Privacy Policy

1. Overview

Truesight is committed to protecting your privacy. This Privacy Policy explains:

• What data I collect
• How I use it
• Your rights regarding your data
• How I protect it

Critical Commitment: I never sell your world content or personal identity. Period.

2. What Data I Collect

2.1 Account Data

When you sign up, I collect:

• Email address
• Password (hashed, never stored in plaintext)
• Display name (optional)
• Account creation date

Why: To authenticate you, send important updates, and recover your account.

2.2 World Data

When you use Truesight, I store:

• Your maps, wiki entries (locations, NPCs, quests, enemies, items, factions)
• Your edits and refinement history

Why: So you can use Truesight to build and organize your world.

2.3 Metadata I Extract (For Analytics & Model Improvement)

I automatically extract structural patterns from your content updates, but never your actual content:

What I extract:

• Location types present (tavern, dungeon, forest, etc.) and counts
• NPC counts and relationships to locations
• Quest structure (complexity, chains, connections)
• Enemy types and frequency
• Faction relationships and density
• Worldbuilding patterns (such as the kinds of Entries created)
• Feature refinement patterns (which AI suggestions you correct)

What I DO NOT extract:

• Actual NPC names, descriptions, or backstories
• Actual location names or descriptions
• Actual quest text or plot details
• Your email, username, or any identifying information
• Links between content and your identity

Example: I extract “World A has 3 taverns, 2 temples, and 1 dungeon” but NOT “The Broken Tavern is run by Barkeep Bob in the market district.”

2.4 Technical Data

I collect standard technical information:

• IP address
• Device type, browser, operating system
• Pages visited, features used, time spent
• Error logs for debugging
• Performance metrics

Why: To improve Truesight, debug issues, and understand usage patterns.

2.5 Issue Reports

When you send a bug report, feature request, support request, or other feedback through Truesight, the text you enter is sent to the Truesight issue tracker. That repository will become public, so do not include world content, personal information, or anything you do not want to share publicly.

You may choose to include basic troubleshooting details: the current page type with record identifiers removed, browser and operating-system information, and screen size. This option is off by default. Truesight does not automatically attach your account identity, world content, or map content. Screenshots can only be added through the linked GitHub issue form and are shared according to GitHub's privacy terms.

2.6 Payment Data

I use Stripe for payments. I do not store your payment methods; Stripe does.

I store:

• Subscription tier
• Billing dates
• Payment history (not card details)

3. How I Use Your Data

3.1 To Provide Truesight

• Store your worlds and Entries
• Process your map uploads and AI linking
• Execute Scribe's features

3.2 To Improve Scribe

I improve Scribe using:

• Your extracted metadata (patterns, not content)
• Your refinement history (which Scribe suggestions you corrected)

You own your content. I own the patterns I learn from it.

This is opt-out by default—if you disable analytics in settings, I don't extract metadata.

3.3 For Research & Analytics

Aggregate, anonymized patterns only:

• “70% of worlds include taverns”
• “Average NPC-to-location ratio is 2.3”
• “Quest chains average 3.2 steps”
• “Users in Europe prefer intrigue-focused worlds”

These insights are extracted only from worlds where users have not opted out of analytics.

I may publish reports or sell these patterns to:

• Game publishers (Paizo, Level Up Collective, etc.)
• Tool makers (VTT platforms, campaign planning tools)
• Academic researchers studying creative worldbuilding
• Market research firms

I will never sell patterns linked to your identity.

3.4 For Legal & Security

• Comply with legal obligations
• Prevent fraud or abuse
• Protect Truesight and user security

4. Data Sharing

4.1 Third-Party Services

I use these services (all with EU data center options):

• Stores hashed credentials
• Email for account recovery

Payments: Stripe

• Handles all payment processing
• I never see your payment methods

Cloud Infrastructure: AWS EU

• All data stored in European data centers
• Encrypted in transit and at rest

Analytics:

• Only if you haven't opted out of analytics
• As of September 2026 no data collected yet.

All third parties are GDPR-compliant and under Data Processing Agreements.

4.2 I Will NOT Share

• Your personal identity with any party buying aggregate data
• Your world content with anyone
• Your email or contact info with marketers
• Links between your identity and your behavioral patterns

5. Your Rights (GDPR & CCPA)

You have the right to:

5.1 Access

Request all data I hold about you. Email: privacy@Truesight.world

5.2 Rectification

Correct inaccurate data. Edit your account settings or contact us.

