Privacy Notice

About this notice

Last updated: 10 September 2026

At FableRealms, we think privacy information should tell you what actually happens to your information, not hide it behind pages of legal terminology.

This Privacy Notice explains what information FableRealms collects, why we need it, where it goes, how long we keep it, and the choices and rights you have.

FableRealms is a platform for creating worlds, running tabletop role-playing games, collaborating with other players and, if you choose, using Oracal, our optional AI-assisted tooling.

FableRealms is an 18+ service.

1. Who we are

FableRealms is operated by:

FableRealms Limited

United Kingdom

For most of the processing described in this Privacy Notice, FableRealms Limited is the data controller.

That means we decide why and how personal information is processed in connection with the FableRealms platform.

For privacy enquiries, data-rights requests or complaints, contact:

luke@fablerealms.io

You can use the same address for general support.

2. Who can use FableRealms

FableRealms is intended only for people aged 18 or over.

You must not create or use a FableRealms account if you are under 18.

We may ask you to confirm that you meet this age requirement when creating or using an account.

If we reasonably believe that an account belongs to someone under 18, we may suspend the account while we investigate and may delete it where appropriate.

If you believe that someone under 18 is using FableRealms, please contact us at:

luke@fablerealms.io

3. Information we collect

The information we process depends on which parts of FableRealms you use.

Account and authentication information

FableRealms currently supports authentication through third-party identity providers including:

• Google
• Discord

When you use one of these services to sign in, we may receive information necessary to create and authenticate your FableRealms account.

This may include:

• Your email address
• Your display name
• Your profile image or avatar, where provided
• A unique identifier associated with your Google or Discord account
• Authentication and session information
• The date your account was created
• Login and authentication events
• Your FableRealms user identifier
• Your subscription level
• Your account status and permissions

Authentication is handled using Supabase.

FableRealms does not receive or store your Google or Discord password.

The information Google or Discord processes when you use their services is also governed by their own privacy terms.

4. Campaign and storytelling content

A large part of FableRealms consists of information that you choose to create.

Depending on the tools you use, this may include things such as:

• Campaigns
• Campaign names and descriptions
• Stories
• Acts
• Chapters
• Pages
• Chronicle entries
• Characters
• Character sheets
• NPCs
• Monsters
• Creatures
• Locations
• Maps
• Scenes
• Tokens
• Items
• Inventories
• Quests
• Session notes
• Player notes
• DM-only information
• Story secrets
• Lore
• Images
• Artwork
• Uploaded files
• Table and session information
• Other material you choose to create or upload

We process this information because storing, organising, displaying and sharing it with the people you choose is the core purpose of FableRealms.

Campaign content may be stored using Redis Cloud and associated platform infrastructure.

Files and uploaded assets are stored using Amazon S3.

You control what you put into your campaign.

You should not use campaign content to store unnecessary real-world personal information about yourself or another person.

5. Private and shared content

FableRealms contains collaborative features.

Information you create may therefore be visible to other people where you choose to share it with them, for example by:

• Inviting someone to a campaign
• Joining another person's campaign
• Sharing information with players
• Using Guildhall
• Sending a direct message
• Publishing or sharing content using a feature designed for that purpose

Some campaign information may deliberately be restricted.

For example, a Dungeon Master may create information that players should not see.

We use access controls within FableRealms to determine which users are permitted to access different information.

You are responsible for choosing who you invite to your campaigns and what information you intentionally share with them.

6. Guildhall and direct messages

Guildhall allows FableRealms users to find and communicate with other users.

Where you use Guildhall, we may process information such as:

• Your FableRealms identity
• Profile information you choose to make available
• Campaign or group listings
• Applications or invitations
• Direct messages
• Message timestamps
• Participants in conversations
• Blocking, reporting or moderation information where those functions are used

Direct messages are stored using Supabase so that participants can access their conversations.

Messages are not public merely because they are stored by FableRealms.

