PRIVACY POLICY

1. INFORMATION PROCESSED BY ROOTWOVEN

Google sign-in and account information

The current Android application uses Google Sign-In. When you sign in, Google and our self-hosted authentication system provide or process account information that may include your Google account identifier, email address, name, and profile-picture URL. We also create Rootwoven account and authentication identifiers. Rootwoven does not receive your Google password, recovery code, or other Google sign-in secret.

Story content and gameplay

We process the information needed to provide and save your game, including game-slot or universe titles, dialogue and other text you submit, story choices and actions, generated dialogue, story and character state, gameplay progress, and identifiers that associate this information with your account and game. Story content is private to the service unless you choose to share it elsewhere.

Rootwoven does not intentionally ask you to submit sensitive real-world personal information in story text. Please do not include unnecessary health, financial, identity, or other sensitive information. If you enter such information, it may be processed with the rest of your story content to provide the game.

Technical and diagnostic information

The application and our service providers process technical information such as an app-installation or device identifier, device model, operating-system and app version, feature interactions, crash logs, diagnostics, request and service events, and, when an error or crash report is created, a screenshot of the application at that time.

The current Rootwoven Android application does not request GPS or device-location permission and does not contain an advertising feature or Advertising ID integration. It does not request access to your contacts, microphone, camera, or photo gallery. A Google profile-picture URL received during sign-in is account information; it is not gallery access. Servers and infrastructure providers may process an IP address and infer a broad region for routing, security, abuse prevention, and service operation.

2. INFORMATION PROCESSED ON OUR WEBSITE

Website accounts and game linking

Clerk provides website sign-up, sign-in, profile management, and session handling. Depending on what you provide, Clerk may process your email address, name, profile image, authentication credentials, session information, and account identifiers. Clerk handles raw website passwords; our Rootwoven backend does not receive them.

If you link a website account to Rootwoven, we process a short-lived linking token and the identifiers needed to associate the verified website email with the correct game account. We also store whether you opted in to optional Rootwoven news, playtest, or Kickstarter emails. You can change that preference from your website account or unsubscribe from an email.

Website analytics and storage

In production, the website may use consent-managed Google Analytics to process page visits, clicks, checkout events, browser and device information, Google Analytics client and session identifiers, IP-derived approximate region, and related usage information. Advertising storage, personalization, and ad-user-data signals are disabled in our implementation. In regions where consent is required, analytics remains disabled until consent is given through Termly. Elsewhere, you may disable website analytics or enable it again.

Essential cookies or browser storage may be used for authentication, security, preferences, account linking, checkout continuity, consent, and your analytics opt-out. Details and available controls are provided in our Cookie Policy.

Website payments

Website checkout is handled by Xsolla. Xsolla collects and processes payment credentials and billing information under its own privacy notice. We send Xsolla the account and product information needed to create checkout and receive transaction, product, amount, currency, status, and subscription information needed to deliver purchases, prevent duplicate credits, handle refunds and disputes, and maintain financial records. Where available and permitted, consented Google Analytics attribution may accompany the checkout request.

The current Rootwoven Android application has no Android checkout or Google Play Billing path and does not collect payment-card data or Android purchase history. Website and Steam purchases are separate from the Android application.

3. HOW WE USE INFORMATION

We process information to:

• authenticate users and manage accounts;
• provide, save, personalize, and maintain Rootwoven stories and gameplay;
• generate dialogue, interpret player input, maintain story state, and perform AI safety analysis;
• operate, secure, troubleshoot, and improve the application, website, backend, and infrastructure;
• process website purchases, grant digital items, administer subscriptions, and handle support, refunds, fraud, and disputes;
• measure website and product use where analytics is enabled;
• send optional marketing messages only when you opt in; and
• comply with legal, accounting, tax, safety, and security obligations.

