Draft — pending review. This notice describes what the Wistmere software does with your information today. It has not been reviewed yet and will change before Wistmere opens more widely.
What we collect, and why
- Waitlist. Your email address and, if you give it, a name. We use them only to send your beta invitation and news about the beta. We do not record your IP address with the signup.
- Contact form. Your name, email address, subject and message, stored and emailed to us so we can reply. We do not record your IP address with the message.
- Your account. During the closed beta we create accounts for invited testers: a username, an email address and a password (stored only as a one-way hash), plus sign-in timestamps. Signing in sets a session cookie, which is what keeps you logged in.
- Your campaigns. Campaigns, characters, their inventories and progression, the log of what happened in play, and the conversation with the AI Game Master. Keeping these is the service: it is how Wistmere remembers your story.
- Your AI provider key. If you bring your own API key, it is stored encrypted. It is decrypted only on our server, to make requests to your provider on your behalf, and is never shown back to you in full. You can remove it at any time from your API key page.
- Technical logs. Like any website, our servers log requests, including IP addresses, to operate and secure the service. The application's own log keeps only its most recent entries.
Who else receives information
- Your AI provider. When you play a turn, your message and the campaign context the Game Master needs — character and campaign state, recent conversation and relevant events — are sent to the AI provider that runs the Game Master. Today that provider is Anthropic (Claude). With your own key, the request is made with your key under your agreement with that provider. How the provider handles that data is governed by its own terms and privacy policy.
- Dice. Dice rolls can draw on random.org. Those requests ask only for random numbers; they contain no information about you or your campaign.
- Email delivery. Emails we send (invitations, password resets, account notices) go through our outbound email provider.
- Content delivery. Images, stylesheets, scripts and fonts are served from static.wistmere.com through a content delivery network, which, like any web server, sees your IP address when your browser fetches them.
- Analytics. We count page views with Umami, which runs on our own infrastructure and is reached through this site's own address. It sets no cookies and we use it only for aggregate statistics. Administration pages are not counted.
We do not sell your information, and we do not use it for advertising.
How long we keep it
We keep your account and campaigns while your account exists, and waitlist and contact messages until they have served their purpose or you ask us to remove them. Nightly backups of the site are kept for 14 days.
Your choices
You can ask us to show you, correct or delete the information we hold about you, or to take you off the waitlist, through our contact form.
Changes
We will update this page when what we do changes, and note the date here.