However, authorised FableRealms personnel may access relevant information where this is reasonably necessary to:

• Respond to a support request
• Investigate suspected abuse
• Investigate a safety or security incident
• Enforce our Terms or community rules
• Prevent fraud
• Protect another user
• Comply with a valid legal obligation
• Diagnose a technical problem that cannot reasonably be resolved another way

We do not routinely read private messages or private campaign content.

7. Information collected automatically

When you use FableRealms, some technical information is generated automatically.

This may include:

• IP address
• Browser type and version
• Operating system
• Device information
• Session identifiers
• Authentication events
• Login timestamps
• Failed login attempts
• Pages or services requested
• API requests
• Error information
• Performance information
• Security events
• Server logs
• Approximate location derived from an IP address where relevant to security or analytics

We use this information primarily to operate, secure, monitor and improve FableRealms.

Our infrastructure logging currently includes services such as:

• Amazon CloudWatch
• Supabase platform and authentication logs

We do not use precise GPS location as part of the ordinary FableRealms service.

8. Analytics

We use Google Analytics to understand how people use the FableRealms website and platform.

Analytics can help us understand things such as:

• Which pages are visited
• Which features are used
• How visitors arrive at FableRealms
• Broad device and browser information
• General usage patterns
• Whether changes to the platform are working as expected

We use this information to understand and improve FableRealms rather than to sell advertising profiles.

Where consent is required for analytics cookies or similar technologies, those technologies should only be activated after the appropriate choice has been made.

You will be able to manage non-essential cookies through our cookie controls.

Further information will be available in our Cookie Notice.

We do not currently use FableRealms to serve third-party behavioural advertising.

9. Payments

Paid FableRealms subscriptions and purchases are processed by Stripe.

FableRealms does not store your full payment-card number, security code or complete payment-card credentials on our infrastructure.

Stripe handles payment-card information.

FableRealms may receive and retain information associated with a transaction, such as:

• Stripe customer identifier
• Subscription identifier
• Subscription status
• Product or plan purchased
• Transaction amount
• Currency
• Payment status
• Invoice identifier
• Payment date
• Refund or cancellation status
• Billing country where supplied
• Limited payment-method information made available by Stripe

Stripe also processes information independently where necessary to provide payment services, prevent fraud, comply with financial regulation and meet its own legal obligations.

10. Emails

FableRealms uses Brevo to deliver service and transactional email.

These emails may include things such as:

• Account-related messages
• Authentication messages
• Security notifications
• Campaign invitations
• Session notifications
• Subscription information
• Important changes to FableRealms
• Changes to our legal terms
• Privacy or security notices
• Support responses

We currently do not send marketing newsletters or promotional mailing campaigns and have no current plans to introduce them.

Brevo may process your email address and technical delivery information in order to send and troubleshoot email on our behalf.

If we decide to introduce optional marketing email in the future, we will update our privacy information and introduce any consent or unsubscribe controls required before doing so.

11. Oracal and artificial intelligence

FableRealms includes an optional AI-assisted service called Oracal.

You do not need to use Oracal to use FableRealms.

Oracal is intended to assist a storyteller, not replace one.

When you choose to use Oracal, FableRealms selects and weights relevant information from your campaign so that the response can understand the world and situation surrounding your request.

Depending on what you ask Oracal to do, the context sent may include things such as:

• Story information
• Campaign lore
• Locations
• Characters
• NPCs
• Monsters
• Items
• Relevant events
• Relevant campaign history
• Other campaign information needed to answer the request

We do not deliberately include your account-level personal information in this context.

For example, we do not intentionally send your:

• Email address
• Payment details
• Subscription payment history
• Google account details
• Discord account details

simply because you make an Oracal request.

However, campaign content is created by users.

If you type real-world personal information into a campaign and that information becomes relevant context for an Oracal request, it is possible for that information to form part of the content processed.

You should therefore avoid putting unnecessary real-world personal or sensitive information into campaign content.

12. How Oracal requests are processed

Oracal currently uses Google's Gemini API.

When you make an Oracal request, the relevant request and campaign context are transmitted to Google so that the model can generate a response.

FableRealms uses Google's paid Gemini API service for production use.

Under the applicable paid-service arrangements, Google states that customer prompts and responses are not used to improve its general products or train its general AI models.

