Privacy Policy

1. Data we process

Depending on how you use FableWake, we process:

• account details supplied through Firebase Authentication, such as your email address, display name, profile photo, Firebase user identifier, and authentication security data;
• campaign and character data, including names, appearance descriptions, portraits, choices, actions, dice results, inventory, world state, NPC information, journal entries, and AI responses;
• multiplayer data, including room membership, character data, submitted actions, group-chat messages, activity times, and content reports;
• purchase and entitlement records when you buy through Google Play, such as the product or plan, purchase token, order reference, purchase status, and purchase or expiry time. FableWake does not receive your bank, card, or other payment-account details;
• technical data needed to operate and secure the service, such as session identifiers, timestamps, IP addresses, device/browser information, local browser storage, and the time you were last actively using the app (recorded at most once per minute while interacting with a visible page);
• when you use an ad-supported Android or iOS version, advertising data processed by Google Mobile Ads, which may include your IP address (and approximate location derived from it), app interactions, diagnostic information, and device or advertising identifiers.

2. Why we use data

We use account, campaign, and multiplayer data to provide the service and save your progress. Purchase records are used to verify purchases with the Apple App Store or Google Play, grant and restore credits or subscription access, prevent duplicate claims and fraud, and keep entitlements in sync. This processing is necessary to perform our agreement with you. We use limited technical data and reports to secure the service, prevent abuse, investigate problems, and protect players, based on our legitimate interests and legal obligations.

Advertising data is used to deliver and measure ads, limit invalid traffic, prevent fraud, and fund the ad-supported version. Where consent is required, we ask for it before requesting ads. You can reopen Advertising privacy choices from the account screen in the Android or iOS app. We ask for consent before adding other optional analytics or marketing uses that require it.

3. AI processing

Your character, recent campaign context, relevant memory, inventory, world state, dice outcomes, and player action can be sent to OpenAI to generate the next scene. An appearance description can be sent to generate a portrait. FableWake requests text responses with storage disabled. OpenAI may nevertheless retain limited abuse-monitoring logs for up to 30 days, unless law requires longer retention.

Do not put sensitive personal information in character names, story prompts, or chat messages. AI output can be incorrect or unexpected.

4. Service providers and other players

We use Google Firebase for sign-in, Google Play Billing for Android purchases, Google Mobile Ads for advertising in the ad-supported mobile versions, Cloudflare for hosting, databases and portrait storage, and OpenAI for text and image generation. These providers process data under their applicable terms and safeguards. Firebase Authentication is operated from the United States. Other providers may also process data outside the European Economic Area using appropriate transfer mechanisms where required.

Rewarded ads appear only after you choose to watch one. During internal testing, the app uses Google test advertisements. FableWake does not sell personal data.

In multiplayer, other room members can see your display name, character sheet, submitted actions, dice outcomes, and group-chat messages. Reports can be reviewed by authorised moderators or service administrators.

5. Storage and retention

Account and campaign information is retained while your account and campaigns remain active or while it is reasonably needed to provide the service. Solo campaigns can be deleted in the app. A multiplayer host can delete the shared campaign; another player can remove it from their own library. Browser settings and multiplayer session references remain on that device until they are replaced or browser storage is cleared.

You can download a machine-readable copy of your account and campaign data or permanently delete your account from the account screen. Deleting an account also deletes shared multiplayer campaigns you host for every participant. Server sessions expire after 30 days. Security, fraud, report, or legal records may be kept longer where necessary and proportionate.

6. Your rights

Where the GDPR applies, you may request access, correction, deletion, restriction, portability, or objection. Where processing relies on consent, you may withdraw it. You can also complain to your local supervisory authority; in the Netherlands this is the Autoriteit Persoonsgegevens.

We may ask for reasonable verification before acting on a request. Mandatory legal retention and the rights of other players can limit deletion in specific cases.

7. Security and children

FableWake uses HTTPS, hashed server-session tokens, access controls, and restricted account cookies. Passwords are handled by Firebase Authentication and are not stored in the FableWake campaign database. No internet service is completely secure.

FableWake is not intended for children under 16. A parent or guardian should contact us if a child has supplied personal data without valid permission.

8. Changes and contact

We may update this policy when the product, providers, or law changes. Material changes will be communicated in the app or by another appropriate method.

For privacy questions or requests, contact fablewakegames@gmail.com.