Privacy Policy

1Introduction

CrownForge LLC ("we," "us," or "our") operates Questwright (questwright.app) (the "Services"). This Privacy Policy explains how we collect, use, and protect your personal information when you use Questwright. Other CrownForge products have their own accounts and their own privacy policies; a Questwright account is used only for Questwright.

We believe in transparency. We collect only what we need to provide our Services, we don't sell your data, and we'll tell you exactly what happens with your information.

2Information we collect

Account information

When you create a Questwright account, we collect:

• Username - Your unique login identifier
• Display Name - How your name appears to others
• Email Address (optional) - For account recovery
• Password - Stored securely using industry-standard hashing

OAuth login data

If you sign in with Discord, Google, or Twitch, we receive:

• Discord - Your Discord ID, username, and avatar URL
• Google - Your Google ID, email, name, and profile picture
• Twitch - Your Twitch ID, username, and profile picture

We only request the minimum permissions needed. We do not access your friends lists, server memberships, or any other data beyond basic profile information.

Content you create

When you use our Services, we store:

• Characters - Names, stats, backstories, inventory, and other character data
• Campaigns - Campaign settings, world information, and session history
• Campaign Configurations - Custom campaign setups including locations, NPCs, factions, quest hooks, deities, house rules, and DM instructions
• Game Sessions - Conversations with the AI Dungeon Master, dice rolls, and story events
• NPCs and Locations - Characters and places created during play

Communications

When you use our messaging and notification features, we store:

• Messages - Direct messages between you and other users, including party chats and DM conversations
• Notifications - Alerts about campaign activity, join requests, announcements, and other events
• Join Requests - Messages you send when requesting to join a campaign
• Block List - Users you have chosen to block from messaging you

Automatic deletion: Messages and notifications are automatically deleted after 30 days. Read notifications may be deleted sooner (after 7 days) to keep your inbox manageable.

Beta access requests

When you request beta access, we collect:

• Your name and email address
• Age range (to verify you are 18+)
• Your tabletop RPG experience level
• Your response about why you'd make a good tester
• Your Discord account information (required for beta)

Bug reports

When you submit a bug report, we collect:

• Your description of the issue
• Your Discord username and ID (if submitted via Discord)
• Current session ID (if applicable)
• Timestamp of the report

Usage and cost data

When you use AI-powered features (gameplay, campaign generation, backstory tools, rules questions), we log:

• AI request metadata - Which feature was used (e.g., gameplay, campaign creation, rules lookup) and the number of tokens consumed
• Estimated cost - A calculated cost estimate for each AI request, based on the provider's published pricing
• User and campaign association - Your user ID and (if applicable) the campaign ID, so we can attribute usage to the correct account and campaign

We do not log the content of your messages or the AI's responses in usage records. Usage logs contain only metadata (timestamps, token counts, cost estimates) and are used to manage platform costs, detect abuse, and ensure fair access for all users.

To fix bugs, we may keep an encrypted copy of the exact text sent to our AI providers for up to 7 days. It is deleted automatically, used only for troubleshooting, and never used for model training.

Policy acceptance and preferences

• Policy acceptance - When you accept our Terms of Service and this Privacy Policy, we record which version you accepted and when.
• Model training preference - Whether you have opted out of model training (see "Model Training" below).

3How we use your information

We use your information to:

• Provide and maintain the Services
• Create and manage your account
• Save your characters, campaigns, and game progress
• Generate AI-powered story content for your games
• Respond to bug reports and support requests
• Send service-related communications (password resets, account notices, and notices of changes to our Terms or this Policy)
• Improve the Services based on how they are used
• Train our own game models on de-identified gameplay data, unless you opt out (see "Model Training")
• Monitor AI usage and associated costs to manage platform resources, ensure fair access, and prevent abuse
• Adjust AI service quality on a per-user or per-campaign basis to maintain sustainable operations (see our Terms of Service Section 4.5)
• Review campaign configurations for potential inclusion as Community Modules (with your explicit consent; see our Terms of Service Section 4.3)

We do not sell your personal information. We do not share your data with advertisers or third-party marketers.