5.3 Deletion (Right to Be Forgotten)

Request permanent deletion of your account and associated data.

Timeline:

• Immediate deletion of all worlds, Entries, and account data from live systems
• Backups retained for 30 days (for recovery purposes), then permanently deleted
• Metadata extracted from your worlds for analytics is immediately anonymized/removed

You can request deletion at any time in your account settings or by emailing privacy@Truesight.world

5.4 Data Portability

Request your data in a portable format (export of your worlds and Entries).

5.5 Opt-Out of Analytics

Toggle “Share anonymized metadata for research” in Settings.

• Disables future metadata extraction
• Does not retroactively remove already-extracted patterns
• Can be re-enabled anytime

5.6 Opt-Out of Marketing

I don't send marketing emails. You receive product updates and security notices only (required for account operation).

6. Data Retention

6.1 World & Account Data

• While you have an account: Indefinitely, until you delete
• After deletion: 30 days in backups, then permanent deletion
• Metadata extracted: Kept indefinitely in anonymized form for analytics (cannot be linked back to you)

6.2 Technical Logs

• Server logs: 90 days, then deleted
• Error logs: 30 days, then deleted
• Analytics data: Per your opt-out preference (1 year if opted in, immediately removed if opted out)

6.3 Payment Data

Handled by Stripe per their retention policy

I retain billing history for accounting, Stripe retains payment methods.

7. Data Security

7.1 How I Protect Your Data

• Encryption in transit: TLS/HTTPS for all connections
• Encryption at rest: AES-256 for stored data
• Password hashing: bcrypt, salted
• Access control: Role-based access, principle of least privilege
• Regular security audits: Annual third-party penetration testing
• Data centers: AWS EU (GDPR-compliant infrastructure)

7.2 What I Cannot Guarantee

• 100% security (no system is impenetrable)
• Protection against your own compromised password
• Liability beyond what insurance covers (see Terms of Service)

If there's a breach, I will:

• Notify affected users within 72 hours
• Notify data protection authorities if required by law
• Provide information to help you protect yourself

8. Scribe Fine-Tuning (Machine Learning)

8.1 How Scribe Learns

Scribe improves by learning from:

• Your refinements: When you correct AI suggestions, those corrections train Scribe
• Aggregate patterns: Location distributions, NPC relationships, quest structures (anonymized)

8.2 Who Has Access to Trained Models

• Only Truesight internal systems train on your data
• I do NOT license Scribe to third-party LLM companies (OpenAI, Anthropic, etc.)
• You can opt-out of analytics in settings to prevent metadata extraction
• Opting out stops future training data but doesn't retroactively purge what's been learned

8.3 Your Model (Premium Feature, Future)

Premium users may eventually be able to train a personal instance of Scribe on only their worlds. Details to come.

9. Children's Privacy

Truesight is not intended for children under 13. I don't knowingly collect data from children under 13. If I discover I have, I'll delete it immediately.

Parents/guardians: Contact us at contact@truesight.world if you believe I've collected data from a minor.

10. International Data Transfers

All data is stored in EU data centers and subject to GDPR.

If you're accessing Truesight from outside the EU, you understand your data is processed in the EU under GDPR standards.

11. Changes to This Privacy Policy

I may update this policy. When I do:

• I'll email you if changes are material
• I'll post the updated policy with a new “Last Updated” date
• Your continued use means you accept the changes

Material changes will include a 30-day notice period before they take effect.

12. Contact Us

Questions about this privacy policy?

Email: contact@truesight.world

Data Protection Officer (if required by your jurisdiction):

I'll appoint one before EU launch and provide contact info here.

Complaints:

You have the right to lodge a complaint with your local data protection authority if you believe I've violated your rights.

Appendix A: Summary for the Privacy-Conscious

What I do:

• ✅ Store your worlds securely
• ✅ Use metadata to improve Scribe (you can opt-out)
• ✅ Sell anonymized patterns to publishers (never linked to you)
• ✅ Encrypt everything in EU data centers
• ✅ Delete your data when you ask

What I don't do:

• ❌ Sell your name, email, or identity to anyone
• ❌ Share your world content
• ❌ Use your data to train third-party AI systems
• ❌ Run targeted ads
• ❌ Sell to data brokers
• ❌ Keep your data after you delete it (except 30-day backup window)

I stand behind these privacy commitments.

Diederik de Graaf

Creator of Truesight