Responsible entity and contact
The formal identity of the responsible entity will be provided before the public launch.
For questions about the platform or your data, use the contact and suggestion form, choosing the appropriate category.
1. Data we process
- Account: name, email, hashed password and account activity dates.
- Content: worlds, text, images and relationships between characters, locations and events that you enter. Drafts are private and remain in your account until you complete them or delete your account.
- Activity: followed worlds, alerts, read status and notification preferences.
- Contact: name, email, category and message submitted through the suggestion form.
- Technical data: session and security information. The infrastructure may log IP addresses, browser data and errors for operation and diagnostics.
- Optional analytics: when you allow analytics cookies and the service is active, Google Analytics receives technical and browsing data on public pages.
2. Purposes and legal bases
We process the data needed to create your account, organize worlds, follow worlds and manage preferences to provide the service you request. Security, abuse prevention and handling suggestions rely on our legitimate interest in maintaining and improving the platform. Rights requests and other legal obligations are processed to comply with applicable law.
Optional update emails and analytics cookies depend on your choice. You can disable emails in Settings and withdraw analytics consent on the cookies page, without affecting the lawfulness of earlier processing.
3. What is public
Your creator name and public world content can be viewed by anyone and indexed by search engines. Unlisted worlds are accessible by link. Your email and password are not published on world pages. Administrators may access the data needed to manage and support the service.
4. Providers and recipients
Hosting: dominios.pt. Email provider: to be confirmed before public launch.
We use the hosting infrastructure and email provider configured to operate the service. These providers' access should be limited to what their roles require. Where active and authorized, Google Analytics is provided by Google; see Google privacy policy.
Pages may display external images, including from Unsplash or addresses added by creators. When loading these images, your browser contacts the provider, which receives technical connection data. Do not include personal data in image addresses.
Providers outside the European Economic Area may involve international transfers. Applicable providers and transfer mechanisms must be identified and assessed before the public launch. We do not sell your account data.
5. Retention
Account data and content are retained for as long as needed to use the platform. You can request deletion of your account and associated data using the contact above. Legal obligations, security, the defence of legal rights and backups may justify limited retention after that request.
Suggestions are retained for up to 365 days and removed by the maintenance routine. Your cookie choice is stored for 180 days; the site's analytics cookies last for up to one year. Report retention in Analytics depends on the service configuration.
We retain your cookie choice, policy version and date in a consent record for up to 365 days. This record uses a hashed random identifier and does not store your IP address or browser; when you are signed in, it is linked to your account.
6. Your rights
You can export your account data or delete your account under Data and privacy in settings. Other requests can be sent to the contact listed here. We respond within the applicable legal deadlines, generally within one month.
Where applicable, you may request access, correction, erasure, restriction or portability of your data and object to processing based on legitimate interests. You may also withdraw consent for optional purposes. We may request only the information needed to verify your identity.
To exercise these rights, use the contact provided or the suggestion form under Privacy and personal data. You have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD).
7. Security and updates
Passwords are stored as hashes and restricted operations require authentication and authorization. No service is risk-free; use a unique password and report suspected incidents. This policy will be updated when there are relevant changes to data processing.