Privacy Policy

1. Information We Collect

You provide:

• Account info - name, email and the year you were born
• Content - the actions and dialogue you type during play sessions, and the names you give your characters
• Feedback - what you send us, the page you sent it from, your browser type, and an email if you add one so we can reply

Collected automatically:

• Usage data - pages visited, features used
• Device data - browser type, OS, device type
• IP address - for security, rate limiting, and abuse prevention
• Session cookies - for authentication

You can play without an account: a guest's hero is kept only in your browser's local storage, and we receive nothing about it. If you make an account, that hero is saved with it, and we store your hero (their name, sheet and what they have done in the game) with your account.

2. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Platform
• Authenticate your identity and manage your account
• Save your hero and run the game
• Send you emails about your account, such as confirming your email address or resetting your password
• Detect and prevent fraud, abuse, and security issues
• Comply with legal obligations

We do not:

• Sell your data to third parties
• Use your data for advertising (there are no ads)
• Use content you submit to train AI or machine learning models

3. AI Features

Some features are AI-powered. When you use them, the relevant content is sent to a service provider to generate the result:

• Characters you question - when you question a suspect in a case, your question and the conversation so far are sent to our AI provider, Anthropic (Claude), to write the character's answer

We send only what the feature needs. It's our policy to use AI providers, and account plans with those providers, under commercial terms that do not use API content to train their models - not the free or default consumer tiers some providers offer, which can differ.

4. Information Sharing

• Service providers - Fly.io (hosting), Neon (database), Stripe (payments - they handle your card details, we never see them), Resend (transactional email), our AI provider Anthropic (AI features, above), and Cloudflare Turnstile (bot protection on signup). These process data on our behalf.
• Sign-in providers - if you choose to sign in with Google, Facebook, or Apple, that provider shares your name and email with us
• Legal requirements - if required by law, subpoena, or legal process
• Safety - to protect rights, safety, or property of TwistScript or its users

5. Data Retention

• Account data is retained while your account is active
• A deleted account is closed at once and erased for good 30 days later, so a deletion made by mistake can be undone if you ask us in that time.
• When your account is erased, your hero is erased with it.
• Feedback you sent is kept after account deletion, unlinked from your account, along with any email you added to it; ask us if you want it removed. Usage counts, such as when an account was created, keep only an internal ID that no longer matches any account
• Transaction records are retained as required for legal compliance

6. Your Rights

Depending on your location, you may have the right to access, correct, delete, export, or object to processing of your personal data. To exercise these rights, contact hello@twistscript.com.

California residents: we do not sell personal information. EEA residents: our legal basis is contract performance, legitimate interest, and consent where required.

7. Cookies

We use session cookies for authentication and a short-lived cookie that carries the year you were born through sign-up. Your sound and text settings (music, Read aloud, Bigger text), and a guest's hero, are saved in your browser's local storage, not in cookies. We do not use cookies for advertising or tracking.

8. Children

You must be 13 or older to create an account, and we do not knowingly collect data from children under 13. Sign-up asks the year you were born to check this; we keep only the year and never show it to anyone. If we learn an account belongs to someone under 13, we delete it.

9. Security

We use HTTPS, secure authentication, and access controls to protect your data. No method of transmission is 100% secure.

10. Changes

We may update this Privacy Policy from time to time. Material changes will be communicated via the Platform. The date at the top of this page reflects the most recent update.