Privacy Policy

1. Controller

The controller responsible for the processing of your personal data is the operator of Kobold Kronikler, whose full contact details are set out in the Impressum.

For data-protection enquiries, please contact us using the email address listed in the Impressum with the subject line “Data Protection / Datenschutz”.

A Data Protection Officer has not been appointed, as there is currently no statutory obligation to do so (Art. 37 GDPR / §38 BDSG).

2. Personal Data We Collect

We collect only the data that is necessary (“data minimisation”, Art. 5(1)(c) GDPR):

3. Legal Basis and Purposes

Every processing activity must have a legal basis under Art. 6 GDPR. We rely on the following:

4. Data Retention

We retain personal data only for as long as necessary for the stated purpose and no longer than required by law:

• Account data: Retained for as long as your account is active. Upon deletion of your account, account data is deleted within 30 days, unless a longer retention period is required by law (e.g. German commercial or tax retention obligations under HGB / AO, typically up to 10 years).
• Campaign content: Retained for as long as your account is active and for 30 days following account deletion.
• Server / access logs: Retained for a maximum of 7 daysin the normal course of operations, unless a specific security incident requires longer retention.
• Cookie consent records: Retained for 1 year from the date of consent, so that we can demonstrate your consent (Art. 7(1) GDPR).
• Tier application records: Retained for as long as your account is active, and deleted with your account within 30 days of its deletion. We keep decided applications rather than deleting them on decision, because the record of which tier you were granted, and of your acceptance of the revocation clause, is what evidences the basis on which that access was given (see Terms §4).
• Invitations by email: Deleted as soon as the invitation is accepted, declined or cancelled. One that is not used expires after 14 days and is deleted within two days after that, so we keep an invited address for at most 16 days after the last invitation email. Server logs record the invitation, not the address.
• Data processed by service providers: Deleted within the storage period stated for each provider in section 5.

5. Data Sharing and Third-Party Processors

We do not sell your personal data. We use the following service providers. For each, the table states who the provider is, what it receives and why, the legal basis, how long the data is kept, and whether it is transferred outside the European Economic Area (EEA).

PostHog, Microsoft Clarity and Google AdSense are used only after you have given your consent. You can withdraw your consent at any time, with effect for the future, in the cookie preferences (Art. 7(3) GDPR).

We disclose personal data to law-enforcement or other authorities only where we are legally required to do so.

Connected AI apps

On a Lore-Keeper or Archivist plan you can connect an AI app of your choice, such as Claude or ChatGPT, to your account. This works only after you have turned on AI features in your account settings and approved the connection yourself. The connected app can read the campaigns you can open and propose changes, which take effect only once you approve them on the website. A campaign run by someone else is available to your app only while that campaign's GM also has AI features turned on.

What the app reads is sent, at your request, to the company that provides it. That company is not our processor: it handles the data as a separate controller under its own terms and privacy policy, and it may process it outside the EEA. Legal basis for our part: Art. 6(1)(b) GDPR - providing the feature you asked to use.

We keep a record of each connection (the app's self-declared name, what it may do, and when it was connected, last used and disconnected) until you delete your account. You can disconnect an app at any time under Account settings, Connected Apps, which ends its access immediately.

6. International Transfers

Your account and campaign data is stored on our servers within the European Economic Area (EEA). Cloudflare, Proton, Sentry, Anthropic, PostHog, Microsoft and Google (see section 5) are based outside the EEA or process data there. For each of them, section 5 states the country and the legal safeguard for the transfer: an adequacy decision of the European Commission (Art. 45 GDPR), which for US companies means certification under the EU-U.S. Data Privacy Framework, or the EU Standard Contractual Clauses (Art. 46(2)(c) GDPR).

7. Automated Decision-Making

We do not use automated decision-making or profiling with legal or similarly significant effects as described in Art. 22 GDPR.

8. Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Passwords are stored using bcrypt hashing (12 rounds) - plaintext passwords are never stored.
• All connections to the Service are encrypted via HTTPS/TLS.
• Traffic to the Service passes through Cloudflare’s network, which filters out attacks such as denial-of-service attacks and known exploit attempts before they reach our servers.
• HTTP security headers are applied on all responses: Strict-Transport-Security (HSTS), X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy.
• CSRF tokens are used to protect all authenticated requests.
• Rate limiting is applied to login, registration, and note-creation endpoints to limit brute-force and credential-stuffing attacks.
• Inline images are not permitted in user-generated markdown content - this prevents external image requests that would expose a viewer’s IP address to third-party servers.
• Markdown output is sanitised using DOMPurify to prevent cross-site scripting (XSS).
• The database is accessible only from within the internal Docker network and is not exposed to the public internet.
• Data is stored on Hetzner infrastructure within the EEA, and Hetzner’s technical and organisational measures (TOM, Art. 32 GDPR) supplement our own.

No system is entirely free from risk. In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours and, where required by Art. 34 GDPR, inform affected users without undue delay.

9. Your Rights Under GDPR

You have the following rights regarding your personal data. To exercise any of them, contact us using the details in the Impressum with the subject line “Data Subject Request”. We will respond within one month (Art. 12(3) GDPR).

10. Right to Lodge a Complaint

You have the right to lodge a complaint with a data-protection supervisory authority at any time (Art. 77 GDPR). The supervisory authority competent for the operator is the data protection authority of the German federal state (Bundesland) in which the operator is located. A list of all German supervisory authorities is available at: bfdi.bund.de - Supervisory Authorities

If you are located in another EU member state, you may also contact your local supervisory authority.

11. Cookies

For detailed information about the cookies we use, their purposes, duration, and how to manage your preferences, please see our Cookie Policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in the law or our data practices. Material changes will be communicated to registered users by email or by a prominent notice within the Service before taking effect. The “Last updated” date at the bottom of this page indicates when this policy was last revised.