Privacy Policy

1. Introduction

Welcome to NightDare ("we," "us," or "our"). This Privacy Policy explains how we collect, use, and safeguard your information when you use our multiplayer tabletop roleplaying game at nightdare.com (the "Service"). By using the Service, you agree to the practices described here.

2. Information We Collect

2.1 Information You Provide

• Account Information: Your email address, used to sign you in and manage your account.
• Payment Information: If you choose a paid plan, payments are processed securely through Stripe. We do not store your full card details.
• Gameplay Content: The character details, actions, messages, and other text you type while playing.
• Feedback and Reports: Bug reports, error reports, and messages you send us through the contact form.

2.2 Automatically Collected Information

• Log Data: IP address, browser type, operating system, and access times.
• Usage Data: Sessions started, turns taken, and how you interact with the Service.
• Cookies: Session cookies used for authentication and to keep you signed in.

3. How We Use Your Information

We use the information we collect to:

• Run your game sessions and let the Game Master continue your story
• Create and manage your account
• Process payments and prevent fraud
• Respond to your messages, bug reports, and support requests
• Monitor, debug, and improve the Service
• Keep the Service secure and enforce our Terms of Service

4. Service Providers We Share Data With

We do not sell or rent your personal information. We share it only with trusted providers that help us operate the Service:

• Supabase: Database and authentication (stores your account and game data)
• Stripe: Payment processing (PCI compliant)
• Vercel: Hosting infrastructure
• Resend: Transactional and account email delivery
• Storytelling and infrastructure providers: Your gameplay text is sent to third-party providers that generate the Game Master's narration. They process this content only to return the next part of your story and do not use it to identify you.

Each provider has its own privacy policy governing its handling of your information. We may also disclose information when required by law or to protect our rights, users, and the safety of others.

5. Data Retention

You may request deletion of your account and associated data at any time by contacting us.

6. Data Security

We use reasonable technical and organizational measures to protect your data, including:

• Encrypted data transmission over HTTPS/TLS
• Authentication handled through Supabase Auth
• Access controls for internal systems

No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

7. Your Rights and Choices

Depending on where you live, you may have the right to:

• Access: Request a copy of the personal information we hold about you
• Correction: Ask us to correct inaccurate information
• Deletion: Request deletion of your account and data
• Opt-out: Unsubscribe from any non-essential emails

To exercise these rights, contact us through the contact form.

8. Children's Privacy

The Service is not intended for children under 13, and we do not knowingly collect personal information from them. If you believe a child under 13 has provided us with personal information, please contact us and we will remove it.

9. International Data Transfers

Your information may be processed in countries other than where you live, which may have different data protection laws. By using the Service, you consent to these transfers.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will post the new version here and update the "Last Updated" date. For material changes, we may provide additional notice through the Service or by email.