Privacy Policy

Information We Collect

We collect account information such as email address, display name, profile photo, authentication identifiers, email verification status, subscription tier, and account timestamps.

We store campaign and character content you create or import, including characters, campaign metadata, maps, VTT sessions, dice rolls, tokens, props, fog state, story nodes, extracted locations, relationships, encounters, notes, chat messages, assistant responses, prompts, generated images, and uploaded or generated media.

If you upload a campaign source PDF, we may store the original file, filename, page count, storage location, extraction jobs, progress, results, generated map assets, and extracted campaign content.

Eligible purchases are handled by Stripe Managed Payments under the Sold through Link brand. Sold through Link, LLC acts as merchant of record. Stripe acts as an independent controller for personal data collected through Link for payment, billing, tax, fraud prevention, order management, transaction support, and related service purposes. We do not store full card numbers. We may store subscription tier, payment identifiers, cancellation status, credit balance, credit transaction records, and checkout or subscription event metadata.

Usage, Analytics, and Logs

We may collect technical and usage information such as pages and features used, product events, error logs, diagnostics, device and browser metadata, approximate location, IP-derived metadata, and timestamps.

The website and app use limited cookieless PostHog measurement for visits, signup outcomes, scroll depth, visible time, and traffic sources. Optional analytics cookies connect website and app journeys only after consent, and masked session recording may then run on both surfaces. Frontend analytics that use cookies or similar device storage, and session recording, run only after analytics consent where consent is required. Backend analytics and exception diagnostics may also be captured when configured; these do not depend on browser cookies, but they may still process personal data if event payloads identify users or accounts.

How We Use Information

• Create and manage accounts.
• Authenticate users and keep sessions secure.
• Provide campaigns, characters, VTT, chat, extraction, and generation features.
• Process subscriptions, credits, refunds, and billing state.
• Store and deliver user-created content.
• Run AI, OCR, image generation, and placement features requested by users.
• Debug, secure, monitor, and improve the service.
• Detect abuse, fraud, and policy violations.
• Comply with legal, accounting, tax, and payment obligations.

AI and OCR Processing

Some One Realm features use AI or OCR providers. When you request those features, we may send relevant prompts, uploaded pages, images, extracted text, campaign context, map images, chat messages, or generated assets to providers such as OpenAI, Mistral AI, DeepSeek, or other listed subprocessors, depending on the providers configured for that feature. To monitor quality, cost, and errors, AI assistant prompts, replies, and tool calls are also recorded in our product analytics provider (PostHog, EU region) and retained there for a limited period.

We do not use your private campaign content or uploaded PDFs to train our own foundation models. Third-party provider handling is described in our Subprocessors page and the providers' terms and privacy documentation.

Legal Bases for EU and UK Users

• Contract: to provide One Realm features, accounts, subscriptions, credits, support, and requested AI processing.
• Legitimate interests: to secure, debug, maintain, and improve the service, prevent abuse, and keep operational records.
• Consent: for optional browser analytics, tracking, marketing communications, or other optional processing where consent is required.
• Legal obligation: for accounting, tax, payment, fraud, and compliance records.

Sharing, Payment Partners, and Subprocessors

We share information with subprocessors that help us operate One Realm, including authentication, hosting, storage, analytics, AI/OCR processing, support, and security providers.

For eligible purchases, Sold through Link, LLC acts as merchant of record. Stripe independently controls personal data collected through Link for its payment, tax, fraud prevention, order management, transaction support, and related service responsibilities; it does not act solely as a One Realm subprocessor. See the Subprocessors and Payment Partners page for the current list and role descriptions.

We may disclose information if required by law, to protect rights and safety, in connection with a merger or sale of assets, or with your direction or consent. We do not sell your uploaded PDFs, campaign content, or character data.

Retention and Deletion

We retain information for as long as needed to provide One Realm, comply with legal obligations, resolve disputes, enforce agreements, prevent abuse, and maintain security.

Account deletion may not remove records we must retain for billing, tax, security, fraud prevention, or legal reasons. Backups are deleted on normal backup rotation.

Your Rights and Choices

Depending on where you live, you may have rights to access, correct, delete, export, object to, restrict processing, withdraw consent, opt out of tracking or marketing, and lodge a complaint with a data protection authority.

To make a privacy, data export, or deletion request, email privacy@one-realm.com. We may need to verify your identity before fulfilling a request.

One Realm handles requests concerning personal data we control. For personal data Stripe independently controls through Link, see the Link Privacy Policy and Stripe Privacy Center for available rights and request options.

Security and Transfers

We use technical and organizational measures designed to protect information, including authenticated access controls, httpOnly session cookies, provider security controls, and limited access to production systems. No service can guarantee perfect security.

We and our subprocessors may process information in countries other than where you live. Where required, we rely on appropriate safeguards such as contractual protections or other lawful transfer mechanisms.

Contact

Privacy and data requests: privacy@one-realm.com.

General support: support@one-realm.com.