Privacy Policy

Who we are

Emberfall (emberfall.apollo502.com) is run by Apollo Projects LLC, a Kentucky limited liability company, which decides how your information is used (in European terms, the controller). Contact: apolloprojectsllc@gmail.com.

What we collect

Playing without an account

Your campaigns and a few preferences (layout, sound, stage, keyboard shortcuts) are kept in your own browser's local storage. They are not sent to us. Clearing your browser's site data deletes them; the in-game export lets you keep a copy.

If you make an account

• Your email address, to sign you in, confirm the address, and send account messages.
• Your password, stored only as a one-way scrypt hash. We cannot read it.
• Sign-in sessions: a random token in a cookie (below). We store only a hash of it, with when it was created and last used, and the IP address and browser description it signed in from, so you and we can spot a session that is not yours.
• One-time links for confirming your address and resetting your password, stored as hashes and expiring after use or within hours.
• Your campaign saves: the game state and story log, so a campaign follows you between devices. If you paste your own module, its text travels with that save. Synced saves are also counted in aggregate to show how many players earned each deed; only the totals are ever shown, never who earned what.
• A security log of account events (sign-ins that fail, password changes, deletions, purchases, mailing-list sign-ups and unsubscribes, administrative actions), with the account email and IP address involved.

If you join the mailing list

“Word from the road” is an occasional email about new tales and sales, a few times a year. It is separate from your account and you can join without one. We keep your email address, whether it is pending, confirmed or unsubscribed, where on the site you signed up, and, as the record of your consent, when you asked and confirmed and the IP address each was done from. Nothing is sent until you follow the link in the confirmation email (if you are signed in with a confirmed account address, signing up with that address counts as confirmed). The confirmation link is stored only as a hash. We do not track whether you open or click our emails.

If you buy

Payment is handled by Stripe on Stripe's own checkout page. We never see or store your card details. We keep a purchase record: your account and email, the product, the amount and currency, its status, and Stripe's reference numbers, so we can unlock the campaign, honour refunds, and meet tax and accounting rules.

Bring a friend

Each account has a referral link. If you arrive through someone's link, a cookie remembers which link it was (below), and if you then buy, your purchase record notes whose link it was, so a friend's discount can be applied and counted. The person who shared the link sees only how many friends bought through it, never who.

Our servers

Like any website, our servers see your IP address and browser details with each request, and keep short technical logs for security and fault-finding. When something breaks, in our server or in your browser, we record the error message, where in the code it happened and which page it was on, in our own database, without your account or IP address. We also limit how often sign-in and email actions can be tried from one address, which briefly holds that address in memory.

Cookies and local storage

We set at most two cookies, both our own. ember_session is set only when you sign in. It keeps you signed in for up to 30 days, is marked HttpOnly and Secure, and is strictly necessary for your account to work. ember_ref is set only if you open a friend's referral link: it holds that link's code for 30 days so the friend's discount can be applied if you buy, and is used for nothing else. We do not use analytics, advertising or third-party cookies, so there is nothing to opt out of. Local storage holds your offline campaigns and preferences, as described above, and notes if you joined the mailing list from that browser so the sign-up box stops asking.

How we use it, and our reasons

• To provide the game and your account, and to deliver what you bought (performing our contract with you).
• To keep accounts secure, prevent abuse, and investigate problems (our legitimate interest in running a safe service).
• To keep payment and tax records (legal obligation).
• To send account emails you need: address confirmation, password resets, security notices, and receipts.
• To send the mailing list's occasional news, only to addresses that asked for it and confirmed (your consent, which you can withdraw at any time with the one-click link in every email or from your Account page). Account emails never add you to the list.

We do not sell or rent your personal information, share it for cross-context advertising, or use it to profile you.

Who helps us run Emberfall

These service providers process data for us under their own security and privacy commitments, only as needed for their part:

• Stripe: payments and refunds.
• Resend: sending account emails, and the mailing list's emails if you joined it (your address and the message).
• Hostinger: the server the site and its database run on.
• Cloudflare (R2 storage): off-site database backups, encrypted before they leave our server; Cloudflare cannot read them.

Emberfall has an optional AI storyteller mode. It is currently switched off. If it is ever switched on, this page will be updated first to say what is sent to the AI provider and when.

We may disclose information if the law requires it, to protect people's safety or our rights, or as part of a sale or reorganisation of the business, in which case this policy would continue to apply to it.

How long we keep it

• Your account, sessions and saves: until you delete the account. Sessions end after 30 days, or when you sign out or change your password.
• Deleting your account (Account page) removes it, its sessions and its campaigns at once.
• Purchase records are kept, detached from the deleted account, for as long as tax and accounting law requires.
• The mailing list: a confirmed address is kept until you unsubscribe. After that we keep the address marked as unsubscribed, with its dates, so we can show you left and never mail you again by mistake; ask and we will delete it entirely. An unconfirmed sign-up is never mailed again unless it is requested again. Deleting your account deletes the list entry for its address too.
• The security log is kept, including the entry recording a deletion, so that account activity can be investigated later.
• Backups: encrypted database backups are kept for 14 days on our server and up to 90 days off-site. Deleted information can remain in them until they expire.

Your rights

Wherever you live, you can ask us to tell you what we hold about you, give you a copy, correct it, or delete it, and you can delete your account yourself at any time from the Account page. Campaigns can be exported from the game. Email apolloprojectsllc@gmail.com from your account address and we will answer within 30 days (45 where the law allows). We will not treat you differently for exercising these rights.

US state residents (including California, and Kentucky under its consumer data protection law): you have the rights above to know, access, correct, delete and obtain a portable copy. We do not sell or share personal information or use it for targeted advertising or profiling, so there is nothing to opt out of. You may use an authorised agent, and if we decline a request you may appeal by replying to our answer.

If you are in the UK or the European Economic Area, you also have the right to object to or restrict processing based on our legitimate interests, and to complain to your data protection authority. Your information is processed in the United States and wherever our providers operate; where the law requires, transfers rely on our providers' standard contractual clauses or equivalent safeguards.

Children

Accounts are for people aged 13 or older; anyone under 18 needs a parent or guardian's permission to make an account or buy. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has made an account, tell us and we will delete it.

Security

Connections are encrypted, passwords are hashed with scrypt, session and email tokens are stored only as hashes, the database is reachable only from the application, and backups are encrypted with a key that is not kept on the server. No system is perfectly secure; if a breach affecting your information happens, we will tell you as the law requires.

Changes

If we change this policy we will update the date at the top, and for significant changes tell account holders by email before they take effect.