Privacy Notice

Effective Date: October 01, 2024

At Trails Weaver ("the Platform"), your privacy matters to me. This Privacy Notice explains what personal data I collect, why, how I use and protect it, and the rights you have. It applies to the Trails Weaver landing page and the main application.

Privacy at a glance

I collect the minimum needed to run the app — mainly your email and the worlds you create.
Your content is yours. I never sell your data, show ads, or use advertising trackers.
I never use your content to train AI or share it with AI providers.
Payments go through Paddle — I never see your card details.
You can access, export, or delete your data at any time — just email me.

1. Who I Am

Trails Weaver is an independent product built and operated by a solo developer based in Ukraine. I am the data controller responsible for your personal data. You can reach me at info@trailsweaver.com for any privacy question or request.

2. Data I Collect

Account information: your email address, and a unique account identifier from Google if you choose to sign in with Google.
Content data: anything you create or upload in the Platform — worlds, scenarios, characters, locations, maps, notes and uploaded images — stored so I can provide the service to you.
Technical data: basic information your browser sends automatically, such as IP address, device and browser type, and server logs, used for security and to keep the service running.
Payment data: handled entirely by Paddle (see below). I receive confirmation of your subscription status but never see or store your card details.

3. How I Use Your Data and My Legal Bases

Under the GDPR I rely on the following legal bases:

To provide the service — creating and maintaining your account, storing and displaying your content, and enabling sharing features. Legal basis: performance of a contract.
To process payments for the Pro tier, via Paddle. Legal basis: performance of a contract and legal obligation (e.g. keeping tax records).
To secure and improve the Platform — preventing abuse, debugging, and understanding how features are used. Legal basis: my legitimate interests in running a safe, reliable product.
Analytics on the landing page, measured without cookies or personal profiles. Legal basis: my legitimate interests in understanding traffic.

4. Cookies and Local Storage

The Platform uses cookies and local storage that are strictly necessary to log you in and keep your session active — these are required for the app to work. The landing page sets no cookies; it uses Vercel Analytics, a privacy-friendly, cookieless analytics tool, to understand traffic.

5. Third Parties and Sub-processors

I keep the list of third parties short and only share what is needed:

Paddle — payment processing for the Pro tier, acting as Merchant of Record.
Vercel — hosting and privacy-friendly analytics for the landing page.
Supabase — database, authentication, and storage for the main application, where your account and content are securely kept.
Google — sign-in, if you choose to log in with your Google account.

I do not sell your personal data, and I do not share it for advertising. There are no ads, advertising trackers, or marketing pixels inside the product.

6. International Data Transfers

Some of these providers may process data outside the European Economic Area (for example, in the United States). Where that happens, the transfer is covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses and the providers' own data-processing agreements.

7. How Long I Keep Your Data

I keep your account and content data for as long as your account is active. If you delete your account or ask me to delete your data, I remove it within a reasonable period (normally within 30 days), except where I must keep certain records longer to meet legal or accounting obligations — for instance, payment records required by tax law. Residual copies may persist briefly in backups before being overwritten.

8. Your Rights

If you are in the EU, EEA, or UK, you have the right to:

access the personal data I hold about you;
have inaccurate data corrected;
have your data deleted;
restrict or object to certain processing;
receive your data in a portable format and, where technically feasible, have it transferred;
withdraw consent at any time, without affecting prior processing;
lodge a complaint with your local data protection supervisory authority.

To exercise any of these, email me at info@trailsweaver.com. I aim to respond within 30 days.

9. Children

Trails Weaver is not directed to children under 16, and I do not knowingly collect personal data from them. If you believe a child has provided me with personal data, contact me and I will delete it.

10. Security

I take reasonable technical and organisational measures to protect your data, including encrypted connections and access controls. No method of transmission or storage is completely secure, so I cannot guarantee absolute security.

I keep access to your content to a minimum. I only access it when it is needed to provide support, investigate a technical issue, or comply with a legal obligation.

11. Artificial Intelligence

I do not use your content to train AI or machine-learning models, and I do not share your content with third-party AI providers. Your worlds and writing are yours.

12. Changes to This Notice

I may update this Privacy Notice from time to time. Any changes will be posted on this page with a new effective date.