Privacy Policy

What We Collect

Depending on the login method you choose (Discord, Google, or email), we receive your user ID, username, and/or email address. This information is used for authentication purposes only. We store your campaign content, including characters, lore, NPC descriptions, session history, and chat messages, to deliver the service to you.

How We Use It

Your data is used solely to run your AI-powered sessions and persist your campaign state. We do not sell, advertise with, or share your content with third parties beyond the AI providers necessary to deliver your sessions.

AI Providers and Training

Your session content is processed by AI providers (such as OpenRouter and Venice.ai) to generate GM responses. Each provider has its own data usage policy. If you bring your own API key (BYOK), your data is subject to that provider's terms, not ours.

Where possible, we configure our AI integrations to opt out of training data usage. Check individual provider settings for the most current information on their training data policies.

Your Content

You own everything you create in Stage Whisper: your campaigns, characters, lore, and session transcripts. We store it for you. You can export or delete your data at any time (see account deletion instructions below).

Age Verification (Didit)

To access age-restricted content (18+), you must verify your age through Didit (didit.me), a third-party identity verification provider. When you begin verification, you are redirected to Didit's platform, which operates under its own policies.

What Didit collects on our behalf

• Facial scan data (biometric data) for liveness verification
• Identity document data (where required by your jurisdiction)
• Device and technical data for fraud prevention

What we receive from Didit

• Verification result: pass/fail and age category
• We do not receive or store your facial scan, ID document images, or raw biometric data

Legal basis

We process age verification data based on your explicit consent (provided when you initiate verification) and our legitimate interest in restricting adult content to users who meet the legal age requirement in their jurisdiction.

Didit as independent controller

Didit may process anonymized or pseudonymized verification data for security, fraud prevention, model training, and legal compliance purposes. This processing is governed by Didit's own policies:

• Didit Privacy Policy
• Didit Verification Privacy Notice
• Didit End User Terms for Identity Verification

Data retention

We retain your verification status for the life of your account. Didit's retention of biometric data is governed by its own policies (see Verification Privacy Notice above).

Your rights

To exercise your data rights regarding verification data we control, contact us via community or support system. For data held by Didit as an independent controller, contact [email protected].

Legal Basis for Processing

We process your data under the following GDPR legal bases:

• Contractual necessity — storing your campaigns, characters, session history, and chat messages is necessary to deliver the Stage Whisper service you signed up for
• Explicit consent — age verification via Didit is based on your explicit consent, provided when you initiate verification
• Legitimate interest — authentication sessions, security measures, and fraud prevention

Data Retention

We retain your account and all associated campaign data indefinitely while your account remains active. If you delete your account (see Data Deletion below), all data is permanently removed after a 5-day cooldown period.

Inactive accounts may be removed at our discretion, with reasonable advance notice where possible.

Your Rights

Under GDPR, you have the right to:

• Access — request a copy of your personal data
• Rectification — correct inaccurate or incomplete data
• Erasure — delete your account and all associated data (see Data Deletion below)
• Portability — export your campaign data in a machine-readable format
• Objection — object to processing based on legitimate interest
• Withdraw consent — withdraw consent for age verification at any time

To exercise any of these rights, use the self-serve tools below or contact us via community or support systems.

Data Deletion

You can delete your account and all associated data at any time — no contact with support is required:

• While logged in: visit your Profile page and click "Delete Account". This schedules your account for deletion with a 5-day cooldown, during which you can cancel.
• Without logging in: visit stagewhisper.ai/delete-account, enter the email associated with your account, and verify with a one-time code.

After the 5-day cooldown, your account and all associated data — campaigns, sessions, turns, NPCs, locations, lore, BYOK keys, credits, and everything else — is deleted.

Third Parties

• Discord: used for authentication
• Google: used for Google Sign-In authentication on web and Android
• AI Providers (various providers via OpenRouter, and Venice.ai): process session content to generate GM responses
• Didit: age verification — collects facial biometrics and identity documents; see Age Verification section above
• Stripe: payment processing for credit purchases. Stripe collects payment information directly; we do not store full card details. See Stripe's Privacy Policy
• Resend: transactional email delivery (login codes, deletion verification). See Resend's Privacy Policy
• Hosting Provider: our server infrastructure, which stores your data

Cookies

We use only strictly necessary authentication cookies to maintain your login session. No tracking, advertising, or analytics cookies are used. Because these cookies are essential to the functioning of the service, they are exempt from consent requirements under the ePrivacy Directive.

Updates

This policy may be updated as the service evolves. Changes will be posted on this page.

Contact

For privacy-related questions or to exercise your data rights, reach out via the support system which appears when you are logged in, or our Discord server.