What We Collect

When you use Elsewhile, we collect the following information:

Account information: Email address and password (hashed) when you create an account.
Story content: The text you write during interactive fiction sessions, including your choices and character interactions.
Preferences: Settings like theme preference, content mode (SFW/NSFW), and response length preferences.
Usage data: Session activity, feature usage patterns, and performance metrics to improve the service.
Guest sessions: If you use Elsewhile without an account, we store a temporary session token to maintain your game state.
Device information: Browser type, operating system, and screen size for optimizing the experience.

Legal Basis for Processing

We process your personal data under the following legal bases (GDPR Article 6):

Contract performance: Processing your story content and account data is necessary to provide the interactive fiction service you requested.
Legitimate interest: Aggregated usage analytics help us improve service quality and fix technical issues. We balance this against your privacy rights.
Consent: Optional features such as NSFW content access, email notifications, and marketing communications require your explicit consent, which you may withdraw at any time.

How We Use Your Data

Provide the service: Your story content is processed by AI language models to generate narrative responses, character interactions, and NPC memories.
Improve quality: Aggregated, anonymized usage data helps us improve story generation quality and fix issues.
Account management: Email is used for authentication, password recovery, and essential service communications.

Third-Party Services and International Transfers

We use the following third-party services to operate Elsewhile. Your data may be transferred to and processed in countries outside your jurisdiction, including the United States:

AI language model providers (e.g., Google Gemini): Your story content is sent to AI providers to generate responses. These providers process data on servers that may be located in the United States or other countries. We use providers that maintain appropriate data protection standards. AI providers may process your content according to their own privacy policies but we do not authorize them to use your story content to train their models.
Cloud hosting (Google Cloud Platform): Our servers and database are hosted on GCP infrastructure in the United States.
Image generation services: Scene descriptions may be sent to image generation APIs to create visual content.
Payment processing (Stripe): If you subscribe to a paid plan, payment information is handled directly by Stripe. We do not store your credit card details.

For transfers of personal data from the European Economic Area (EEA), we rely on Standard Contractual Clauses approved by the European Commission and the data protection frameworks of our service providers.

Data Retention

Account data: Retained as long as your account is active. After account deletion, data is permanently removed within 30 days.
Guest sessions: Guest session data is retained for 30 days, after which it is automatically deleted.
Usage analytics: Aggregated, anonymized analytics are retained indefinitely. Individual usage records are deleted after 12 months.

Your Rights

Depending on your location, you may have the following rights regarding your personal data:

Access: Request a copy of the personal data we hold about you. You can also export your story data from the session page.
Deletion: Request deletion of your account and all associated data. We will process deletion requests within 30 days.
Correction: Update your account information through settings or by contacting us.
Portability: Receive your data in a structured, machine-readable format.
Restriction: Request that we limit processing of your data in certain circumstances.
Objection: Object to processing based on legitimate interest.
Withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.

To exercise any of these rights, contact us at privacy@elsewhile.ai. We will respond within 30 days.

California Privacy Rights (CCPA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

Right to know: You may request details about the categories and specific pieces of personal information we have collected.
Right to delete: You may request deletion of your personal information, subject to certain exceptions.
Right to opt out of sale: We do not sell your personal information to third parties.
Non-discrimination: We will not discriminate against you for exercising your privacy rights.

Children's Privacy

Elsewhile is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided us with personal data, please contact us and we will delete it promptly. Users must be at least 18 years old to access NSFW content.

Cookies and Local Storage

We use browser local storage to maintain your authentication token, theme preference, and session state. We do not use third-party tracking cookies. Local storage data remains on your device and is not transmitted to third parties.

Security

We use industry-standard security measures to protect your data, including encrypted connections (TLS), hashed passwords, and access controls. However, no method of electronic transmission or storage is completely secure, and we cannot guarantee absolute security.

Changes to This Policy

We may update this privacy policy from time to time. We will notify registered users of material changes via email. Continued use of the service after changes constitutes acceptance of the updated policy.

Contact

For privacy-related questions, data requests, or to exercise your rights, contact us at privacy@elsewhile.ai. We will respond within 30 days of receiving your request.

Privacy Policy