Privacy Policy

FableForge - Privacy Policy

Effective Date: 2 May 2026
Last Updated: 24 October 2026

1. Introduction

FableForge is a product of Forgeworks Labs PTY LTD ("Forgeworks Labs", "we", "us", "our"). We are committed to protecting your privacy and handling your personal information with care and transparency.

This Privacy Policy explains how we collect, use, store, and protect your information when you use the FableForge website and AI-powered interactive role-playing game platform (collectively, the "Service"). By using the Service, you acknowledge that you have read and understood this Privacy Policy.

2. Information We Collect

We collect information in the following categories:

Account Information

When you create an account, we collect:
- Email address
- Username or display name
- Profile avatar (if provided)
- How you arrived — the campaign link or referring site, and the first page you landed on

Account authentication is handled by Clerk, a third-party authentication provider. We do not store your password directly.

Gameplay Information

When you use the Service, we collect and store:
- Characters you create (names, attributes, customisations)
- Session and game state data
- In-game interactions, choices, and prompts
- Character memories and narrative history
- Progress, achievements, and gameplay statistics

This data is essential for providing persistent gameplay experiences where your choices and progress are remembered. Your sessions are private: we do not open or read them, and they are encrypted. See Section 7A.

Technical Information

We automatically collect:
- IP address (which may indicate general location)
- Browser type and version
- Device type and operating system
- Pages visited and features used
- Date and time of access

Payment Information

If you make purchases, payment processing is handled entirely by Stripe. We do not collect, store, or have access to your credit card or bank account details. Stripe may collect information necessary to process your payment in accordance with their privacy policy.

Information We Do Not Collect

We do not collect:
- Phone numbers
- Contact lists or address books
- Location data beyond what IP address may indicate
- Biometric data

3. How We Use Your Information

We use the information we collect to:

  • Provide the Service - Operate gameplay, save progress, maintain character memories, and deliver AI-generated content
  • Improve the Service - Understand how features are used, identify issues, and develop improvements
  • Manage your account - Authenticate access, process transactions, and maintain account security
  • Communicate with you - Send service updates, respond to enquiries, and provide support
  • Ensure security - Detect and prevent fraud, abuse, and violations of our Terms of Service
  • Comply with legal obligations - Meet applicable legal and regulatory requirements

We do not open, read, review or analyse your individual sessions. Your adventures are private to you - see Section 7A.

3A. Legal Basis for Processing (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data on the following legal bases under the General Data Protection Regulation (GDPR):

  • Performance of a contract (Article 6(1)(b)) — To provide and maintain your account, deliver gameplay experiences, process your in-game interactions through AI services, and save your progress. This processing is necessary for us to deliver the Service you have requested.
  • Legitimate interests (Article 6(1)(f)) — To improve and secure the Service, understand usage patterns, and detect fraud or abuse. We balance our interests against your rights and do not use this basis where your interests override ours.
  • Consent (Article 6(1)(a)) — For non-essential cookies (analytics, such as Google Analytics, and advertising measurement, such as Meta's, Reddit's and OpenAI's tags), marketing communications, and any other processing where we specifically request your consent. You may withdraw consent at any time without affecting the lawfulness of processing carried out before withdrawal.
  • Legal obligation (Article 6(1)(c)) — To comply with applicable laws, regulations, or court orders.

4. How We Share Your Information

We share information only in limited circumstances:

Service Providers

We work with trusted third-party providers who help us operate the Service:

  • Clerk (Authentication) - Receives your email, username, and profile information
  • Stripe (Payment Processing) - Handles payment details directly; we do not store payment information
  • Resend (Email Delivery) - Sends our emails, such as the welcome email when you join and, if you opted in, our marketing emails. Resend receives your email address and, for marketing emails, your name. Marketing email is opt-in: the "Keep me in the loop" box at sign-up starts unticked, every marketing email has an unsubscribe link, and you can turn it off at any time in your account settings. Resend is processed in the United States. See Resend's Privacy Policy.
  • AI Partners (Content Generation) - Receives prompts and gameplay inputs to generate responses
  • TypeSafe (Game Decisions) - When you act in a scene where a fight or someone's clothing could come into play, we ask TypeSafe's Jev model what your action does (for example, whether it starts a fight). TypeSafe receives the words of your action, the last few lines of the scene, the names, roles and temperaments of the characters present, and the place. It returns only probabilities, never text, and does not receive your email address or your name on your account. TypeSafe is processed in the United States, and its terms commit it not to train its models on this data. See TypeSafe's Privacy Policy and Data Processing Agreement.
  • Cloudflare (Hosting/Infrastructure) - Our application is delivered through Cloudflare's global network. Cloudflare receives technical data including IP addresses, request headers, and traffic patterns to serve and protect the application. Data may be processed at Cloudflare edge locations worldwide. For more details, see Cloudflare's Privacy Policy
  • Google Analytics (Usage Understanding) - With your consent, we use Google Analytics to understand how visitors interact with our website. Google Analytics collects anonymised data including pages visited, session duration, referral sources, and general geographic region (country/city level). This data is processed by Google and may be transferred to servers in the United States. Google Analytics uses cookies to collect this information and is only activated after you provide consent via our cookie consent banner. For more details, see Google's Privacy Policy and How Google uses data.
  • PostHog (Product Analytics and Session Replay) - With your consent, we use PostHog to understand how the Service is actually used. PostHog receives the pages and screens you visit, the actions you take, the campaign or referrer that brought you here, and a session replay: a reconstruction of your visit showing your navigation, clicks and layout. All text and all images are masked in these recordings - we see where you clicked and what broke, not what your story said. Unlike Google Analytics, this data is not anonymous: once you have an account it is linked to you by an opaque account identifier, and activity from before you signed up is joined to that account. We do not send PostHog your email address or your name. PostHog is processed in the United States. See PostHog's Privacy Policy.
  • Sentry (Error Monitoring) - With your consent, we use Sentry to find out when something breaks. When an error occurs, Sentry receives technical diagnostic data: the error itself, the page you were on, your browser and device type, your IP address, and a masked replay of the moments before the error - again with all text and images hidden. We do not send Sentry your account identifier, your email address, or your name, so these reports are not linked to your account. Sentry is processed in the United States. See Sentry's Privacy Policy.
  • Meta (Advertising Measurement, only if you accept it) - If you accept advertising measurement, Meta's tag (the Meta Pixel) runs on our website, never on game or sign-in pages. It tells Meta which of those pages you view and when you create an account, together with your IP address, your browser and device, the `fbclid` click identifier if you arrived from one of Meta's ads, and Meta's own cookies (`_fbp` and `_fbc`). If we turn on Meta's matching features, it will also receive a hashed (one-way scrambled) copy of your email address or of our identifier for your account when you sign up, so Meta can recognise its own users; we will not turn these on before this policy says so. Meta may use what it receives to measure our ads and to decide who sees ads, ours and others', as its Business Tools Terms allow. It never receives your sessions or anything you type. Meta processes this data in the United States and elsewhere. See Meta's Privacy Policy and your Meta ad settings.
  • Reddit (Advertising Measurement, only if you accept it) - If you accept advertising measurement, Reddit's tag (the Reddit Pixel) runs on our website, never on game or sign-in pages. It tells Reddit which of those pages you view and when you create an account, together with your IP address, your browser and device, the `rdt_cid` click identifier if you arrived from one of Reddit's ads, and Reddit's own cookie (`_rdt_uuid`). If we turn on Reddit's matching features, it will also receive a hashed (one-way scrambled) copy of your email address or of our identifier for your account when you sign up; we will not turn these on before this policy says so. Reddit may use what it receives to measure our ads and to decide who sees ads. It never receives your sessions or anything you type. Reddit processes this data in the United States. See Reddit's Privacy Policy and your Reddit ad settings.
  • OpenAI (Advertising Measurement, only if you accept it) - If you accept advertising measurement, OpenAI's tag (the OpenAI Measurement Pixel) runs on our website, never on game or sign-in pages. It tells OpenAI when you create an account, together with your IP address, your browser and device, our website's address, the `oppref` click reference if you arrived from one of our ads in ChatGPT, and OpenAI's own cookies (`__oppref`, which keeps that click reference for 30 days, and `__obref`, a random reference for your browser kept for up to a year). If we turn on OpenAI's matching features, it will also receive a hashed (one-way scrambled) copy of your email address or of our identifier for your account when you sign up; we will not turn these on before this policy says so. OpenAI uses what it receives to measure our ads. We send it with OpenAI's opt-out flag, which asks OpenAI not to use it to personalise ads for you. It never receives your sessions or anything you type. OpenAI processes this data in the United States. See OpenAI's Privacy Policy.
  • YouTube (Embedded Video, Press page only) - Our Press page can play videos that outlets have published about FableForge. Nothing is requested from YouTube or Google until you press play - until then the player is a placeholder served from our own site. If you do press play, the video loads from `youtube-nocookie.com`, YouTube's privacy-enhanced host, which then receives your IP address and browser information. See Google's Privacy Policy.
  • Discord (Team Notifications) - When you send us feedback or a bug report, the first 200 characters of your message are posted to a private channel so our team sees it promptly, with its type, your rating and basic technical context (the page, your browser type, and the game location and turn it was sent from). Your account details and the text of your sessions are never posted. See Discord's Privacy Policy.
  • VibeTopList (Vote Rewards, only if you choose to vote) - If you use a "Vote for us" button to vote for FableForge on VibeTopList, a list of games, the vote link carries a random code we made for your account. It is not your name, email address or account identifier. After you vote, VibeTopList tells us that a vote with that code happened, so we can add your Embers. VibeTopList also sends us the voter's IP address with each vote; we do not keep it. Voting happens on VibeTopList's own site, under VibeTopList's Privacy Policy.
  • Discord (Joining Our Server, only if you choose to join) - If you choose to join our Discord from the game, we keep your Discord user ID, your Discord username and the date you joined through us, so that we can give the joining reward once. We ask Discord only for permission to see your username and to add you to our server. We use that permission once and then hand it back. We never read your messages, your other servers or your friends. If you delete your account, we remove your Discord ID and username. We keep only a one-way code made from your Discord ID, which cannot be turned back into it, so the reward cannot be collected again with the same Discord account.

