Markbound is a small, indie project. We collect as little as we can get away with, and we tell you who else sees it. This policy explains what we keep, why, and how to get rid of it.
1. Who we are
Markbound is operated by Generative Studio, based in the Netherlands. Questions or data requests: ataakillioglu@generative-studio.nl.
2. What we collect
- Account: email address, hashed password (or Google sign-in identifier).
- Game content: characters, sagas, journal entries, oracle pulls, dice rolls — everything you create in the app.
- Usage data: per-day counts of AI narration turns, used to enforce your tier's allowance.
- Saga checkpoints: AI-generated summaries of your saga progress, used to give the Narrator long-term memory across sessions.
- Billing: if you subscribe, Stripe stores your payment method, billing address and invoices. We never see or store your card number.
- Technical: standard server logs (IP address, user agent, timestamps) for security and debugging, retained briefly.
- Product analytics: product events — we record when you sign up, create a character, create a saga, take a narration turn, and start or complete a checkout. We do NOT record narration text, character details, or any free-text input — only event names, your user ID, and safe metadata fields like tier, saga ID, model provider, token counts, latency, and retry counts.
We do not run third-party analytics, advertising trackers, or social pixels. There are no cookies beyond the strictly necessary ones used to keep you signed in.
3. Who processes your data
We use a small number of trusted sub-processors to run the service:
- Lovable Cloud (Supabase): database, authentication, file storage. Hosted in the EU.
- Stripe: payment processing for subscriptions.
- AI model provider (Moonshot AI, running Kimi K3): when you ask the Narrator to respond, the prompt — including the relevant slice of your saga and journal — is sent to Moonshot AI, which runs the Kimi K3 model. See our AI Disclosure for specifics.
- Email provider: for transactional emails (sign-up confirmation, password reset, billing receipts).
- Sentry (https://sentry.io): error monitoring. Receives crash reports and exception traces from our servers when something goes wrong. We strip cookies, request headers, email addresses, and free-text user input from every event before it is sent. Sentry retains error data for the period configured in our project settings (default 90 days).
4. Legal bases (GDPR)
- Contract: processing your account, sagas and subscription so we can deliver the service.
- Legitimate interest: security logging, abuse prevention, enforcing usage caps.
- Legal obligation: tax records for invoices.
5. How long we keep things
- Account and game content: until you delete your account.
- Usage counters: retained indefinitely so we can support billing disputes, enforce subscription tier limits, and detect abuse.
- Invoices: kept for the legally required period (typically 7 years in the Netherlands).
- Server logs: rotated within ~30 days unless tied to an active investigation.
- QA eval run records (
ai_eval_runs) may include saga excerpts and AI outputs used during architecture testing. These are scoped to your account by row-level security and are deleted when you delete your account. - Email delivery logs (recipient address, template name, send status) are retained for operational diagnostics and to comply with anti-spam obligations. Suppression records (bounces, unsubscribe requests, spam complaints) are kept indefinitely so we never re-email someone who has asked us to stop.
- Analytics events are retained as long as your account exists and are deleted with your account.
6. Your rights
Under the GDPR you have the right to access, correct, export and delete your data, and to object to or restrict processing. Email ataakillioglu@generative-studio.nl and we will respond within 30 days. You can also lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens).
7. Account deletion
You can permanently delete your account from your account settings. We will process the deletion immediately. You may also email us at ataakillioglu@generative-studio.nl if you prefer. Stripe billing records are retained as required by tax law.
8. Children
Markbound is not directed at children under 16 and we do not knowingly collect data from them.
9. Changes
If we change this policy in any material way we will update the date at the top and, where appropriate, notify you by email.