1. The short version
We collect the minimum an account and a game need: your email, your saved games, what you type into the game (so the game master can answer), and billing records without card numbers. We do not sell your data, we do not show ads, and we do not train models on your stories. Your game text is sent to the AI providers that run the game master and the illustrator; they process it to produce your turn.
2. Who is responsible
Kerf and Code LLC, Washington, USA, operates QuestSolo and is the data controller. Contact: kncadmin@kerfandcode.com.
3. What we collect
Account: your email address, a sign-in method (email link or Google), the times you sign in, and an account id. If you sign in with Google we receive your email and the name on that account; we use the email.
Game data: the worlds, characters, maps and stories you create, the choices and free text you type, dice results, and the settings you pick. Saved games are stored so they follow you between devices. A copy of the current game also lives in your browser’s local storage.
Billing: your Stripe customer and subscription ids, your plan, your credit balance, and a ledger of every credit granted or spent with the reason. Card numbers go straight to Stripe and never reach us. We also record what each game turn cost us to run, tied to your account, so we can keep the game priced fairly.
Technical: server logs with the time, route, response code and, for account and billing routes, your account id or email; these help us find faults. Google Analytics tells us how many people visit which public pages; it sets cookies and can see your IP address and a device identifier.
Messages: if you write to us through the contact page or by email, we keep the message and your address in our mailbox so we can reply.
4. Why we use it
To run the game and your account; to charge for credits and plans and honor refunds; to keep the daily free allowance fair; to find and fix faults; to answer you when you write; and to understand, in aggregate, how the game is used. The legal bases, where they apply, are performance of our contract with you, our legitimate interest in running and protecting the service, and consent for analytics cookies.
5. Who processes it for us
Anthropic runs the language model behind the game master; each turn sends it your recent game text and the game’s state. Google runs the image model that paints scenes, portraits and maps (it receives the text prompt for each picture), provides Google sign-in if you choose it, and runs Google Analytics. Supabase hosts our database and sign-in. Stripe handles payments, subscriptions and the billing portal. Vercel hosts the site and keeps our server logs. Resend delivers contact-form messages to our mailbox. Each of these processes data under its own terms and security practices; we send them only what their part of the job needs. Some of them are in the United States, so if you are outside the US your data is transferred there.
We do not share your data with anyone else except when the law requires it, to protect the service or other players from abuse, or as part of a sale or merger of the business (in which case these commitments travel with the data).
6. Cookies and local storage
The game itself uses your browser’s local storage, not cookies, to keep you signed in and to hold your current game and settings. Google Analytics sets its own cookies on the public pages; you can block them with a browser setting or an ad blocker and the game works exactly the same.
7. How long we keep it
Account, game and billing data stay while your account exists. Billing ledgers are kept for as long as tax and accounting rules require (typically seven years) even after an account is closed. Server logs are kept for a short rolling window (weeks, not years). Contact messages stay in our mailbox until they are no longer needed.
8. Your choices and rights
A finished tale can be downloaded as a keepsake from inside the game. To see, correct, or delete the data we hold about you, or to close your account, write to kncadmin@kerfandcode.com from the address on the account; we act on requests within 30 days. Deleting an account removes your profile, saved games and credit balance; billing records we are required to keep are retained in a form that no longer links to a live account. Depending on where you live, you may also have rights to restrict or object to processing, to data portability, and to complain to a supervisory authority.
9. Children
QuestSolo is not directed at children under 13 and we do not knowingly collect their data. If you believe a child under 13 has an account, tell us and we will delete it.
10. Security
Data travels over encrypted connections and is stored with providers that encrypt at rest. Access to the database is limited to the operator, and the keys that can read it never reach the browser. No system is perfectly secure; if we learn of a breach affecting your data we will tell you.
11. Changes
When this policy changes in a way that matters, we will email account holders or post a notice in the game before it takes effect. The current version always lives at this address.
See also the terms of service.