Privacy Policy

This policy explains how Bookwyrm handles personal data when you browse public pages, create an account, join a campaign, use live-session or AI features, publish work, buy something, sell through a storefront, or contact support. Bookwyrm uses personal data to operate the service; it does not sell personal data to data brokers or build cross-site behavioural advertising profiles.

1. Data we collect

• Account data: name, email address, authentication methods, security settings, preferences, teams, and connected accounts.
• Product data: characters, compendiums, drafts, campaigns, notes, chats, files, permissions, activity needed to operate collaborative features, and publication choices.
• Commerce data: products, orders, subscriptions, gifts, refunds, payout status, and transaction identifiers. Stripe handles full payment-card details.
• Support and safety data: contact threads, reports, appeals, supplied context, and records needed to investigate and reply.
• Technical data: IP address, device and browser information, request identifiers, security events, cookies or local storage needed for sessions and preferences, and privacy-conscious first-party usage measurements.
• Optional voice data: session audio, transcripts, speaker labels, and, only where the feature and consent flow require it, voice characteristics used to distinguish consenting speakers.

2. Why we use it

We use data to provide accounts and requested features, enforce access rules, deliver purchases, process payments and seller onboarding, secure and debug the service, prevent fraud and abuse, answer support requests, comply with legal obligations, and understand aggregate product use. Where law requires a specific legal basis, it will generally be performance of the service agreement, legitimate interests in operating and securing the product, consent for optional processing such as recording, or compliance with law.

3. Visibility and collaboration

Your visibility choices determine who can see content. Private work is processed to provide requested features, security, moderation, backup, and user-invoked AI. Team collaborators and campaign members can see material granted to their role. Public work can be viewed, indexed, cached, linked, and copied by third parties. Review the owner, visibility, and campaign-sharing controls before publishing or sharing.

4. AI providers

Bookwyrm sends content to an AI provider only when you invoke an AI-backed feature such as Quill, image generation, transcription, or Live Assist. It sends the context needed for that request rather than an unrelated account history. Provider contracts should prohibit using submitted private content to train general models. AI output and the related prompt or conversation may be stored in Bookwyrm so the feature can work and you can review its history.

5. Recording, transcription, and voice characteristics

A session recording or transcription can begin only after the product’s consent gate is satisfied, and the interface keeps a visible recording state. Source session audio is deleted after 30 days by default and cannot be configured beyond 90 days. A DM may delete it earlier. Transcripts, recaps, and campaign notes may remain with the campaign until deleted under its controls.

Voice characteristics used to distinguish speakers are sensitive. They are created only for consenting participants, used only for speaker attribution in the requested session features, and can be erased without deleting the readable transcript.

6. Payments and other service providers

Bookwyrm uses service providers for hosting, storage, email, search, security, AI, analytics, payment processing, seller onboarding, and print fulfilment where requested. They receive only the data needed for their role and process it under their own terms and our applicable agreements. For marketplace sales, the creator’s connected Stripe account is the merchant of record; Bookwyrm and Stripe also process transaction data needed to complete and administer the sale.

7. Creator promotion

Bookwyrm may recommend creators, releases, or relevant content inside its own product using contextual signals such as what page, ruleset, or content category you are viewing and the creators you choose to follow. It does not sell this data or use it to follow you across unrelated websites.

8. Retention

Data remains while needed to provide the account and features you use. Support, safety, payment, tax, fraud, and dispute records may be kept longer where reasonably required. Generated account-export archives expire after 7 days. Scheduled account deletion has a 14-day restoration window. Backups rotate on an operational schedule, so deleted data may persist there temporarily before ageing out and is not restored except for disaster recovery.

9. Your choices and rights

You can edit account details, change visibility and notification preferences, manage connected accounts, export account data, and schedule account deletion through the product. Depending on where you live, you may also have rights to access, correct, erase, restrict, object to, or receive a portable copy of personal data, and to complain to a data-protection authority. Use the privacy contact route for a request the self-service controls do not cover.

10. Security and children

Bookwyrm uses access controls, encryption in transit, credential protections, request logging, and operational safeguards appropriate to the service. No system can promise perfect security; report suspected compromise promptly. Accounts are for adults aged 18 or older, and Bookwyrm is not directed to children.

11. International processing and changes

Providers may process data in countries other than your own. Where required, Bookwyrm relies on contractual or other recognised safeguards for those transfers. We may update this policy as the service or its providers change and will give reasonable notice of material changes.

12. Contact

For privacy questions, rights requests, or data-protection concerns, use the privacy and data request form. For urgent safety issues, choose Safety or abuse instead.