EU-U.S. Data Privacy Framework and SCCs. Our AI features use a locally hosted model on our own servers - no user data is sent to external AI providers. Each third-party service listed above has its own privacy policy governing its use of your data.

International Data Transfers

Where data is transferred to processors in the United States (Google, Discord, Cloudflare), we rely on: (1) the EU-U.S. Data Privacy Framework adequacy decision (European Commission, July 2023), where the processor is certified; and (2) Standard Contractual Clauses (SCCs) as an additional or fallback safeguard. We have conducted Transfer Impact Assessments for each international data transfer. No other international transfers occur - in particular, AI processing occurs entirely on our servers within the EU.

Data Retention

We retain your data only for as long as necessary for the purposes described in this policy. Account data (email, username, profile) is retained for the duration of your account plus 30 days after deletion. User-generated content and file uploads are retained for the duration of your account plus 30 days after deletion. Backups are retained for up to 90 days on a rolling cycle. Google Analytics data is retained for 14 months (GA4 configuration setting). Server and security logs are retained for 90 days. AI session data (prompts and outputs not explicitly saved) is not retained beyond the active session. When you delete your account, all personal data, uploaded files, and user-generated content will be permanently deleted within 30 days. Some anonymised, non-identifiable usage statistics may be retained for analytical purposes.

Your Rights

Under GDPR, you have the following rights regarding your personal data: Right of access (Art. 15) - request a copy of the data we hold about you; Right to rectification (Art. 16) - correct inaccurate or incomplete data; Right to erasure (Art. 17) - request deletion of your data ("right to be forgotten"); Right to restriction (Art. 18) - ask us to limit processing in certain circumstances; Right to data portability (Art. 20) - receive your data in a structured, machine-readable format; Right to object (Art. 21) - object to processing based on legitimate interest; Right to withdraw consent - withdraw analytics consent at any time via your profile settings, without affecting prior processing; Right to complain - lodge a complaint with VDAI (see Data Controller section for contact details). You can exercise most of these rights directly through your account settings. For data deletion or export requests not available through the interface, please contact us through the application's feedback system. We will respond to all requests within 30 days. In complex cases this may be extended to 60 days, with notification.

Children and Age Restrictions

Our Service is intended for users aged 16 and above as a platform policy. We do not knowingly collect personal data from users under 16. If we become aware that a user is under 16, we will restrict processing and delete their data promptly. If you believe a minor has registered, please contact us.

Changes to This Policy

We may update this Privacy Policy from time to time. For significant changes, we will notify you through the application with at least 30 days' notice before changes take effect, and provide a summary of what has changed. Your continued use of the Service after the effective date constitutes acceptance. For changes to consent-based processing, we will seek fresh consent where required.

Contact Us

If you have questions about this Privacy Policy or our data practices, please contact us at [email protected] or through the application's feedback system. For formal data subject requests, please include your account email and a description of your request.