Privacy Policy

1. Who We Are

Game Master's Dream is operated by Matthew G., an individual developer. If you have questions about this policy, contact us at: contact@gamemastersdream.com.

2. Information We Collect

We collect the following information when you use our service:

• Account information: Your name, email address, and hashed password when you create an account.
• Campaign data: Campaign names, story nodes, NPC data, character sheets, maps, and other content you create within the app. This data is stored in our database and locally on your device.
• Subscription data: Your subscription status, plan type, and payment processor identifiers (LemonSqueezy customer ID and subscription ID). We do not store payment card numbers — payments are handled entirely by LemonSqueezy.
• Usage data: The number of AI generations used per month, to enforce subscription plan limits.
• Email verification and 2FA codes: Temporary one-time codes sent via email for account verification and two-factor authentication.
• Password reset tokens: Temporary secure tokens used to verify identity during password resets.

3. How We Use Your Information

We use the information we collect to: operate and maintain the service; verify your identity and secure your account; enforce subscription limits; send transactional emails (account verification, password resets, subscription confirmations); and respond to support requests. We do not sell your personal data to third parties.

4. Third-Party Services

We use the following third-party services that may process your data:

• Vercel — Web hosting and infrastructure.
• Neon — Database storage (your account and campaign data is stored here).
• LemonSqueezy — Payment processing and subscription management (Merchant of Record).
• Brevo (Sendinblue) — Transactional email delivery (verification, password reset, subscription emails).
• Google Gemini API — AI content generation (NPC and companion descriptions for Pro subscribers).
• Upstash Redis — Rate limiting (request frequency data, not campaign content).
• PartyKit — Real-time live session connections (Pro subscribers).

5. Data Retention

Unverified accounts (email not confirmed within 24 hours) are automatically deleted. Active accounts and all associated campaign data are retained for as long as your account remains open.

When you delete your account, your personal data and campaign content are scheduled for permanent deletion and will be purged within 30 days. After that period, no recovery is possible. Subscription billing records may be retained for up to 7 years where required by law.

6. Your Rights

Depending on your location, you may have rights regarding your personal data, including:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request that we correct inaccurate data.
• Erasure (right to be forgotten): Delete your account at any time via Settings — this wipes your data within 30 days. For other erasure requests, contact us by email.
• Restriction / Objection: Object to or ask us to restrict certain processing of your data.
• Data portability: Request a machine-readable export of your personal data.

EU residents (GDPR): Our lawful basis for processing your data is performance of our contract with you (operating the service) and our legitimate interest in securing the platform. You have the right to lodge a complaint with your local data protection authority.

California residents (CCPA): We do not sell your personal information. You have the right to know what personal data we collect and to request its deletion. We do not discriminate against users who exercise their privacy rights.

To submit any rights request other than account deletion, email us at contact@gamemastersdream.com. We will respond within 30 days.

7. Cookies

We use a session cookie to keep you logged in. We use a localStorage entry to remember your UI preferences (theme, active campaign). We do not use third-party advertising cookies or tracking pixels.

We use Vercel Analytics to collect aggregated, privacy-friendly page view data and Core Web Vitals metrics. Vercel Analytics does not use cookies and does not track individual users across sessions or sites. No personal data is associated with these analytics. For more information, see Vercel's Analytics privacy documentation.

8. Children's Privacy

This service is not directed to children under the age of 13. We do not knowingly collect personal data from children under 13. If you believe a child under 13 has provided us with personal data, contact us and we will delete it promptly.

9. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email. The "Last updated" date at the top of this page reflects the most recent revision.

10. Contact

For questions or data deletion requests regarding this Privacy Policy, contact: contact@gamemastersdream.com.