Privacy policy
In short
- We keep your email address to run your account (your password is stored only by our sign-in provider, never by us), and we save your characters and your story so you can pick up where you left off.
- The text you write in the game is sent to an AI provider so the Master can reply. Your email address is not.
- We use no advertising, no analytics and no cookies.
- From the account window in the game you can change your display name and delete your characters or your whole account yourself. To receive a copy of your data as a JSON file, or if you cannot sign in, write to privacy@travelersdiary.app.
1. Who is responsible
Traveler's Diary (the "service") is run by Matteo Cristofoli ("we"). We decide how the personal data described on this page is used, which makes us the "controller" under the GDPR. You can reach us at privacy@travelersdiary.app.
Our full details (registered address, tax or VAT number, certified email address) will be shown here before the service opens to the public.
2. What we collect and why
| Data | What it is | Why | Legal basis |
|---|---|---|---|
| Account | Your email address, a display name, a password (it passes through our server to our sign-in provider, which keeps it in protected form; we never store it), and the dates your account was created and last used. | To create and secure your account, let you sign in, and send you the confirmation and password emails. | Contract (Art. 6(1)(b) GDPR) |
| Proof of acceptance | The date and version of the legal texts you accepted when you signed up, and your statement that you are at least 16. | To be able to show that you accepted the texts and the age condition (Art. 7(1) GDPR). | Legitimate interests (Art. 6(1)(f) GDPR) |
| Game data | Your characters, the backstory you write, your messages and the Master's replies, the story summary, and your turn balance with its history. | To run the game, save your progress and count your turns. | Contract (Art. 6(1)(b) GDPR) |
| Newsletter | The email address you leave on the coming-soon page, with the date you signed up. | To tell you when the game launches. | Consent (Art. 6(1)(a) GDPR), which you can withdraw at any time on the unsubscribe page |
| Technical data | Your IP address and request details, which our hosting provider logs and which we use to limit abuse, for example too many sign-in attempts. | To keep the service secure and available. | Legitimate interests (Art. 6(1)(f) GDPR) |
We do not sell your data and we do not use it for advertising or profiling. What your browser stores on your device is described on the cookies and local storage page.
3. The AI Master and your text
The Master is an artificial intelligence. To write each reply we send an AI provider the story so far, your messages, your character sheet (name, race, class, items, backstory) and the campaign rules. We do not send your email address, display name or password. Today the provider is Anthropic, which processes this text on our behalf to produce the reply. Its own privacy policy is at anthropic.com/legal/privacy. If we change provider we will update this page.
Write fiction. Please do not put sensitive personal information about yourself or anyone else (health, beliefs, identifying details) in your messages or your character's backstory.
4. Who else handles your data
| Provider | Role | What it handles |
|---|---|---|
| Render | Hosting of the website and the game server | Every request to the service, including technical logs. |
| Supabase | Database and sign-in | Your account, game data and newsletter address, and your password in protected form. |
| Resend | Email delivery | Your email address and the text of the confirmation and password emails. |
| Anthropic | AI model | The game text described in section 3. |
Some of these providers are based in, or process data in, the United States. Where personal data leaves the European Economic Area, the transfer relies on a safeguard the GDPR allows, such as the standard contractual clauses approved by the European Commission.
5. How long we keep it
- Account and game data: for as long as your account exists. You can delete a character in the game at any time, which removes it and its story.
- Deleting your account: open your account in the game and choose "Delete my account". After you confirm with your password, your account, your characters and their stories, your turn balance, your sign-in and any newsletter signup under the same email address are deleted at once, and the game's saved data on that device is cleared (your theme choice stays). If you cannot sign in, write to us using the contact details in section 1, from the address you signed up with, and we delete it within 30 days. Copies held in our providers' backups disappear on their normal schedule.
- Inactive accounts: we do not currently delete them automatically.
- Newsletter address: until you withdraw on the unsubscribe page or delete your account under the same email address.
- Proof of acceptance: for as long as your account exists.
- Technical logs: for the period set by our hosting provider.
6. Your rights
Under the GDPR you can ask us to give you a copy of your data, correct it, delete it, limit how we use it, or send it to you in a portable format. You can object to uses based on legitimate interests, and withdraw consent at any time without affecting what happened before. From the account window in the game you can already change your display name and delete characters or your account; to receive a copy of your data as a JSON file, and for anything else, contact us using the details in section 1 and we will answer within one month.
If you think we have handled your data badly, you can complain to your local data protection authority. In Italy that is the Garante per la protezione dei dati personali (garanteprivacy.it).
7. Age
Traveler's Diary is for people aged 16 or older, and we ask you to confirm it when you sign up. If you believe a younger person has created an account, tell us and we will delete it.
8. Security
Connections to the service use HTTPS. Your password passes through our server only to reach our sign-in provider, which stores it in protected form; we never store it ourselves. No system is perfectly secure; if a breach affects you, we will tell you as the law requires.
9. Changes and contact
When we change this page we update the date at the top, and for important changes we will tell you by email or in the game and, for the legal texts, ask you to accept again. Questions about your data: use the contact details in section 1.