Privacy Policy — Tale Companion
Effective date: 22nd of October 2026.
This Privacy Policy explains how Niccolò Masiero, an Italian sole proprietor trading as Tale Companion (“we”), handles personal data when you use play.talecompanion.com. We are the controller of the personal data described here, except where another provider independently determines its own purposes for processing information it receives.
Contact: help@talecompanion.com
1. Data we collect
Depending on how you use the Service, we process:
- Account data: email address, username, account identifiers, account preferences, and information needed for authentication.
- Campaign data: chats, prompts, characters, stories, lore, settings, AI preferences, generated responses, uploaded text and media, and other information you save or submit. These may contain personal information if you put it there.
- Usage and technical data: AI model selections, request and Ink usage, balance and transaction records, feature activity, login and activity timestamps, IP address, browser or device information, and security or error records.
- Purchase data: plan, purchase and subscription status, amounts, dates, transaction identifiers, and limited payment-related information supplied by Stripe. Stripe processes payment details on its Checkout pages; we do not need your full card number to operate Tale Companion.
- Communications: messages you send to support, reports about content, refund requests, and your marketing preferences.
- Publications: content you choose to submit for publication and the information needed to review, display, and respond to reports about it.
Please avoid entering sensitive personal facts—particularly information about other real people—into campaigns. A fictional story involving a sensitive topic is not necessarily personal data, but an identifiable person’s health, sex life, beliefs, or similar details may be. If you include such information, it may be stored and sent with relevant AI requests as explained below.
2. Why we use data and our legal bases
| Purpose | Data involved | GDPR legal basis |
|---|---|---|
| Create accounts; save and run campaigns; provide AI requests, publications, subscriptions, and Ink balances | Account, campaign, usage, and purchase data | Performance of our contract with you, where necessary to provide the Service you request |
| Process purchases, keep required business and tax records, and respond to lawful requests | Purchase, account, and relevant communications data | Legal obligation, where applicable; otherwise contract or legitimate interests as appropriate |
| Secure the Service, prevent fraud and abuse, investigate specific reports, and handle disputes | Relevant account, technical, campaign, publication, and transaction data | Our legitimate interests in operating a secure, lawful Service and protecting rights, balanced against your interests; legal obligation where applicable |
| Understand feature use and improve performance using usage statistics | Usage and technical data; aggregated statistics where possible | Our legitimate interests in improving the Service; consent where required for particular tracking technologies |
| Measure which of our Reddit ads bring new players (Reddit Pixel; sign-up and purchase reports to Reddit) | Reddit cookies and browser identifiers, ad click identifier, IP address, browser details, a hashed email address, account identifier, purchase amount and currency | Your consent, given in the cookie banner or Settings → Privacy; you can withdraw it at any time |
| Send marketing emails | Email address and marketing preference | Your consent, unless a specific legally permitted existing-customer exception applies; you can opt out |
| Respond to support requests and exercise of rights | Your communications and relevant account information | Contract, legal obligation, or legitimate interests, depending on the request |
We do not describe account-level activity records as “anonymous.” We may create aggregated or genuinely anonymised statistics to understand and improve the Service. We do not use the contents of private campaigns in Tale Companion advertising, or train our own AI models on them, under this Policy.
Sensitive personal data: Our Service is intended for fictional entertainment, not for collecting your real-life health, sex-life, or other special-category data.
3. Who receives data
We use the following providers to operate the Service:
- Cloudflare provides website and application infrastructure, data storage, security, and default AI models where selected. Information processed depends on the Cloudflare products and settings we use.
- OpenRouter routes requests when you select an OpenRouter model. The underlying model provider also receives the inputs needed to answer the request. Relevant inputs may include a prompt, campaign context, chat history, and attachments selected or required for that operation. Providers’ retention and training practices differ and may change; we display model-level information before selection. OpenRouter and a model provider may also process request metadata.
- Stripe hosts Checkout and processes purchases and subscription payments. Stripe also processes information under its own privacy terms for purposes it determines.
