Privacy Policy

Who we are

RPG Forge ("we", "us") operates rpgforge.ai. For anything in this policy, write to support@rpgforge.ai.

What we collect

Account information. When you register we store:

• Your email address and display name.
• A password hash, if you signed up with a password. We never store the password itself.
• Your Google account identifier and profile image, if you signed in with Google. We do not receive your Google password.
• Your Discord account identifier, if you chose to link one.
• Your credit balance and a record of credits granted and spent.

Content you create. Worlds, characters, items, locations and other material you build in the editor, plus your play sessions: the actions you take and the text generated in response.

Technical information. Standard server logs, which include your IP address, browser user agent and the pages requested. These are used to keep the service running and to investigate abuse.

We do not collect special category data, and the service is not intended for anyone under 13.

Why we use it

• To provide the service: run your games, save your worlds, and sign you in.
• To process payments and maintain your credit balance.
• To keep the service secure, prevent abuse, and debug faults.
• To send you service messages about your account. We do not send marketing email.

Where the GDPR applies, our bases for this are performing our contract with you (running the service and billing you), our legitimate interests (security and abuse prevention), and your consent where you have given it.

AI model providers

Play and world generation are powered by third-party large language models. When you take a turn, the relevant game text is sent to a model provider to produce a response. Depending on the model chosen for a world, that provider may be Google, OpenAI, OpenRouter or DeepSeek. Art is generated by Google, OpenAI, DeepInfra or Venice. Your email address and payment details are never included.

Other services we share data with

• Stripe handles all payments. Card details go directly to Stripe; we never see or store them. We keep a record of which purchase was made and when.
• Google receives a sign-in request if you use Google authentication.
• Discord receives a verification request if you choose to link a Discord account.
• Our hosting provider, which stores the database and serves the site.

We do not sell your personal information, and we do not share it for advertising.

Cookies

We set a session cookie so you stay signed in, and we use browser storage to remember small interface preferences. Both are necessary for the site to work as expected. We do not run third-party advertising or analytics trackers.

What is public

If you publish a world, its contents, its title and your display name become publicly visible and may be indexed by search engines. Unpublished worlds and drafts are visible only to you. Play sessions are private to their participants.

How long we keep it

Account data and the worlds you create are kept while your account is open. Server logs are kept for a short operational period. Payment records are kept as long as tax and accounting rules require. When you delete your account we remove your personal data and unpublish your worlds, except where we must retain a record for legal or accounting reasons.

Your rights

Depending on where you live, you have the right to access, correct, export or delete your personal data, to object to or restrict certain processing, and to withdraw consent. To exercise any of these, email support@rpgforge.ai from the address on your account. We will respond within the time your local law allows, and at most 30 days.

If you are in the EU or UK and are unhappy with our response, you may complain to your local data protection authority.

International transfers

Our providers, including the model providers listed above, may process data in the United States and elsewhere. Where required, transfers rely on the appropriate safeguards, such as the European Commission's standard contractual clauses.

Security

Connections are encrypted in transit, passwords are stored hashed, and access to the database is restricted. No service can promise perfect security, and we will tell you promptly if a breach affects your data.

Changes

We will update the date at the top of this page when this policy changes, and will give notice in the app for anything significant.