FableRealms does not voluntarily contribute your Oracal requests, campaign content or responses to Google datasets for model training.

FableRealms does not maintain a permanent Oracal conversation-history feature containing every prompt and response you have made.

Google may process and temporarily retain API information in accordance with its applicable service terms, security requirements and abuse-prevention processes.

FableRealms may retain limited operational information about the use of Oracal, such as:

• The fact that a request was made
• Time of the request
• User identifier
• Campaign identifier
• Model or service used
• Oracle Credit usage or equivalent usage amount
• Processing status
• Technical error information
• Safety or abuse signals where applicable

We do not need to retain the full prompt and generated response simply to maintain that usage record.

If you choose to save an Oracal-generated NPC, monster, image, item, description or other output into your campaign, the saved result becomes ordinary campaign content and is stored until you delete it or delete the relevant campaign or account.

13. Oracal does not make decisions about you

Oracal is used to assist with storytelling and content creation.

We do not use Oracal to make decisions about:

• Whether you can have a FableRealms account
• Your subscription eligibility
• Your payment eligibility
• Your legal rights
• Your reputation
• Employment
• Credit
• Insurance
• Health
• Other decisions that produce legal or similarly significant effects

FableRealms does not currently use solely automated decision-making to make decisions about users that have legal or similarly significant effects.

14. Where we get information from

Most information processed by FableRealms comes directly from you.

We may also receive information from:

Google and Discord

When you choose one of them as your authentication provider.

Other FableRealms users

For example, when someone invites you to a campaign, sends you a message, includes you in collaborative activity or reports an interaction.

Stripe

For payment, subscription, billing and transaction status.

Your browser or device

Through ordinary service requests, security logging, cookies and similar technologies.

Google Analytics

Through usage and analytics information, subject to applicable consent requirements.

Our infrastructure providers

Through technical, authentication, security and service logs generated as FableRealms operates.

15. Why we process information and our lawful bases

Data-protection law requires us to have a reason for processing personal information.

Different reasons may apply depending on what we are doing.

Providing FableRealms

This includes creating your account, storing campaigns, running StoryEngine, WorldBuilder, Table, Chronicle, Guildhall, Codex and other platform features.

Lawful basis: performance of our contract with you.

We cannot provide an account-based storytelling platform without processing the information necessary to operate it.

Authentication

We process identifiers and authentication information so that we know which FableRealms account you are authorised to access.

Lawful basis: performance of our contract with you and our legitimate interests in securing the service.

Payments and subscriptions

We process subscription and transaction information to provide paid services and maintain billing records.

Lawful basis: performance of our contract with you and compliance with legal obligations.

Oracal

When you choose to use Oracal, we process your request and relevant campaign context in order to provide the requested AI-assisted feature.

Lawful basis: performance of our contract with you.

Guildhall and messaging

We process messages and interaction information so that users can communicate and use collaborative features.

Lawful basis: performance of our contract with you.

Security and fraud prevention

We process technical information, logs and account activity to protect users and FableRealms against attacks, unauthorised access, fraud and misuse.

Lawful basis: our legitimate interests in operating a safe and secure service and, where applicable, compliance with legal obligations.

Support

We process information you provide when asking for help so we can investigate and respond.

Lawful basis: performance of our contract with you and our legitimate interests in supporting users and maintaining the service.

Legal and regulatory requirements

We may retain or disclose information where reasonably necessary to comply with law, taxation requirements, valid legal process or regulatory obligations.

Lawful basis: compliance with legal obligations and, where appropriate, our legitimate interests in establishing, exercising or defending legal rights.

Analytics

We use analytics to understand and improve the service.

Where consent is legally required before analytics information can be collected or accessed on your device, we rely on your consent.

You can withdraw that consent through our cookie controls.

16. Who we share information with

Running FableRealms requires specialist technology providers.

We only provide them with information necessary for the relevant service.

Current categories and providers include:

Supabase

Used for authentication and parts of our platform database, including Guildhall messaging.

Redis Cloud

Used for FableRealms application and campaign information.

