App Privacy Policy

This policy explains how the Loreium app and its backend services handle your personal data. Loreium is an interactive, AI-generated storytelling game: you create and play through narrative worlds, and our service generates the story and imagery in response to your choices. For data about our marketing website, see the website privacy policy.

The controller for your data under the GDPR is:

Loreium UG (haftungsbeschränkt)

Lindenstr. 16, 83607 Holzkirchen, Germany

Contact[email protected]

Full company details are listed in our imprint.

Account

When you register with an email address, we collect that address and a password, which are managed by our authentication provider, Supabase. If you sign in with Google instead, we receive your email address and Google account identifier from Google; your Google password is never shared with us. Either way we store a user ID and the username you choose. We use this to create and secure your account and to let you sign in.

Gameplay you create

We store the content you generate while playing — your sessions, the actions and free-text you enter on each turn, the characters and worlds you build, your messages to the world builder, and related game state. This is what makes your stories persistent so you can continue, roll back, and branch them. A copy is also cached locally on your device.

Generated content

The narrative text and images (such as character portraits and scene art) produced in response to your play are stored so they remain part of your story.

Purchases

If you buy credits, we store your credit balance and a record of your transactions. Payments are handled by Stripe; we do not receive or store your full card details.

Preferences

Settings such as your theme, reading font and spacing, and model tier are stored locally on your device.

Push notifications

Turn-finished alerts tell you when a turn you started has finished generating. When you first sign in, your device asks whether to allow notifications; if you allow it — or, on older Android versions that do not ask, unless you have turned alerts off — your device registers a push token with Firebase Cloud Messaging and we store that token against your account. You can turn alerts off at any time in Settings, which deletes the token. We also delete it when you sign out or delete your account.

Technical data

We record the app version and standard request metadata (such as your IP address) in our server logs to operate and secure the service. To diagnose problems and monitor quality, our operational logs may also include the gameplay text you and the service generate.

The app requests internet access, and your device’s permission to show notifications. It does not access your camera, microphone, location, or contacts. When you set a profile picture you pick one image through your device’s own photo picker; the app cannot browse the rest of your photo library. We do not use advertising identifiers, and we do not include third-party analytics, advertising, or crash-tracking SDKs that profile you.

Loreium is a tool for writing fiction. Please do not enter special categories of personal data (such as information about real health, sex life or orientation, religion, ethnicity, or political views) about yourself or any identifiable real person into your gameplay or world-building text. If you nonetheless choose to include such data, you consent under Art. 9(2)(a) GDPR to our processing it for the purpose of providing the service. You can withdraw this consent at any time by deleting the relevant content or contacting us.

To generate your story, the text you enter together with the relevant world and character context is sent to AI language-model providers (OpenRouter, and Fireworks AI for some tiers). OpenRouter forwards your prompts to its own third-party model providers in order to fulfil the request. Image prompts derived from your story are sent to our image provider (fal.ai). This processing is solely to deliver the gameplay you requested. We do not use your content for advertising. We instruct these providers to process your data only to provide the service; their handling is also governed by their own terms.

We automatically screen submitted text against our content policy to prevent abuse, which may cause a turn to be rejected. We do not make automated decisions that produce legal or similarly significant effects concerning you within the meaning of Art. 22 GDPR.

Our application and database are hosted in the EU (Frankfurt). Some of the sub-processors listed below operate outside the EU (for example, in the United States). Where data is transferred outside the EU, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

We process your account, gameplay, and payment data to perform our contract with you and provide the service (Art. 6(1)(b) GDPR). We process server and operational logs and apply content safeguards on the basis of our legitimate interest in operating the service securely and preventing abuse (Art. 6(1)(f) GDPR). Turn-finished alerts tell you about gameplay you started yourself and are part of providing the service (Art. 6(1)(b) GDPR); where your device asks you to allow notifications, that permission is a further gate on top. You can stop them at any time by turning alerts off in Settings. Where the law requires consent, we ask for it.

We keep your account and gameplay data for as long as your account is active. When you delete a session it is removed from your library and marked for deletion on our servers, and may persist in backups for a limited period before being purged. Operational logs are kept for a limited period (typically up to 90 days). We retain transaction and invoicing records for as long as required by German commercial and tax law (generally up to 10 years).

You can have your account and all associated data deleted at any time. Our account deletion page explains how to request it, exactly what is removed, and what we are required to keep. Signing out clears the copy of your data cached on your device.

Under the GDPR you have the right to access, rectify, erase, restrict, and port your personal data, and to object to certain processing. Where we rely on consent, you also have the right to withdraw it at any time, without affecting processing already carried out. To exercise any of these rights, email us at [email protected].

You also have the right to lodge a complaint with a data protection supervisory authority. For our company, the competent authority is the Bavarian State Office for Data Protection Supervision (BayLDA).

Loreium is not directed to children. You must be at least 16 years old to create an account and use the app.

We may update this policy as the app evolves. The date at the top of this page reflects the most recent revision.