Privacy Policy

This Privacy Policy explains what personal data RoleKey ("we", "us") collects, why we collect it, and what rights you have. RoleKey is a platform for creating and running text-based roleplay communities. If anything here is unclear, email us at cronachedirajadunia@gmail.com.

1. Data we collect

When you use RoleKey we collect:

• Account data - your email address and a hashed password (we never store the password in plain text).
• Profile data - the display name you choose, and any optional status message, signature, or profile image you add.
• Technical data - your IP address, browser user agent, and session cookies, used for authentication, rate limiting, and security.
• Game content - everything you create inside a world: characters, chat messages, private messages, forum posts, uploaded images, and any other content you submit.
• Activity data - timestamps of logins, last-seen status, and basic audit entries for staff actions (e.g. character edits, moderation).
• Age attestation - a record that you confirmed you are 18 or older when you created your account. We do not collect or store your date of birth.
• Payment data - if you buy a paid plan for a world you own, the payment is handled by Stripe. We store only the Stripe customer and subscription references for that world and its plan status. We never see or store your card details.
• Assistant messages - if you are the owner or an admin of a world, what you write to ArKey, the assistant in the admin panel.

We do not collect analytics data, advertising identifiers, or third-party tracking data. We do not sell or share your data with advertisers.

2. Why we collect it

• To provide the service - serving pages, delivering messages, persisting your characters and progress.
• To authenticate you - verifying your login and keeping your session secure.
• To keep the platform safe - detecting abuse, preventing spam, investigating violations of our Terms.
• To contact you about your account - e.g. email confirmations, password resets, security notices.
• To bill paid plans - charging the subscription of a world you own.
• To answer your questions in the admin assistant - only if you are an owner or admin and you use ArKey.

Under the GDPR, the legal bases we rely on are performance of a contract (delivering the service you signed up for, including a paid plan), legitimate interest (keeping the platform secure) and legal obligation (keeping billing records).

3. Where your data is stored

Your data is stored on infrastructure operated by Supabase (our database, authentication, and file storage provider), currently hosted in the European Union. Application hosting is provided by Vercel. Both providers act as data processors on our behalf and are bound by their own security and privacy commitments.

Some of the providers listed in section 4, such as Stripe, Anthropic and Google (YouTube), may process data outside the European Economic Area, in particular in the United States. For those transfers we rely on Standard Contractual Clauses, adequacy decisions or equivalent safeguards offered by the provider.

4. Third parties

We use the following third-party services to run RoleKey:

• Supabase - database, authentication, real-time messaging, file storage.
• Vercel - web hosting and content delivery.
• Elastic Email - delivers account emails, such as confirmation and password reset, for our authentication provider. It receives your email address.
• Stripe - payments for paid plans. When you subscribe, Stripe receives your email address and the name of your world, and collects your payment details on its own checkout page. For some processing, such as fraud prevention and its own legal obligations, Stripe acts as an independent controller under its own privacy policy.
• Anthropic - the AI model behind ArKey, the assistant in the admin panel, which only owners and admins can use. When you send it a message, the conversation and a summary of your world's configuration (settings and counts, no data about members or characters) are sent to Anthropic to write the answer. Under its commercial terms, Anthropic does not train its models on this data. We do not store ArKey conversations: they stay in your browser tab and are gone when you close it. Please don't write other people's personal data in ArKey.
• Google Fonts - font files are loaded from fonts.googleapis.com / fonts.gstatic.com. Google may log the request IP per its own policy.
• YouTube - videos embedded in worlds. A video loads only when you click it, and YouTube then receives your IP address under its own privacy policy.
• Cloudways - hosts the demo video on the RoleKey home page. Your browser loads it from there when you open that page, so Cloudways receives your IP address.
• Websites chosen by owners and players - inside a world, some images can be shown from another website by their address instead of being uploaded, for example the world's logo, an image in a forum post or in a character's biography. Your browser loads them from that website when you open the page, so that website receives your IP address under its own policy. We do not choose these websites. On RoleKey's own pages (Discover, profiles and the platform forum) we only show images uploaded to RoleKey; a character sheet you open from a profile follows the rules of its world.

We do not use analytics providers, advertising networks, or social-media tracking pixels.

5. Cookies

We only use technical cookies that are strictly necessary for the service to work: a Supabase session cookie (keeps you logged in), a theme preference cookie, and a subdomain-resolution cookie used by our multi-tenant routing. We do not use analytics or marketing cookies, so no cookie banner is required under the ePrivacy Directive.

6. How long we keep your data

We keep your data for as long as your account is active. You can delete your account at any time from Settings → Account; deletion removes your platform account, your characters and any worlds you own. Your private messages stay with the other person in the conversation, without your name.

Public game content you posted in worlds you don't own (chat messages, forum posts) may be retained by those worlds as part of their history, since it belongs to the shared story. You can ask the owner of a world to remove specific content, or contact us if they are unresponsive.

If you delete a world with a paid plan, its subscription is cancelled. Stripe keeps payment records as required by law and under its own policy.

Backup copies may persist for up to 30 days after deletion and are then overwritten.

7. Your rights (GDPR)

If you are in the European Economic Area, the UK, or Switzerland, you have the right to:

• Access - request a copy of the personal data we hold about you.
• Rectification - correct inaccurate or incomplete data.
• Erasure - delete your account and associated personal data.
• Portability - receive your data in a machine-readable format.
• Objection / restriction - object to or restrict certain types of processing.
• Complaint - lodge a complaint with your local data protection authority.

Access and Portability you can exercise yourself, right now. In Settings → Your data the Download my data button produces a JSON file containing everything listed in section 1 that belongs to you: your profile, the worlds you belong to, your characters, your messages, your forum posts and your rolls. Uploaded images appear as links rather than files, so download anything you want to keep before deleting your account.

For the other rights, or if the export is missing something, email cronachedirajadunia@gmail.com. We respond within 30 days.

8. Security

Passwords are stored hashed via Supabase Auth. Data in transit is encrypted with TLS. Access to production data is restricted to the operators of RoleKey. Despite our best efforts, no online service can be 100% secure - if we become aware of a breach that affects you, we will notify you as required by law.

9. Age requirement

RoleKey is an adults-only service and is not intended for users under 18 years of age. By creating an account you confirm that you are at least 18. If we learn that we have collected data from a user under 18, we will delete the account and the associated data without refunds.

10. Changes to this policy

We may update this policy from time to time. If we make material changes we will notify registered users by email or by a prominent notice in the product. The "Last updated" date at the top of this page always reflects the current version.

11. Contact

Data controller: RoleKey di Christopher Schon Giannarelli, Strada Nuova per Opicina 10, 34151 Trieste (TS), Italy (VAT 01452400326). Full provider details are on our About page.

For any privacy question, data request, or complaint, email cronachedirajadunia@gmail.com, or write to our certified address rolekey@pec.it.