Amazon Web Services

Used for infrastructure services including Amazon S3 for user-created assets and Amazon CloudWatch for operational monitoring and logging.

Google

Used for Google authentication, Google Analytics and the Gemini API used by Oracal.

These are separate Google services and do not all receive the same information.

For example, using Google Analytics does not mean Google Analytics receives the contents of your private campaign, and using Oracal does not mean we intentionally send your FableRealms account or payment details to Gemini.

Discord

Used where you choose Discord to authenticate your FableRealms account.

Stripe

Used for payments, subscriptions and related financial processing.

Brevo

Used to send transactional and service email.

Professional advisers and authorities

We may disclose information to accountants, lawyers, insurers, regulators, courts or public authorities where reasonably necessary and lawful.

We may also use additional suppliers as FableRealms develops.

Where a new supplier materially changes how your personal information is processed, we will update this Notice as appropriate.

17. We do not sell your information

FableRealms does not sell personal information.

We do not sell campaign information.

We do not give advertisers access to private campaigns so that they can target advertisements at you.

We do not allow advertisers to buy lists of FableRealms users.

If this position ever materially changes, we would update this Notice and provide any choices required by applicable law before introducing such processing.

18. International processing

FableRealms is based in the United Kingdom but is available internationally.

Some of the technology companies we rely on operate infrastructure, support teams or subprocessors in multiple countries.

As a result, personal information may sometimes be processed outside the United Kingdom.

Where applicable data-protection law requires safeguards for an international transfer, we use or require appropriate mechanisms such as:

• An applicable adequacy decision or regulation
• Approved contractual safeguards
• Standard Contractual Clauses
• The UK International Data Transfer Agreement
• The UK Addendum to EU Standard Contractual Clauses
• Other legally recognised transfer safeguards

Our providers may also use subprocessors to deliver their services.

You can contact luke@fablerealms.io if you would like further information about the safeguards relevant to your information.

19. How long we keep information

We do not want to keep identifiable information indefinitely simply because storage is available.

How long we retain information depends on why it exists.

Account information

Kept while your account remains active and removed from active systems when your account is deleted, subject to the exceptions described below.

Campaign content

Kept while the campaign exists.

When a campaign is deleted, its associated content is removed from active FableRealms systems.

Uploaded assets

Files stored for a campaign or account are removed from active storage when the associated content is permanently deleted, subject to backup retention.

Guildhall messages

Stored while required to provide the messaging service.

They may be removed when the relevant data is deleted or the account is deleted, although limited information may be retained where necessary for a legitimate security, abuse, dispute or legal investigation.

Oracal content

FableRealms does not maintain a permanent prompt-history service.

Outputs that you explicitly save become ordinary campaign content and follow the retention rules for that campaign.

Limited operational usage records may be retained where needed for billing, Oracle Credit accounting, service operation, security and abuse prevention.

Technical and security logs

Retained for as long as reasonably necessary to operate, troubleshoot and secure FableRealms.

Retention may vary according to the type of log and infrastructure service involved.

Analytics

Analytics information is retained according to our configured analytics retention settings and is deleted or aggregated when it is no longer reasonably required.

Support and privacy communications

Kept as long as reasonably necessary to handle the request, maintain an appropriate record of our response, resolve disputes and meet legal obligations.

Financial records

Information forming part of our accounting and taxation records may be retained for the period required under applicable law.

For a UK limited company this will ordinarily include keeping relevant accounting records for at least six years from the end of the financial year to which they relate.

20. Backups and deletion

Redis and Supabase databases used by FableRealms are protected using backup and snapshot processes.

Our configured backup retention period is up to 30 days.

This means deleting something from the live FableRealms service does not necessarily erase every historical backup copy at that exact second.

When you delete content:

1. It is removed from the active service.
2. It is no longer available through the ordinary FableRealms interface.
3. Historical copies may temporarily remain within protected backups.
4. Those backup copies expire through our normal backup-retention cycle, currently within 30 days.

Backups are maintained for disaster recovery and service resilience.

We do not restore deleted information from a backup simply to continue using it after you have asked us to delete it.

