Privacy Policy

1. Information We Collect

You provide:

• Account info - name, email, username, bio, avatar
• Content - story text you write, worlds and tales you design, and actions you type during play sessions
• Communications - reports you submit

Collected automatically:

• Usage data - pages visited, features used
• Device data - browser type, OS, device type
• IP address - for security, rate limiting, and abuse prevention
• Session cookies - for authentication

Play sessions can be joined by invite link without an account. For players without an account we store only the player name entered for the session and the IP-based limits above.

2. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Platform
• Authenticate your identity and manage your account
• Display the worlds and tales you publish, with attribution
• Send you emails about your account and activity - such as when a story you played in completes, or a weekly digest for projects you follow. You can turn each of these off in Settings.
• Detect and prevent fraud, abuse, and security issues
• Comply with legal obligations

We do not:

• Sell your data to third parties
• Use your data for advertising (there are no ads)
• Use content you submit to train AI or machine learning models

3. AI Features

Some features are AI-powered. When you use them, the relevant content is sent to a service provider to generate the result:

• Storyteller responses - during AI-run play sessions, the story so far and the actions players type are sent to Google (Gemini) to write the next part of the story
• Narration and ambient audio - the story text being narrated, or the scene description, is sent to fal.ai to generate audio

We send only what the feature needs, and we do not authorise these providers to use your content to train their models.

4. Information Sharing

• Public content - the worlds, tales, published stories, and profile information you publish are visible to other users
• Service providers - Fly.io (hosting), Neon (database), Stripe (payments - they handle your card details, we never see them), Resend (transactional email), Google and fal.ai (AI features, above), Upstash (rate limiting), and Cloudflare Turnstile (bot protection on signup). These process data on our behalf.
• Sign-in providers - if you choose to sign in with Google, Facebook, or Apple, that provider shares your name and email with us
• Legal requirements - if required by law, subpoena, or legal process
• Safety - to protect rights, safety, or property of TwistScript or its users

5. Data Retention

• Account data is retained while your account is active
• Worlds and tales you have published are retained after account deletion - your attribution remains
• Transaction records are retained as required for legal compliance

6. Your Rights

Depending on your location, you may have the right to access, correct, delete, export, or object to processing of your personal data. To exercise these rights, contact hello@twistscript.com.

California residents: we do not sell personal information. EEA residents: our legal basis is contract performance, legitimate interest, and consent where required.

7. Cookies

We use session cookies for authentication and preference cookies to remember your settings. We do not use cookies for advertising or tracking.

8. Children

You must be 13 or older to create an account, and we do not knowingly collect data from children under 13. Children may take part in a story played on a parent's or guardian's account under that adult's supervision; in that case the account and its data belong to the adult.

9. Security

We use HTTPS, secure authentication, and access controls to protect your data. No method of transmission is 100% secure.

10. Changes

We may update this Privacy Policy from time to time. Material changes will be communicated via the Platform. The date at the top of this page reflects the most recent update.