- Reddit receives ad-measurement data, only if you allow ad measurement: the Reddit Pixel runs in your browser, and when you create an account or make a purchase we tell Reddit about it with a hashed (scrambled) email address, our account identifier, the Reddit ad click identifier and browser identifier if present, and for sign-ups your IP address and browser details; for purchases, the amount and currency. Reddit uses this to tell us which ads worked and to improve ad delivery, and processes it under its own privacy terms. We never send Reddit your campaigns, chats or other content.
We may disclose relevant data to professional advisers, authorities, or other recipients when reasonably necessary to comply with law, protect rights, or handle a dispute. Public content is visible to other users according to the publishing feature used.
Private campaigns are not public by default, but are not end-to-end encrypted against us or the providers needed for their storage and AI processing. We do not routinely have a human read private campaigns. Authorised access may occur for support you request, a specific credible abuse report, a security incident, or a legal obligation.
4. Your model choices and provider training
Cloudflare-hosted models are the default. You can choose other models offered through OpenRouter. Some underlying providers may retain prompts and outputs or use them to train or improve models. A warning or your selection does not change data already sent to a provider; review the model’s information before sending a request.
We will not represent all OpenRouter models as “no training” or “zero retention.” We cannot directly delete material that an independent provider has already retained. Information about provider policies is based on the policies available to us and should be checked when you select a model.
5. International transfers
Cloudflare, Stripe, Reddit, OpenRouter, or an underlying model provider may process data outside Italy or the European Economic Area. Where GDPR transfer rules apply, we must use an applicable adequacy decision or appropriate safeguards, such as relevant standard contractual clauses, and take any other required measures.
6. Retention and deletion
We keep account and campaign data while your account is active and as needed to provide the features you request. If you delete a chat or account, we aim to remove its content from active, user-facing storage promptly. Deletion from recoverable backups, logs, and providers’ systems may take longer; certain transaction or dispute records may have to be retained.
To request deletion or ask what remains, email us at help@talecompanion.com. Deletion may affect access to purchases and Ink; the Terms explain the applicable financial rights.
7. Cookies and similar technologies
We use two kinds of cookies and similar technologies:
- Essential (always on): keeping you signed in, security, your preferences, remembering an invite link you followed, and remembering how you first reached the site (a link's campaign tags, the referring website, and a Reddit ad click identifier) until you sign up, so we can count where players come from. These stay on our site and are needed for it to work. Your cookie choice itself is also stored in an essential cookie for about six months.
- Ad measurement (optional, off unless you allow it): the Reddit Pixel and the sign-up and purchase reports to Reddit described in section 3. The Reddit Pixel sets its own cookies on our site.
The first time you visit, a small banner asks whether you allow ad measurement; saying no is as easy as saying yes, and the site works the same either way. You can change your answer at any time through Cookie preferences at the bottom of the home page or, once signed in, in Settings → Privacy. Withdrawing consent stops future reports and deletes the Reddit cookies in that browser; it does not undo reports already sent.
8. Marketing and support
If you separately choose to receive marketing emails, we may email you about Tale Companion. You can unsubscribe using the link in a marketing email or by contacting help@talecompanion.com. We may still send necessary service, security, billing, or legal messages.
You may also choose to contact us through a Discord server. Email is our official channel for privacy and purchase requests. If you use Discord, Discord processes information under its own terms and privacy policy.
9. Your privacy rights
Subject to applicable law, you may ask us to access, correct, erase, or restrict your personal data; object to processing based on legitimate interests; obtain eligible data in a portable format; and withdraw a consent you previously gave. Withdrawal does not affect processing that was lawful before withdrawal. We may need to verify that a requester controls the relevant account.
Email help@talecompanion.com to make a request. You may also complain to the Garante per la protezione dei dati personali in Italy or, where applicable, another competent data protection authority.
Providing an email address and certain account data is necessary to create and use an account. Campaign content is supplied when you choose to create it; without the information needed for a particular AI request, we cannot perform that request.
10. Age, security, and changes
The Service is for adults aged 18 or over. If you believe someone under 18 has created an account, contact us at help@talecompanion.com.
We use technical and organisational measures intended to protect data, but no online service can guarantee absolute security. If we materially change this Policy, we will update its date and give any further notice required by law.