We select partners who maintain appropriate privacy and security standards.

AI Technology Partners

To generate interactive storytelling content, we transmit your gameplay prompts and inputs to third-party AI providers. This is essential for the Service to function. AI providers process this data to return generated content and are bound by their own privacy policies and our contractual requirements. See Section 4A below for detailed information about AI data processing.

Legal Requirements

We may disclose information if required by law, court order, or government request, or if we believe disclosure is necessary to:
- Comply with legal obligations
- Protect the rights, property, or safety of Forgeworks Labs, our users, or others
- Investigate potential violations of our Terms of Service

Your sessions are held to a stricter rule: we open or disclose them only when you ask us to, or where the law requires it (see Section 7A).

Business Transfers

If Forgeworks Labs is involved in a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any such change.

With Your Consent

We may share information with your explicit consent for purposes not covered by this policy.

What We Do Not Do

  • We do not sell your personal information
  • We do not share your sessions, or anything you type while playing, with advertising platforms
  • We do not run advertising tags or set advertising cookies unless you accept advertising measurement, and never on game or sign-in pages

4A. AI Technology and Data Processing

The Service uses artificial intelligence and large language model (LLM) technology to generate gameplay narration, dialogue, and game responses. This section provides specific details about how your data interacts with AI systems.

What Data Is Sent to AI Providers

When you play the game, the following data may be transmitted to our AI service providers:
- Your gameplay inputs (character actions, dialogue choices, free-text prompts)
- Character information (names, attributes, current game state context)
- Relevant game world context (location, NPCs, quest state) needed to generate coherent responses

How AI Providers Use Your Data

Our AI service providers process your data solely to generate and return gameplay content. They are bound by Data Processing Agreements (DPAs) and their own privacy policies. We select providers that:
- Process data on our behalf, not for their own purposes
- Maintain appropriate security and privacy standards
- Do not use your individual gameplay data to train their general models without separate consent

Data Retention by AI Providers

AI providers may temporarily retain your prompts and responses for service delivery and abuse prevention, in accordance with their own retention policies. We do not control the retention practices of third-party providers, but we select partners whose practices align with our privacy commitments.