If restoration of a complete system backup is necessary following a genuine technical failure, deletion requests and retention controls must continue to be respected when the restored system is returned to service.

21. Deleting your account

You may ask us to delete your FableRealms account.

Deleting an account will normally remove:

• Your active account
• Your profile
• Campaigns owned solely by you
• Associated campaign content
• Characters associated solely with your account
• Uploaded campaign files and assets
• Saved Oracal-generated campaign content
• Other account content that does not need to remain for another lawful reason

Before deleting an account, you may request that ownership of an eligible campaign is transferred to another user.

This must be arranged before final account deletion.

Once deletion has completed, we may not be able to recover your campaigns.

Some information may be retained after account deletion where necessary to:

• Comply with tax or accounting law
• Maintain transaction records
• Prevent or investigate fraud
• Protect the security of FableRealms
• Investigate serious abuse
• Establish, exercise or defend legal claims
• Comply with a court order or other valid legal requirement

Backup copies may remain for up to 30 days as described above.

22. Information about other people

FableRealms is a creative platform, and users can type almost anything into campaign notes and messages.

That means it is possible for one user to enter information relating to another real person.

If you provide personal information about another person, you are responsible for ensuring that you are entitled to provide that information.

Please do not upload or share unnecessary sensitive information about another person.

FableRealms is designed for fictional storytelling and collaboration, not as a database for real-world medical, financial, employment or other highly sensitive records.

23. Sensitive personal information

FableRealms does not require users to provide information about matters such as:

• Medical conditions
• Mental health
• Religion
• Political beliefs
• Race or ethnicity
• Sexual orientation
• Sex life
• Biometric information
• Criminal history

Please avoid entering real-world sensitive personal information into campaigns, messages or Oracal requests unless there is a genuine reason to do so and you are legally entitled to provide it.

Remember that fictional information about a fictional character is not automatically personal information simply because the story discusses these subjects.

The important distinction is whether the information relates to an identifiable real person.

24. How we protect information

No online service can promise that a security incident will never happen.

What we can promise is that protecting FableRealms and its users is treated seriously.

We use technical and organisational measures intended to protect information against unauthorised access, alteration, loss and disclosure.

These include measures such as:

• Encryption in transit
• Cloud-provider encryption and security controls
• Authentication controls
• Restricted administrative access
• Access permissions
• Logging and monitoring
• Backup and recovery processes
• Infrastructure monitoring
• Security updates
• Secrets and credential management
• Separation of appropriate platform components
• Investigation of suspicious activity

Access to production information is limited to people who require it for legitimate operational purposes.

If we become aware of a personal-data breach, we will investigate it and make any notifications required by applicable data-protection law.

25. Your privacy rights

Depending on where you live and the law that applies to you, you may have rights over your personal information.

Under UK data-protection law these can include:

The right to be informed

You have the right to know how your personal information is being used.

That is one of the reasons this Privacy Notice exists.

The right of access

You can ask us for a copy of personal information we hold about you.

The right to rectification

You can ask us to correct personal information that is inaccurate or incomplete.

The right to erasure

In certain circumstances, you can ask us to delete personal information.

This right is not absolute. For example, we may still need to retain financial information required by law.

The right to restrict processing

In certain circumstances, you can ask us to restrict how personal information is used.

The right to data portability

Where applicable, you may be entitled to receive information you provided to us in a structured, commonly used and machine-readable format.

The right to object

You may have the right to object to processing based on our legitimate interests.

Rights relating to consent

Where we rely on your consent, you can withdraw it.

Withdrawing consent does not make earlier processing unlawful.

Rights relating to automated decisions

You have rights relating to certain forms of solely automated decision-making.

FableRealms does not currently use solely automated processing to make decisions about you that produce legal or similarly significant effects.

26. How to exercise your rights

To make a privacy request, email:

luke@fablerealms.io

Please explain what you would like us to do.

We may need to verify that you are the person associated with the account before providing, changing or deleting information.

We will not ask for more information than reasonably necessary to verify your identity.

We will respond within the time required by applicable law.