Depending on where you live, our legal bases include performing a contract with you, your consent, compliance with legal obligations, and our legitimate interests in operating, securing, diagnosing, and improving the service. You may withdraw consent for optional processing at any time without affecting processing that occurred before withdrawal.

4. AI PROCESSING

Rootwoven uses language and embedding models so players can use natural language rather than a fixed dialogue wheel. Relevant player text, story context, choices, identifiers, and generated results may be sent to AI and observability providers for model inference, structured responses, embeddings, safety analysis, debugging, and service operation.

These providers include OpenRouter and model providers routed through it, Groq, OpenAI, and Langfuse. Their retention and secondary use are controlled by their service terms and the privacy and routing settings configured for our accounts. We do not sell Rootwoven story content or use it to train a Narratwist model.

5. SERVICE PROVIDERS AND DISCLOSURES

We disclose information only as needed to operate the service, complete a transaction, follow your instructions, protect users and the service, or comply with law. Provider categories include:

• Google for Android sign-in and consented website analytics;
• Clerk for website authentication, profiles, account linking, and email preferences;
• Xsolla for website checkout and payment processing;
• OpenRouter, routed model providers, Groq, OpenAI, and Langfuse for AI and model observability;
• hosting, database, network, logging, monitoring, and error diagnosis services, including Grafana Cloud and systems based on Nakama and Sentry; and
• Termly for cookie-consent management.

We may also disclose information if reasonably necessary to comply with law or legal process, protect rights or safety, investigate fraud or abuse, or complete a merger, reorganization, financing, or transfer of the relevant business subject to appropriate safeguards.

We do not sell personal information. We do not share personal information for cross-context behavioral advertising.

6. RETENTION AND DELETION

We retain Rootwoven account and game information while your account is active and as needed to provide the service. We retain technical, diagnostic, security, support, analytics, and transaction records only as long as reasonably necessary for their stated purposes or as required by law. Different providers may apply shorter or longer retention periods under our settings and agreements.

You may request permanent deletion of your Rootwoven account and associated data through our dedicated account-deletion page. After verifying account ownership, we process the deletion within 30 days. We may retain only the minimum records needed for legal, tax, accounting, fraud-prevention, dispute-resolution, or security purposes, then delete or anonymize them when the applicable retention period ends.

7. SECURITY

We use reasonable technical and organizational safeguards, including encryption in transit, authentication, access controls, monitoring, and separation of production systems. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

Never send us a Google password, recovery code, payment-card security code, or other sign-in secret by email or through Rootwoven story text.

8. YOUR PRIVACY RIGHTS

Depending on your location, you may have rights to request access to, correction of, deletion of, restriction of, or a portable copy of your personal information, and to object to certain processing. You may also withdraw consent and complain to your local data-protection authority.

To exercise a right, email social@narratwist.com. We may need to verify your identity before fulfilling a request. To delete a Rootwoven account, use the account-deletion instructions. You can manage optional Rootwoven marketing email from your website account or an unsubscribe link.

9. USERS AGED 13 AND OLDER

Rootwoven is intended for users aged 13 and older. We do not knowingly collect, solicit, or market to children under 13. By using Rootwoven, you represent that you are at least 13 years old and, where the law in your country requires a parent or guardian to authorize a minor's use of the service or our processing of the minor's personal information, that you have that authorization.

If we learn that we collected personal information from a child who could not lawfully provide it, we will deactivate the account and take reasonable steps to delete the information. Contact social@narratwist.com if you believe this has occurred.

10. INTERNATIONAL PROCESSING

Narratwist operates from Poland, and our providers may process information in the European Economic Area, the United States, and other countries. Where required, we rely on contractual or other lawful safeguards for international transfers.

11. CHANGES AND CONTACT

We may update this policy as Rootwoven, our website, providers, or legal obligations change. We will revise the date at the top and provide additional notice where required.

The controller responsible for this policy is Karol Janowski, doing business as Narratwist, Poland. Questions, privacy requests, and complaints may be sent to social@narratwist.com.