Privacy Policy

1. Overview

This Privacy Policy explains what personal data Loreline ("we", "us", the "Service") collects, how we use it, who we share it with, and the choices you have. It applies to spectators and signed-in members alike.

Loreline is currently a free, non-commercial beta operated on an informal basis, not yet by an incorporated legal entity. We aim to collect only what is needed to run the Service. This policy should be read alongside our Terms & Conditions.

2. Data we collect

Depending on how you use the Service, we may process:

• Account data: when you sign in with Google, we receive and store your email address and a unique account identifier. We do not request offline access to your Google account and do not store Google refresh tokens.
• Profile data: a display name and username you choose, shown publicly on your profile if set.
• Content you contribute: photos, videos, audio, titles, descriptions, and the lorelines you create or interact with, stored in our media storage and database.
• Embedded-media metadata: when you add media from third-party platforms (YouTube, TikTok, Instagram, X), we store references and public metadata, not the media itself.
• Location and capture data from media: where a photo or video contains EXIF metadata, we may extract its GPS coordinates and capture date. To protect your privacy, we coarsen the coordinates to roughly town/neighbourhood level (about a 1 km grid) before storing them — we do not retain the original street-level precision. Capture date may be shown on the scene; the coarsened location is stored with the scene and is not shown publicly unless you choose to include it.
• Usage and analytics data: loreline views, watch time, completion, save/unsave actions, device type (mobile/desktop), and — for embedded players — the host site the player is shown on. A per-browser session identifier is stored in your browser’s local storage. We do not store IP addresses in our analytics database.
• Preferences stored locally in your browser: theme, sound, last-selected loreline, and dismissed notices.

3. How we use your data

• To authenticate you and maintain your session.
• To provide, operate, and improve the Service, including displaying your content within the lorelines it belongs to.
• To produce aggregate analytics (such as view counts and watch time) for loreline owners.
• To screen content for safety and legal compliance (see "Content moderation" below).
• To protect the Service against abuse, including rate limiting.
• To respond to your requests and to copyright or content notices.

4. Content moderation

When a loreline is submitted to be made public, its text (title, description, and a sample of scene titles and descriptions) is sent to third-party AI moderation services (OpenAI and Anthropic) to screen for unsafe or unlawful content. Content remains private until it passes screening and, where required, admin review. Private lorelines are not sent to these services for general processing.

Theme generation (a creator feature) sends your design prompt and any reference image URL you provide to Anthropic to generate a theme.

5. Location data and reverse geocoding

If a photo or video you upload contains GPS coordinates in its EXIF metadata, we first coarsen those coordinates to roughly town/neighbourhood level, then send the coarsened coordinates to the OpenStreetMap Nominatim service to translate them into a human-readable place name (town, region, country — not a street address). The coarsened coordinates and place name are stored with your scene. You can avoid this entirely by removing location metadata from files before uploading, or by not uploading files that contain it.

6. Cookies, consent, and local storage

We use cookies that are strictly necessary to keep you signed in (set by our authentication provider, Supabase). These are secure, same-site cookies and are not used for advertising.

Non-essential analytics (loreline view tracking, our per-browser analytics identifier and device fingerprint, and Vercel’s aggregate performance analytics) are off by default and only run after you opt in via our cookie banner. If you reject, or before you choose, none of these run. You can change your choice at any time using the “Manage cookies” link in the site footer.

We also store some essential preferences (theme, sound, last-selected loreline, dismissed notices) in your browser’s local storage; these never leave your device.

7. Who we share data with

We do not sell your personal data. We share data only with service providers ("subprocessors") who help us run the Service, each acting on our behalf:

• Supabase — database, authentication, and media storage (hosts the core data).
• Google — sign-in (we receive your email).
• Vercel — application hosting and aggregate performance analytics.
• OpenAI and Anthropic — AI content moderation and theme generation, as described above.
• OpenStreetMap (Nominatim) — reverse-geocoding of EXIF GPS coordinates.
• Upstash — rate-limiting counters (keyed by account or request identifiers; no profile data).
• Third-party embed platforms (YouTube, TikTok, Instagram, X) — their embedded players load directly in your browser and are governed by their own privacy policies; we do not send them your account data.

8. International transfers

Our service providers may process data in countries outside your own, including the United States. Where this happens, we rely on the providers’ own safeguards for international transfers. Because Loreline is an early-stage beta, we have not yet executed formal data-processing agreements with every provider; we will do so as the Service matures.

9. Data retention

We keep your data only as long as we need it for the purposes described in this policy:

• Account and profile data: kept while your account exists. When you delete your account, this data is erased immediately (see "Your rights" below).
• Content (lorelines, scenes, segments, uploaded media): kept while it remains on the Service. Content you delete is removed from the database; uploaded files are removed from media storage. Residual copies may persist in encrypted backups for up to 30 days before being overwritten.
• Analytics records: retained for up to 24 months to provide historical view and watch-time statistics to loreline owners, then deleted or aggregated into non-identifying totals. When you delete your account, any account identifier on your past analytics rows is removed so the remaining records can no longer be linked back to you.
• Rate-limiting counters: transient, expiring automatically within minutes to hours.
• When you delete your account, deletion cascades across our database to remove your profile, lorelines, scenes, media metadata, saved items, watch progress, notifications, and the shares you created.

10. Your rights and choices

Depending on where you live, you may have rights to access, correct, export, restrict, or delete your personal data, and to object to certain processing. You can manage much of your content directly: edit or delete lorelines and scenes, set content to private, and hide scenes.

You can exercise the core rights yourself from your profile, under “Privacy & data”:

• Export my data: download a machine-readable (JSON) copy of your profile, lorelines, scenes, media metadata, saves, and the shares you created.
• Delete my account: permanently and immediately erase your account and associated personal data. This is irreversible.

10a. Contacting us about your rights

For any right not covered by the self-serve tools above — or if you cannot access your account — contact us at info@loreline.live and we will action your request manually.

11. Children

The Service is not directed to children under the age required to consent to data processing in their country. We do not knowingly collect personal data from such children. If you believe a child has provided us personal data, contact us and we will remove it.

12. Changes to this policy

We may update this policy as the Service develops. Material changes take effect when posted at this page. Your continued use of the Service after changes are posted constitutes acceptance.

13. Contact

For privacy questions or to exercise your rights, contact us at info@loreline.live.