Campaign Configuration review: We may internally review Campaign Configurations to identify exceptional content for our Community Module program. This review is conducted by our team (not shared externally). We will never publish or share your Campaign Configuration without first contacting you and receiving your explicit permission.

4Model training

We are building smaller game models of our own, for example to help decide how the game world responds to a player's action. These models are trained on how Questwright is actually played. This section explains exactly which data is used and how it is protected.

What is used. Gameplay data: the actions players take, the game state around them, and the outcomes. Only data created on or after October 1, 2026 is used. Nothing from before that date is ever used for training.

Whose data. Players who have accepted the current Privacy Policy and the current Terms of Service, and who have not opted out. For every other player, their account, own turns and contact details are removed; game narration from shared scenes they took part in may remain, with their account details and character names removed.

How it is de-identified before anyone uses it. Each training copy is produced by an automated process on our own servers, in an isolated environment with no network access. Before the copy leaves that environment:

• Account details are removed: usernames, display names, email addresses, passwords, and sign-in (OAuth) identifiers.
• Account and campaign identifiers are replaced with pseudonymous identifiers that don't reveal who you are.
• Free-text fields are masked, so personal details you may have typed into a message or backstory are not carried over.
• The accounts, own turns, and contact details of players who opted out or haven't accepted the current Terms of Service and Privacy Policy, and all data from before October 1, 2026, are removed.
• An automated check verifies the result and blocks the copy if anything that should have been removed remains.

Only this de-identified copy is used for training. No person on our team, and no automated agent, works with the unprocessed data for this purpose.

Where training happens. Training runs on rented GPU servers from a cloud provider, which may be located outside the United States. Only the de-identified copy is sent, over an encrypted connection. The rented server and its storage are deleted at the end of each training run.

What the models are used for. Running and improving Questwright's features. We do not sell these models or the training data, and we do not share them with third parties. Our outside AI providers do not receive the training data and do not train their models on your gameplay (see "Third-Party Services").

Opting out. You can opt out at any time with the model training setting on your account page. Opting out removes your account, your own turns and your contact details from every future training copy. Game narration from shared scenes you took part in may remain, with your account details and character names removed. Models already trained are not individually retrained when one player opts out, but they contain no account details or identifiers, and your account, your own turns and your contact details will not be in any copy made after you opt out. Opting out does not affect how the game works for you.

5Third-party services

Outside AI providers

Questwright uses outside AI providers, through their paid APIs, to power the Dungeon Master, campaign generation, backstory tools, and rules questions. The provider used for any given request may vary between sessions or even within a session.

What they receive: Your messages during gameplay, character information relevant to the current scene, and campaign context needed to generate appropriate responses.

What they do NOT receive:

• Your email address
• Your password or account credentials
• Your Discord, Google, or Twitch login tokens
• Your IP address or location
• Your real name (unless you include it in your character's backstory)
• Any data from campaigns you're not actively playing

Their data practices: Our AI providers do not use this data to train their models. They keep requests under their own terms. Most keep them for a limited period for abuse and safety monitoring; some keep them for as long as they consider reasonably necessary for their services or other business purposes. With any provider, content flagged by their safety systems may be kept longer.

Hosting

Our servers are run by a hosting provider in the United States (Virginia). Model training runs on rented GPU servers from a cloud provider, which receive only de-identified data (see "Model Training").

Off-site backups

An encrypted copy of our backups is stored with a backup provider in the United States, so your data survives the loss of our own servers. It is encrypted on our servers before it is sent, and the provider cannot read it. It follows the same retention periods as our other backups (see "Data Retention").

