Privacy Policy

1. Overview & Core Philosophy

At LoreForge Works, L.L.C. ("LoreForge Works", "we", "us", or "our"), we believe your tabletop campaigns, character secrets, and narrative notes belong strictly to you. Our platform is engineered to facilitate real-time session synchronization—not to harvest, profile, or monetize your private table interactions.

This Privacy Policy explains what information we collect, how it is used to deliver the Service, and how your data is protected when using https://loreforge.works and our applications.

2. Information We Collect

We collect only the minimum information necessary to operate a synchronized multi-player table:

• Account Credentials: When you register an account, we collect your email address and an encrypted password hash via our authentication provider (Supabase Auth). We never possess or store plaintext passwords.
• Session & Campaign Data: When you create or participate in a tabletop session, we store character statistics, initiative cards, health vitals, Bennies, wounds, and encounter rosters (stored in structured JSONB format) to synchronize table state across connected devices.
• Local Browser Storage: We use browser localStorage to retain your interface preferences, selected 3D dice themes, active audio volumes, and local workspace drafts.
• Payment Information: All billing, invoicing, and payment processing is handled exclusively by our authorized Merchant of Record (such as Lemon Squeezy). Your credit card details, billing address, and bank accounts are processed directly by the payment processor and are never stored or seen by LoreForge Works servers.

3. How We Use Your Information

Your information is used solely to provide and improve the tabletop companion experience:

• Authenticating your account and authorizing access to private GM rooms.
• Broadcasting real-time roll updates and combat state changes to participants in your room via encrypted WebSockets.
• Sending critical transactional emails (such as password reset links or subscription receipts).
• Diagnosing unexpected system errors and software stability issues.

4. Data Sovereignty & No AI Training

5. Third-Party Service Providers

We partner with industry-standard cloud providers to operate the application infrastructure:

• Supabase Inc.: Provides SOC2-compliant, encrypted cloud database hosting (PostgreSQL) and real-time WebSocket channels.
• Lemon Squeezy: Operates as the Merchant of Record handling secure global payments, checkout flows, and tax compliance.

6. Data Retention & Your Deletion Rights

You have full control over the lifecycle of your campaign data:

• Room Deletion: Game Masters have access to a permanent room deletion control in the application header, allowing the instantaneous purge of all room roster entries, roll logs, and encounter state.
• Account Deletion: You may request the permanent deletion of your account and all associated profile records at any time by contacting us.

7. Contact & Privacy Requests

For privacy inquiries, data export requests, or account deletion, contact our administrative team: