Privacy Policy

Introduction

CrownForge LLC ("we," "us," or "our") operates multiple products and services, including Questwright (questwright.app), CrownForge Business Portal (crownforge.work), and any future products accessible through your CrownForge account (collectively, "the Services"). This Privacy Policy explains how we collect, use, and protect your personal information when you use any of our Services.

We believe in transparency. We collect only what we need to provide our Services, we don't sell your data, and we'll tell you exactly what happens with your information.

Information We Collect

Account Information

When you create a CrownForge account, we collect:

• Username - Your unique login identifier
• Display Name - How your name appears to others
• Email Address (optional) - For account recovery
• Password - Stored securely using industry-standard hashing

OAuth Login Data

If you sign in with Discord, Google, or Twitch, we receive:

• Discord - Your Discord ID, username, and avatar URL
• Google - Your Google ID, email, name, and profile picture
• Twitch - Your Twitch ID, username, and profile picture

We only request the minimum permissions needed. We do not access your friends lists, server memberships, or any other data beyond basic profile information.

Content You Create

When you use our Services, we store:

• Characters - Names, stats, backstories, inventory, and other character data
• Campaigns - Campaign settings, world information, and session history
• Campaign Configurations - Custom campaign setups including locations, NPCs, factions, quest hooks, deities, house rules, and DM instructions
• Game Sessions - Conversations with the AI Dungeon Master, dice rolls, and story events
• NPCs and Locations - Characters and places created during play

Communications

When you use our messaging and notification features, we store:

• Messages - Direct messages between you and other users, including party chats and DM conversations
• Notifications - Alerts about campaign activity, join requests, announcements, and other events
• Join Requests - Messages you send when requesting to join a campaign
• Block List - Users you have chosen to block from messaging you

Automatic deletion: Messages and notifications are automatically deleted after 30 days. Read notifications may be deleted sooner (after 7 days) to keep your inbox manageable.

Beta Access Requests

When you request beta access, we collect:

• Your name and email address
• Age range (to verify you are 18+)
• Your tabletop RPG experience level
• Your response about why you'd make a good tester
• Your Discord account information (required for beta)

Bug Reports

When you submit a bug report, we collect:

• Your description of the issue
• Your Discord username and ID (if submitted via Discord)
• Current session ID (if applicable)
• Timestamp of the report

Usage and Cost Data

When you use AI-powered features (gameplay, campaign generation, backstory tools, rules questions), we log:

• AI request metadata - Which feature was used (e.g., gameplay, campaign creation, rules lookup) and the number of tokens consumed
• Estimated cost - A calculated cost estimate for each AI request, based on the provider's published pricing
• User and campaign association - Your user ID and (if applicable) the campaign ID, so we can attribute usage to the correct account and campaign

We do not log the content of your messages or the AI's responses in usage records. Usage logs contain only metadata (timestamps, token counts, cost estimates) and are used to manage platform costs, detect abuse, and ensure fair access for all users.

How We Use Your Information

We use your information to:

• Provide and maintain the Services
• Create and manage your account
• Save your characters, campaigns, and game progress
• Generate AI-powered story content for your games
• Respond to bug reports and support requests
• Send service-related communications (password resets, account notices)
• Improve the Services based on how they are used
• Monitor AI usage and associated costs to manage platform resources, ensure fair access, and prevent abuse
• Adjust AI service quality on a per-user or per-campaign basis to maintain sustainable operations (see our Terms of Service Section 4.5)
• Review campaign configurations for potential inclusion as Community Modules (with your explicit consent — see our Terms of Service Section 4.3)

We do not sell your personal information. We do not share your data with advertisers or third-party marketers.

Campaign Configuration review: We may internally review Campaign Configurations to identify exceptional content for our Community Module program. This review is conducted by our team (not shared externally). We will never publish or share your Campaign Configuration without first contacting you and receiving your explicit permission.

Third-Party Services

Some CrownForge products, including Questwright, use third-party AI providers to power features. The specific provider used for any given request may vary between sessions or even within a session.

Anthropic (Claude AI)

Questwright uses Anthropic's Claude AI for the Dungeon Master experience, campaign generation, backstory tools, and rules questions. When you use these features, your game conversations are sent to Anthropic's API to generate responses.

What Anthropic receives: Your messages during gameplay, character information relevant to the current scene, and campaign context needed to generate appropriate responses.

