Skip to content
RIFTCOMMAND

Draft — pending legal review

A lawyer has not reviewed this text yet, and it will change before launch. Details in square brackets are still to be filled in.

Privacy notice

Version 0.1 (draft) ·

In short

  • We keep what the game needs: your email, your captain and crew, your orders and the story written for them, and your plan.
  • Your orders and the story so far go to the AI that writes your scenes. Some of the companies involved are outside the EU.
  • Free AI services are tried first, and their providers may keep your orders and the story and train AI on them. Keep personal data out of your orders.
  • We don’t sell your data, show ads, send marketing email, or use what you type to train AI ourselves.
  • Export or delete everything from Settings, under Account. Deleting is immediate and permanent.
  • RiftCommand is for people aged 16 and over.
On this page

Who is responsible for your data

[Company legal name] runs RiftCommand and is the controller of your personal data under the EU General Data Protection Regulation (GDPR). For anything in this notice, write to [Contact email].

Operator
[Company legal name]
Registered office
[Registered office address]
Registration
[Trade Register number]
Tax id
[Tax id (CUI) and VAT number]
Email
[Contact email]
Phone
[Phone number]

Data protection officer: [none appointed, or their name and contact: confirm]

What we collect

Your account

  • Your email address, and the name you give your captain.
  • Your password, which our sign-in provider (Supabase) stores only in scrambled (hashed) form. We never see it.
  • If you sign in with Google: the email address, name and profile picture link Google shares with the sign-in provider.
  • When you joined and when you finished your first commissioning.

Your game

  • Every order you type, and the story written in reply: scenes, dialogue, Bridge Logs and epilogues.
  • Your ship, crew, rank, missions, decisions, standing with each faction, memorials, and your energy and order balances.

What the AI receives

To write the next scene, our engine sends the AI your order together with what it needs to continue the story: the mission so far, your crew, recent lines and your captain’s name. It doesn’t receive your email address, payment details or IP address from us.

Free AI services that may keep and train on what they receive

To keep a free way to play, every request is first offered to AI services that OpenRouter makes available free of charge; only when those are busy or their daily allowance is used up does it go to the paid providers we have chosen. The providers behind the free services accept requests only on the condition that they may log and keep what they receive and use it to train their AI. So your orders, and the story written in reply with your captain’s and your crew’s names, may be stored by those providers and used to train AI, under their own policies. They decide how long they keep it, and we cannot have it deleted there.

Don’t type personal data into your orders: no real names, addresses, phone numbers, health details or anything else about you or other people. Your captain’s name is part of the story they receive too, so choose one that isn’t your own.

Legal basis for offering requests to these services: [legitimate interest in keeping a free way to play, or consent: confirm with the lawyer]

For each request to the AI we keep a record without its text: which part of the game asked, the AI used, its size, how long it took and what it cost.

Payments

  • Your plan, its status and renewal dates, the orders you have used, the packs you bought, and Stripe’s reference numbers for your customer account and subscription.
  • The payment notices Stripe sends us, which can include your name, email address, country and the amount paid. Your card details go only to Stripe.

Technical data

  • Our engine’s logs: your IP address, the address requested, the time, the result and your account’s id. What you type is left out of the logs.
  • Error reports when something breaks in our engine. What you type, your sign-in token and your cookies are removed before a report is sent.
  • What your browser stores for the game, listed on the cookies and storage page.

Messages

What you write to us, and our replies.

Why we use it, and on what legal basis

  • Running your account and the game

    Includes
    Signing you in, keeping your progress, and sending your orders to the AI that writes your scenes.
    Legal basis
    Performing our contract with you (GDPR art. 6(1)(b)).

  • Payments and records

    Includes
    Taking payments, managing plans and packs, keeping accounting and tax records.
    Legal basis
    Our contract with you (art. 6(1)(b)), and our legal duties under accounting and tax law (art. 6(1)(c)).

  • Keeping the game safe and working

    Includes
    Logs, error reports, limits on how fast requests can be sent, and stopping abuse and fraud.
    Legal basis
    Our legitimate interest in a secure, available game (art. 6(1)(f)).

  • Understanding cost and quality

    Includes
    Measuring what each mission costs to write and how well it works, from records without the story’s text.
    Legal basis
    Our legitimate interest in running the game sustainably (art. 6(1)(f)).

  • Answering you

    Includes
    Replying to messages, requests about your data, complaints and refunds.
    Legal basis
    Our contract with you, or a legal duty, depending on the request (art. 6(1)(b) and (c)).

  • Legal claims

    Includes
    Establishing, exercising or defending legal claims.
    Legal basis
    Our legitimate interest (art. 6(1)(f)).

Where we rely on legitimate interests, you can object, and we will stop unless we have compelling grounds to continue. We don’t use your data for advertising, we don’t sell it, and we don’t send marketing email. We don’t use what you type to train AI ourselves; the providers of the free AI services described above may.

Who helps us run the game

These companies handle personal data for us, under data processing agreements and only on our instructions, unless the card says they act on their own account.

