Privacy Policy

What we collect

• Your account: email address, display name and date of birth. Your password is stored only as a secure hash — we never see or keep the password itself.
• Your games: your characters and campaigns, what you type while playing, the story the narrator writes back, your notes, and messages you send to other players in a shared campaign.
• An API key, if you add one: stored encrypted, used only to run your own campaigns, and never shown again.
• Bug reports you send: your description, plus a copy of the game's state at that moment and any recent errors, so we can see what went wrong.
• Technical information: performance and error measurements (how long things take, what failed and where) — never what you type. Our servers may also briefly record your IP address and browser type for security, such as limiting repeated sign-in attempts.
• The narration log: during the beta, every campaign's turns, what you type and what the narrator writes, are kept privately on our server so we can check and improve the narrator.

The game keeps your sign-in in your browser's local storage. We don't use advertising or tracking cookies.

If you arrive through one of our own links (kithmoot.com/go/…, the links in our videos and posts), we count the visit and set one small cookie, km_src, that holds only which link it was and when. It lasts 30 days and is read only by kithmoot.com and the game, so that if you sign up we know which link brought you; the account keeps that link's name. The count of visits keeps no IP address: we keep a scrambled code made from your address and browser that can't be turned back into either and is changed every day, plus whether you were on a phone, tablet or computer, the app you opened the link in, and the name of the site you came from.

How we use it

• To run the game: save your campaigns, narrate your turns and let you play with friends.
• To email you about your account: confirming your address, resetting your password, campaign invites.
• To keep things appropriate: players under 18 always get strict, all-ages content.
• To find and fix bugs, keep the game secure, and make it better.

Who else handles it

• Anthropic provides the AI that narrates the game. What you do in a campaign, and the story so far, is sent to it to write each turn. If you add your own API key, your campaigns go to that provider instead, under your agreement with them.
• Resend delivers the game's emails.
• Stripe takes payments for paid plans. It handles your card details and billing address under Stripe's own privacy policy; we keep only the Stripe references we need to match a payment to your account, never your card number.
• Cloudflare runs the “Verify you are human” check on logging in, resetting a password and asking for an invite. It sees your browser and connection details to tell people from bots, under Cloudflare's own privacy policy.
• Our hosting provider runs the servers and keeps backups.
• Discord, if you join the Kith Moot Discord server — that's covered by Discord's own privacy policy. If you use Connect Discord, we keep your Discord user ID and name so your beta roles there follow your account here; disconnecting removes them.
• Anyone we're legally required to share information with.

Players under 18

You must be at least 13 to create an account. If you're under 18, please have a parent or guardian read this page with you. Accounts under 18 always get strict, all-ages content, and that can't be switched off. If we learn that someone under 13 has signed up, we'll delete the account. Parents or guardians can contact us to ask about or delete a young person's account.

Keeping and deleting your information

We keep your account and campaigns for as long as your account exists. You can delete your account at any time from Profile → Delete account. That deletes your account, every campaign only you play in (characters, story and everything you typed), your bug reports and any API key you added. In a campaign you share with other players, your character leaves the party and the campaign continues for them.

You can also take a copy of everything we keep for your account, at any time, from Profile → Download my data: your account details, your characters, the campaigns you lead, your bug reports and your plan, in one file. Passwords and API keys are never included. Party chat isn't stored at all, so it isn't in the file either.

Performance measurements are kept for about 30 days and detailed request traces for about 7 days. Copies of deleted information can remain in our hosting provider's backups for a short time until those backups are replaced.

Security

Connections to the game are encrypted, passwords are hashed, and API keys are stored encrypted. No system is perfectly secure, but we work to protect your information and will tell affected players if something goes wrong.

Changes and questions

If this policy changes, we'll update the date above and let beta testers know on the Kith Moot Discord server. For questions or requests about your information, email support@kithmoot.com or ask the Kith Moot team there.