Privacy & Legal

What we collect

• Account data: email address and username, collected when you register. Used for authentication only.
• World content: the text, images, and settings you add to your world.
• Visitor data: a random visitor ID, set as a cookie the first time you unlock a reveal, so the world can remember which reveals you've unlocked; and a separate random ID in your browser's localStorage for poll votes. Neither ID is linked to any personal identity.

How we use it

• Your email and username are used solely for account authentication. We do not send marketing emails.
• Your visitor ID is used to personalise your experience within a world (remembering unlocked reveals, votes). The list of reveals you've unlocked is stored on our server against that random ID so that locked content is never sent to your browser before you unlock it.

AI-assisted features

When you respond to a reveal prompt (e.g. a vibe check or lore question), your response text is sent to Anthropic's API for evaluation. This is done to determine whether your answer unlocks the associated reveal. No other personal data is sent. Anthropic processes this data as a sub-processor under a Data Processing Addendum. See: anthropic.com/privacy

Storage on your device

We store the following items in your browser's localStorage:

• yourlore-lit-{worldId} — remembers whether you've completed the arrival ritual for a world
• yourlore-cooldowns — tracks cooldown timers for reveal attempts
• yourlore-visitor-{worldId} — your anonymous visitor ID

These are strictly functional and not used for tracking or advertising.

Cookies

When you unlock your first reveal in a world, a yl-visitor cookie is set containing a random, signed visitor ID (valid for one year). It is strictly necessary for the reveal mechanic — it lets the server know which reveals to show you — and is not used for tracking.

If you create an account and log in, a session cookie (__Secure-next-auth.session-token) is set. This is a strictly necessary cookie required to keep you logged in. It contains a signed JWT and does not contain personal data beyond your user ID.

Data retention

Account data is retained until you delete your account. Visitor localStorage data is retained in your browser until you clear it. Server-side reveal progress is keyed only by the random visitor ID and is deleted when the world it belongs to is deleted.

Your rights

Under GDPR you have the right to access, correct, or delete your personal data. To exercise these rights, contact us at the address in the Legal Notice below.

Sub-processors

• Anthropic PBC — AI evaluation of reveal answers (see above)
• Vercel Inc — hosting and deployment
• Neon Inc — database hosting

Changes to this policy

We may update this policy. Continued use of the service after changes constitutes acceptance.