StormScape
Back to Home

Privacy Policy

Last updated: November 25, 2025

This Privacy Policy explains how StormScape collects, uses, and protects your personal information when you use our AI-powered TTRPG campaign management platform. We believe in transparency, especially regarding how we use AI to process your content.

1.

Introduction

💡

This policy explains what data we collect and how we use it to provide StormScape's campaign management features.

StormScape ("we," "our," or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our web application and Discord bot services (collectively, the "Service").

By using StormScape, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this Privacy Policy, please do not access the Service.

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.

2.

Information We Collect

💡

We collect account info (email, name, Discord ID), your campaign content, session recordings, transcriptions, and basic usage analytics.

2.1Account Information

When you create an account, we collect:

  • Discord account information: Your Discord username, user ID, email address, and avatar (obtained through Discord OAuth)
  • Profile information: Any additional name or display preferences you set
  • Authentication data: Session tokens and authentication credentials

2.2Campaign Content

We store all content you create within StormScape, including:

  • Campaign information: Campaign names, descriptions, settings, and metadata
  • Wiki entries: NPCs, locations, factions, items, and notes you create
  • Character data: Player and NPC characters, their bios, notes, and relationships
  • Session notes: Notes taken during or after game sessions
  • GM notes: Private notes visible only to campaign owners and collaborators

2.3Audio Recordings & Transcriptions

When you use our session recording feature:

  • Audio files: We record audio from Discord voice channels when you enable recording
  • Multi-track audio: Individual audio tracks for each participant (with their consent)
  • Transcriptions: Text transcriptions of your sessions with speaker identification
  • Timestamps: Time-coded data linking transcriptions to specific moments

2.4Usage Data & Analytics

We automatically collect certain information when you use the Service:

  • Log data: IP address, browser type, pages visited, time spent on pages
  • Device information: Device type, operating system, unique device identifiers
  • Feature usage: Which features you use and how often
  • Performance data: Error logs and performance metrics to improve the Service

2.5Payment Information

If you subscribe to a paid plan:

  • Billing information: Name, billing address, and email for invoices
  • Payment method: Handled securely by Stripe—we never see or store your full credit card number
  • Transaction history: Records of payments and subscription status
3.

How We Use Your Information

💡

We use your information to provide the Service, process your content with AI for intelligence reports, improve our product, and communicate with you about your account.

We use the information we collect for the following purposes:

  • Providing the Service: To create and manage your account, store your campaign content, and deliver all features
  • AI Processing: To generate intelligence reports, transcriptions, summaries, and relationship insights (see Section 4 for details)
  • Service Improvement: To understand how users interact with StormScape and improve features
  • Communications: To send important updates, respond to inquiries, and provide customer support
  • Security: To detect, prevent, and address technical issues and security threats
  • Legal Compliance: To comply with applicable laws and regulations
4.

AI and Automated Processing

💡

When you use our intelligence reports feature, your session transcripts and campaign content are sent to AI services (like Anthropic's Claude) to generate summaries and insights. You control when this processing occurs.

This section is important—please read it carefully.

StormScape uses artificial intelligence to help you manage your campaign. Here's exactly how AI processes your content:

What AI Processes

  • Session transcripts: When you generate interval summaries or intelligence reports, your transcribed session text is sent to our AI provider
  • Campaign content: Wiki entries, character bios, session notes, and relationships may be analyzed to generate insights
  • Context data: Relevant campaign context is included to generate accurate, meaningful reports

What AI Generates

  • Interval summaries: 20-minute summaries of your sessions as you play
  • Intelligence reports: Comprehensive campaign analysis for DMs, including story arcs, NPC importance, and recommendations
  • Character journey reports: Personalized summaries of each character's story for players
  • Relationship suggestions: AI-identified connections between characters, NPCs, and locations

AI Service Providers

We currently use the following AI services:

  • Google Cloud Vertex AI (Gemini): For generating intelligence reports and summaries
  • Google Cloud Speech-to-Text: For transcribing audio recordings

These services may process your content on servers outside your country. See Section 11 for more information about international data transfers.

Your Control Over AI Features

  • You choose when to start and stop recording sessions
  • You decide when to generate intelligence reports
  • AI processing only occurs when you explicitly trigger these features
  • You can delete AI-generated content at any time
5.

Audio Recording & Transcription

💡

We record your game sessions from Discord voice channels to transcribe and analyze them. You control when recording starts and stops, and you're responsible for obtaining consent from all participants.

How Recording Works

  • Our Discord bot joins your voice channel when you start a recording
  • Audio is captured from all participants in the channel
  • Recordings are stored securely in Google Cloud Storage
  • Audio is processed in 20-minute intervals for transcription

Data Retention

  • Audio files: Retained for 7 days after the session, then automatically deleted
  • Transcriptions: Retained as long as you maintain your account and the associated campaign
  • AI-generated summaries: Retained with the session data

Your Responsibilities

Before recording any session, you must:

  • Inform all participants that the session will be recorded
  • Obtain consent from all participants
  • Comply with local laws regarding audio recording consent
  • Respect any participant's request to not be recorded

We are not responsible for recordings made without proper consent. You are solely responsible for ensuring legal compliance.

6.

Data Sharing & Third Parties

💡

We share data with service providers who help us operate StormScape. We do NOT sell your data or share it for advertising purposes.