What Anthropic does NOT receive:

• Your email address
• Your password or account credentials
• Your Discord, Google, or Twitch login tokens
• Your IP address or location
• Your real name (unless you include it in your character's backstory)
• Any data from campaigns you're not actively playing

Anthropic's data practices:

• API data is retained for up to 30 days (recently reduced to 7 days for API logs)
• API customer data is not used to train Anthropic's models
• Content flagged by safety classifiers may be retained up to 2 years
• See Anthropic's Privacy Policy for full details

Google (Gemini AI)

Questwright also uses Google's Gemini AI. When Gemini handles a request, the same types of game data described above (messages, character context, campaign context) are sent to Google's API.

What Google receives: The same gameplay data as described above for Anthropic. Google does NOT receive your account credentials, login tokens, IP address, or data from campaigns you are not actively using.

Google's data practices:

• Gemini API data is not used to train Google's models when accessed via paid API
• API inputs and outputs may be logged temporarily for abuse monitoring
• See Gemini API Terms of Service and Google's Privacy Policy for full details

OAuth Providers

When you sign in with Discord, Google, or Twitch, you are subject to their respective privacy policies:

• Discord Privacy Policy
• Google Privacy Policy
• Twitch Privacy Notice

Data Retention

We retain your data for the following periods:

Data Type	Retention Period
Account information	Until you delete your CrownForge account, or 6 months of inactivity
Characters and campaigns	Until you delete them or your CrownForge account
Game session logs	Until the campaign is deleted
Messages	30 days (automatically deleted)
Notifications	30 days unread, 7 days if read (automatically deleted)
Bug reports	1 year
Beta access requests	Until end of beta period
AI usage logs (token counts, costs, model metadata)	1 year

Account Deletion

You can request deletion of your CrownForge account at any time by contacting us. Because your CrownForge account provides single sign-on (SSO) access to all CrownForge products, deleting your account affects all Services. When you delete your account:

• Your CrownForge account and access to all Services is permanently removed
• Your characters are permanently deleted
• Campaigns you created are permanently deleted
• Your contributions to other players' campaigns are removed
• Any data stored in other CrownForge products (e.g., business portal) is permanently deleted
• We may retain anonymous, aggregated statistics (e.g., "X campaigns were played") that cannot identify you

Data Security

We protect your data using:

• HTTPS encryption for all data in transit
• Secure password hashing (passwords are never stored in plain text)
• OAuth tokens that are securely managed and not stored long-term
• Database access restricted to essential services only

No system is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you promptly.

Age Requirements and COPPA Compliance

During the beta period, CrownForge Services are only available to users 18 years of age or older.

In compliance with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect, use, or disclose personal information from children under 13. Our age verification measures include:

• Date of birth collection at registration to verify age
• Immediate rejection of registrations that do not meet the minimum age requirement
• No personal data is stored for rejected registrations

During the beta period, we enforce an 18+ minimum age. If we learn that we have collected data from someone under 18, we will delete it promptly and terminate the associated account.

After beta, we may allow younger users (13+) with appropriate restrictions, enhanced data protections, and parental consent requirements as required by COPPA and applicable state laws. This policy will be updated accordingly before any such change.

If you believe a child under 13 has provided us with personal information, please contact us immediately at [email protected] so we can delete the information.

Your Rights

You have the right to:

• Access - Request a copy of the personal data we hold about you
• Correction - Request correction of inaccurate data
• Deletion - Request deletion of your CrownForge account and associated data across all Services
• Data Portability - Request your data in a portable format
• Withdraw Consent - Unlink OAuth accounts or close your CrownForge account at any time
• Block Users - Prevent specific users from messaging you

To exercise any of these rights, contact us using the information below.

Cookies

We use essential cookies only:

• Session cookies - Each CrownForge product may set its own session cookie to keep you logged in (e.g., one for Questwright, one for the Business Portal)
• OAuth state cookies - Temporary cookies used during the login process for security

We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by:

• Posting the new policy on this page with an updated effective date
• Announcing changes in our Discord server

Your continued use of the Services after changes take effect constitutes acceptance of the updated policy.

Jurisdiction

CrownForge LLC is operated from Pennsylvania, United States. By using our Services, you consent to the processing of your data in the United States. If you are accessing from outside the US, please be aware that your data may be transferred to and processed in the US.