OAuth providers

When you sign in with Discord, Google, or Twitch, you are subject to their respective privacy policies:

• Discord Privacy Policy
• Google Privacy Policy
• Twitch Privacy Notice

6Data retention

We retain your data for the following periods:

7Account deletion

You can delete your Questwright account at any time from your account page. To protect you from someone else deleting it, you will be asked to re-enter your password, or to sign in again with Discord, Google, or Twitch if that is how you log in. When you delete your account:

• Your Questwright account is permanently removed
• Your characters are permanently deleted
• Campaigns you run that no one else is part of are permanently deleted
• For each campaign you run that other players are part of, you can choose to hand it to an eligible player (someone you let in, by approving their join request or inviting them, or who has played in it), so their game can continue. Otherwise it is deleted with your account.
• Your contributions to other players' campaigns are removed
• Your data is excluded from all future model training copies
• Copies in our backups are deleted as those backups expire (see "Data Retention")
• We may retain anonymous, aggregated statistics (e.g., "X campaigns were played") that cannot identify you, and models already trained on de-identified data, which contain no account details or identifiers

8Data security

We protect your data using:

• HTTPS encryption for all data in transit
• Secure password hashing (passwords are never stored in plain text)
• OAuth tokens that are securely managed and not stored long-term
• Database access restricted to essential services only
• De-identification in an isolated environment before any data is used for model training

No system is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you promptly.

9Age requirements and COPPA compliance

During the beta period, CrownForge Services are only available to users 18 years of age or older.

In compliance with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect, use, or disclose personal information from children under 13. Our age verification measures include:

• Date of birth collection at registration to verify age
• Immediate rejection of registrations that do not meet the minimum age requirement
• No personal data is stored for rejected registrations

During the beta period, we enforce an 18+ minimum age. If we learn that we have collected data from someone under 18, we will delete it promptly and terminate the associated account.

After beta, we may allow younger users (13+) with appropriate restrictions, enhanced data protections, and parental consent requirements as required by COPPA and applicable state laws. This policy will be updated accordingly before any such change.

If you believe a child under 13 has provided us with personal information, please contact us immediately at [email protected] so we can delete the information.

10Your rights

You have the right to:

• Access - Request a copy of the personal data we hold about you
• Correction - Request correction of inaccurate data
• Deletion - Delete your Questwright account and associated data from your account page, or ask us to do it
• Data Portability - Request your data in a portable format
• Opt out of model training - Turn off model training from your account page at any time
• Withdraw Consent - Unlink OAuth accounts or close your Questwright account at any time
• Block Users - Prevent specific users from messaging you

To exercise any of these rights, use your account page or contact us using the information below.

11Cookies

We use essential cookies only:

• Session cookies - To keep you logged in to Questwright
• OAuth state cookies - Temporary cookies used during the login process for security

We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

12How we learn from usage

To improve Questwright, we record how the site is used: which pages you visit, which buttons and links you click, and roughly where on the page. We never record what you type, your passwords, or payment details.

These usage records are first party only. They are collected by our own code, stored on our own servers, and are not sent to any analytics company, advertiser or other third party. Our hosting provider, Cloudflare, counts anonymous page views for us, without cookies. Apart from that anonymous count, usage data never leaves our servers. We don't sell it, and we don't use it for advertising. We use it only to understand where people get stuck and to make Questwright better. None of this uses tracking cookies.

Usage records are tied to your account while you're signed in, so we can follow one visit from start to finish. We keep them for 6 months, then delete them. When you delete your account, your usage records are deleted with it.

13Changes to this policy

We may update this Privacy Policy from time to time.

• Significant changes, such as a new use of your data, will be announced on the site and by email to accounts with an email address at least 7 days before they take effect. You will be asked to review and accept the updated policy the next time you sign in after it takes effect. Until you accept, the new uses do not apply to your data.
• Minor changes, such as clarifications or updated contact details, will be posted on this page with an updated effective date.

14Jurisdiction

CrownForge LLC is operated from Pennsylvania, United States, and our servers are located in the United States. By using our Services, you consent to the processing of your data in the United States. If you are accessing from outside the US, please be aware that your data may be transferred to and processed in the US. De-identified training data may be processed temporarily outside the United States during a training run.

Questions about your privacy?Write to us from the Contact page and a person will answer.

Contact us