For requests made under UK or EU data-protection law, this will normally be within one month, although the law allows different handling in certain circumstances.

There is normally no charge for exercising your data-protection rights.

27. Privacy complaints

If you think FableRealms has handled your personal information incorrectly, please tell us.

Email:

luke@fablerealms.io

Put Privacy Complaint in the subject line where possible.

We will:

• Provide a clear route for you to raise your concern
• Acknowledge your data-protection complaint within the legally required period
• Investigate the complaint appropriately
• Keep you informed where additional information is needed
• Explain the outcome of our investigation

For complaints governed by current UK requirements, we will acknowledge a data-protection complaint within 30 days.

You also have the right to complain to the Information Commissioner's Office (ICO) if you are unhappy with how we have used your information or handled your complaint.

If you live outside the United Kingdom, you may also have the right to complain to the data-protection or privacy regulator responsible for your country or region.

We would appreciate the opportunity to investigate your concern first, but contacting us does not remove your right to contact a regulator.

28. Cookies and similar technologies

FableRealms uses cookies and similar technologies where necessary to:

• Keep accounts signed in
• Secure sessions
• Remember essential settings
• Operate the platform

We also use Google Analytics to understand how the service is used.

Where consent is required before non-essential cookies or similar technologies can be used, we will provide controls allowing you to make that choice.

Essential technologies required for the platform to function may not require the same consent.

More detailed information about individual technologies, providers, purposes and retention periods will be provided in our Cookie Notice.

29. Legal requests and protecting people

There may be rare circumstances where we need to disclose information outside the normal operation of FableRealms.

For example, we may disclose information where we reasonably believe this is necessary to:

• Comply with applicable law
• Respond to a valid court order
• Respond to an appropriately authorised law-enforcement request
• Meet a regulatory obligation
• Establish or defend legal claims
• Investigate fraud or serious misuse
• Protect the rights or security of FableRealms
• Protect another person from serious harm

We will not voluntarily hand over user information simply because somebody asks for it.

Requests for information must have an appropriate legal or legitimate basis.

Where legally permitted and appropriate, we will seek to disclose only the information necessary for the relevant purpose.

30. If FableRealms changes ownership

Like any company, FableRealms Limited could one day be restructured, acquire another business, receive investment, merge with another company or be sold.

If that happens, information may need to be disclosed to professional advisers or transferred as part of the transaction.

Any organisation that becomes responsible for FableRealms personal information would remain subject to applicable data-protection obligations.

Where required, we will tell users about a material change in who controls their information.

31. Links and third-party services

FableRealms may contain links to websites or services operated by other organisations.

Their privacy practices are outside our control.

Opening a third-party website, joining an external community or using an external service may result in that provider processing information under its own terms.

This Privacy Notice applies to processing carried out by or on behalf of FableRealms and does not replace the privacy notices of independent third parties.

32. Global users

FableRealms is operated from the United Kingdom but is intended to be available globally.

Our primary privacy framework is based on UK data-protection law.

Depending on where you live, additional privacy laws may apply and may give you additional rights.

Where legislation applicable to FableRealms gives you rights beyond those described in this Notice, we will respect those rights.

If you are located in the European Economic Area, EU data-protection law may also apply to our processing where FableRealms offers services to you.

Details of any legally required EU representative will be published here where applicable.

33. Changes to this Privacy Notice

FableRealms will continue to evolve.

New features may change what information needs to be processed or how existing information is used.

We will review this Privacy Notice and update it when necessary.

The date at the top of this page shows when it was most recently updated.

For minor changes, publishing an updated Notice may be sufficient.

Where a change materially affects how we use your personal information, we will take reasonable steps to bring it to your attention before the new processing begins where required.

This may include:

• An in-app notification
• An account notice
• A website notice
• Email

Historic versions may be retained so that significant changes can be understood.

34. Contact FableRealms

Questions about this Privacy Notice, your information, deletion requests, access requests or privacy complaints can be sent to:

FableRealms Limited

United Kingdom

Email: luke@fablerealms.io

We would much rather you ask us if something is unclear than wonder what is happening with your information.

Privacy should not be a mystery.