  • Supabase

    Does
    Our database and sign-in: your account, your game and your email address.
    Where
    Supabase, Inc. (USA); data stored in [Supabase project region]

  • Stripe

    Does
    Takes payments and runs plans and refunds. It also acts on its own account to prevent fraud and meet its legal duties, under its own privacy policy.
    Where
    Stripe Payments Europe, Ltd. (Ireland), with transfers to Stripe, Inc. (USA)

  • OpenRouter

    Does
    Passes each request for the story to the AI that writes it: your orders, your captain’s name and the story so far.
    Where
    OpenRouter, Inc. (USA)

  • The free AI providers

    Does
    Write the story whenever a free AI service is available, which is first. They may log and keep your orders and the story they receive and use them to train AI, acting on their own account under their own policies, not on our instructions.
    Who and where
    [the providers behind the free AI services in use, and their countries]

  • The paid AI providers

    Does
    Write the story when no free service is available. For these we set OpenRouter to use only providers that, by their own policies, don’t keep requests after answering them or train on them; some may hold a request briefly to detect abuse.
    Who and where
    [the providers of the chosen AI and their countries]

  • Cloudflare

    Does
    Hosts this website and carries and protects the traffic to our engine: your IP address and request details.
    Where
    Cloudflare, Inc. (USA), on a worldwide network

  • Error tracking

    Does
    Receives error reports from our engine, without what you typed, your sign-in token or cookies.
    Who and where
    [Sentry or GlitchTip, company and region]

  • Hosting

    Does
    Runs our game engine and keeps its logs. We manage it ourselves with Coolify, deployment software we run on that machine.
    Who and where
    [hosting provider and country]

  • Email delivery

    Does
    Sends sign-in, confirmation and password-reset emails to your address.
    Who and where
    [email delivery provider and country]

  • Google (only if you sign in with Google)

    Does
    Confirms who you are and shares your email address, name and picture link. Google acts on its own account, under its own privacy policy.
    Where
    Google Ireland Limited, with transfers to Google LLC (USA)

  • Hugging Face (only if you get the voice pack)

    Does
    Your browser downloads the voice files from it, so it sees your IP address. Nothing you say or read is sent.
    Where
    Hugging Face, Inc. (USA)

We also share data when the law requires it (for example with tax or consumer authorities or a court), with our professional advisers, and with a company that takes over the game, which would then be bound by this notice.

Data that leaves the EU

Several of the companies above are based in the United States, and the AI that writes your story may run outside the European Economic Area. When data goes to a country the European Commission has not found to protect it adequately, we rely on the safeguards the GDPR allows: the EU-US Data Privacy Framework for companies certified under it, or the Commission’s standard contractual clauses.

Which safeguard covers each company: [list per processor, from the signed agreements]. You can ask us for a copy of the safeguards.

How long we keep it

  • Your account and your game

    Kept
    While your account is open. Deleting your account erases them at once.

  • Accounts nobody uses

    Kept
    [period after which an inactive account is deleted]

  • What the free AI providers keep

    Kept
    As long as each provider’s own policy says. Deleting your account here doesn’t reach those copies.

  • Records of AI requests

    Kept
    Unlinked from you when you delete your account, then kept without the link for cost accounting for [period].

  • Payment records

    Kept
    For as long as Romanian accounting and tax law requires: [period, to confirm with the accountant]. When you delete your account, the payment notices we keep are cut down to amounts and statuses.

  • Engine logs

    Kept
    [log retention, for example 14 days]

  • Error reports

    Kept
    [retention set at the error tracking provider]

  • Backups

    Kept
    Database backups are kept for up to [30 days: confirm against the backup job], so a deleted account is gone from them within that time.

  • Messages

    Kept
    As long as we need them to deal with what you asked, then [period].

Your rights

Under the GDPR you have the right to:

  • get a copy of your data, and receive it in a format a machine can read (access and portability);
  • have wrong data corrected;
  • have your data erased;
  • have its use restricted while a question about it is settled;
  • object to uses based on our legitimate interests;
  • complain to a data protection authority.

In the game

  • Export my data, in Settings under Account, downloads a file with your profile, ship, crew, missions with every order and scene, billing records and a log of the AI requests made for you.
  • Delete account, in the same place, erases your account and your game at once. For your safety it asks you to have signed in within the last 10 minutes. It also ends any plan straight away, without a refund for the rest of the month, and closes your customer account at Stripe, which keeps the records the law requires of it.

You can also write to [Contact email]. We may ask you to confirm the request from your account’s email address. We answer within one month; if a request is complex we can take two months more, and we tell you why.

Complaints

You can complain to the Romanian data protection authority, ANSPDCP, or to the authority of the EU country where you live or work. We would appreciate the chance to put things right first.

Children

RiftCommand is for people aged 16 and over, and you confirm your age when you sign up. If you believe a child under 16 has an account, tell us and we will delete it.

Decisions made by code

The game’s code decides what happens in your missions and applies your plan and energy by fixed rules. None of this has legal or similarly significant effects on you, so the GDPR’s rules on automated decisions of that kind (art. 22) don’t apply. The AI disclosure explains how an order is decided.

Security

Connections to the game are encrypted. Every request for your data needs a valid sign-in, your password is stored only hashed, and access to player data is limited to the people who run the game. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authority as the law requires.

Changes to this notice

When we change this notice, we update the version and date at the top. If a change affects how we use your data in an important way, we tell you by email before it applies.