Service Providers We Use

  • Discord: Authentication and bot functionality
  • Google Cloud Platform: Database hosting, file storage, AI/ML services, and transcription
  • Vercel: Web application hosting
  • Stripe: Payment processing
  • Resend: Transactional email delivery

When We Share Data

  • With your permission: When you share campaign content with other users (e.g., players in your campaign)
  • Service providers: With vendors who help us operate the Service, under strict confidentiality agreements
  • Legal requirements: When required by law, court order, or government request
  • Protection of rights: To protect the safety, rights, or property of StormScape or our users
  • Business transfers: In connection with a merger, acquisition, or sale of assets

What We Do NOT Do

  • We do NOT sell your personal information
  • We do NOT share your data with advertisers
  • We do NOT use your campaign content to train AI models for other purposes

Campaign Sharing

When you invite players to your campaign, they can access:

  • Content you've marked as visible to players
  • Shared session notes and transcriptions
  • Their own character information

GM notes and private content remain visible only to campaign owners and collaborators.

7.

Data Retention

💡

We keep your data as long as you have an active account. When you delete content or your account, we remove it from our systems within 30 days.

Retention Periods

  • Account data: Retained while your account is active
  • Campaign content: Retained until you delete it or delete your account
  • Audio recordings: Automatically deleted 7 days after the session
  • Transcriptions: Retained with the associated campaign
  • Payment records: Retained for 7 years for tax and legal compliance
  • Backup data: Removed from backups within 30 days of deletion

Deleting Your Content

When you delete content:

  • It's immediately removed from the active database
  • It's removed from backups within 30 days
  • AI-generated content based on deleted data is also removed

Account Deletion

When you delete your account:

  • All your campaigns, characters, and content are permanently deleted
  • Your personal information is removed
  • This process is completed within 30 days
  • Some anonymized usage data may be retained for analytics
8.

Your Rights

💡

You can access, export, or delete your data at any time. You may also have additional rights depending on your location.

Rights for All Users

  • Access: View all data we have about you through your account settings
  • Export: Download your campaign content in a portable format
  • Delete: Delete any content or your entire account
  • Correct: Update or correct your personal information
  • Object: Opt out of certain processing activities

Additional Rights (EU/EEA/UK)

If you're located in the EU, EEA, or UK, you also have the right to:

  • Request restriction of processing
  • Data portability
  • Lodge a complaint with a supervisory authority
  • Withdraw consent (where processing is based on consent)

California Residents

Under the CCPA, California residents have the right to:

  • Know what personal information is collected
  • Know whether personal information is sold or disclosed and to whom
  • Say no to the sale of personal information (we don't sell your data)
  • Access your personal information
  • Equal service and price, even if you exercise privacy rights

How to Exercise Your Rights

To exercise any of these rights, you can:

We will respond to your request within 30 days.

9.

Security

💡

We use industry-standard security measures including encryption, access controls, and regular security audits to protect your data.

We take the security of your data seriously. Here's how we protect it:

Technical Safeguards

  • Encryption in transit: All data is encrypted using TLS 1.3 when transmitted
  • Encryption at rest: Data stored in our databases and cloud storage is encrypted
  • Secure authentication: OAuth 2.0 through Discord with secure session management
  • Access controls: Role-based permissions limit who can access what data

Operational Safeguards

  • Regular audits: We regularly review our security practices
  • Vendor security: We only work with service providers who maintain strong security standards
  • Incident response: We have procedures to detect and respond to security incidents
  • Employee training: Our team is trained on data protection best practices

While we implement robust security measures, no method of transmission over the Internet or electronic storage is 100% secure. We cannot guarantee absolute security, but we commit to promptly notifying affected users in the event of a data breach.

10.

Children's Privacy

💡

StormScape is not intended for users under 13. We do not knowingly collect data from children under 13.

StormScape is not intended for children under the age of 13. We do not knowingly collect personal information from children under 13.

If you are a parent or guardian and believe your child has provided us with personal information, please contact us at [email protected]. We will take steps to delete such information from our systems.

Users between 13 and 18 should have parental consent before using StormScape, particularly for features involving audio recording.

11.

International Users

💡

StormScape is operated from the United States. Your data may be processed in the US and other countries where our service providers operate.

StormScape is operated from the United States. If you access the Service from outside the US, please be aware that your information may be transferred to, stored, and processed in the United States and other countries where our service providers maintain facilities.

Data Transfers

We transfer data outside your country in the following circumstances:

  • Hosting and database services (Google Cloud Platform - various global regions)
  • AI processing services (Google Cloud Vertex AI)
  • Email delivery (Resend)
  • Payment processing (Stripe)

Safeguards for International Transfers

When we transfer data internationally, we rely on:

  • Standard Contractual Clauses approved by the European Commission
  • Data processing agreements with our service providers
  • Compliance with applicable data protection frameworks
12.

Changes to This Policy

💡

We may update this policy from time to time. We'll notify you of significant changes via email or in-app notification.

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons.

How We Notify You

  • Minor changes: Updated "Last Updated" date on this page
  • Material changes: Email notification to registered users and/or prominent notice in the app

Your continued use of StormScape after changes become effective constitutes acceptance of the updated Privacy Policy. We encourage you to review this page periodically.

13.

Contact Us

💡

Questions about privacy? We're happy to help.

If you have questions or concerns about this Privacy Policy or our data practices, please contact us:

We aim to respond to all privacy-related inquiries within 30 days.