Your Control

The AI content generation is integral to the Service — it cannot function without it. By using the Service, you acknowledge that your gameplay inputs will be processed by AI service providers as described above and in our Terms of Service.

5. Cookies and Similar Technologies

We use cookies and similar technologies for:

Essential Cookies

Required for the Service to function, including:
- Session management
- Authentication (via Clerk)
- Security features

These cookies are strictly necessary and do not require your consent.

Analytics Cookies (Consent Required)

With your consent we use two analytics tools, which set cookies and store data in your browser to help us understand how the Service is used:

  • Google Analytics, via Google Tag Manager, collects which pages you visit, how long you spend on the site, and how you arrived here. This data is aggregated and anonymised. Its cookies include `_ga`, `ga*`, and related identifiers.
  • PostHog collects product usage and a masked session replay, and stores its identifier in both a cookie and your browser's local storage. This data is not anonymous - see the PostHog entry in Section 4 for exactly what it receives and how it is linked to your account.

This list describes the analytics tools we use today; it is not a guarantee that no other cookie is ever set by them, and we will update this policy if we add or change providers.

Nothing above is loaded until you give your explicit consent through our cookie consent banner. Before you choose, and if you decline, no analytics cookies are placed, no session replay is recorded, nothing is stored durably in your browser, and Google Analytics, PostHog and Sentry do not collect anything. If you later withdraw consent, the identifiers already stored are cleared.

Advertising Measurement Cookies (Consent Required)

With your separate consent, Meta's, Reddit's and OpenAI's tags run on our website so that each platform can tell whether a visit or a sign-up came from one of its ads (see their entries in Section 4 for what each receives and how it may be used). They set their own cookies: Meta's `_fbp` and `_fbc`, Reddit's `_rdt_uuid`, and OpenAI's `__oppref` and `__obref`. If you arrived from an ad, the click identifier in the link (such as `fbclid`, `rdt_cid` or `oppref`) is kept in the page's memory until you choose; it is written for these tags only if you accept (for OpenAI's tag, back into the page's address, which is where that tag reads it), and forgotten if you decline.

  • Only with your consent. No advertising tag runs, and no advertising cookie is set, before you choose or if you decline. Advertising measurement is delivered through Google Tag Manager, so it can only run while analytics is on too.
  • Never on game or sign-in pages. The tags are switched off on game pages, on the pages that complete a sign-in, and on any page whose address carries a game or sign-in identifier, so they never see your game or your sign-in.
  • Withdrawal. If you withdraw consent, Meta's, Reddit's and OpenAI's cookies are cleared from our website and the page reloads, so no advertising tag keeps running.
  • Global Privacy Control. If your browser sends a Global Privacy Control signal, we treat it as a refusal of advertising measurement: no advertising tag runs, whatever you choose in the banner. Your analytics choice still applies.

Your Cookie Choices

When you first visit the Service, our cookie consent banner offers three equal choices: accept all, reject all, or choose. Choosing lets you say yes or no to analytics and to advertising measurement separately; nothing is ticked in advance. You can change your preferences at any time by clicking the "Cookie Settings" link in the footer of the website. If you reject non-essential cookies, only strictly necessary cookies will be used.

Most browsers also allow you to control cookies through their settings. However, disabling essential cookies may prevent the Service from functioning correctly.

6. Data Retention

We retain your information as follows:

  • Account data - Retained until you delete your account or your account is determined to be dormant
  • Gameplay data - Retained until account deletion or your account is determined to be dormant
  • Technical logs - Retained for a limited period for security and troubleshooting

When you delete your account, we delete all associated gameplay data. Some information may be retained if required by law or for legitimate business purposes (such as fraud prevention).

Dormant Accounts

Accounts that remain inactive for an extended period may be considered dormant. We may delete data associated with dormant accounts after providing reasonable notice.

7. Data Security

We implement appropriate technical and organisational measures to protect your information, including:

  • Encryption of data in transit and at rest
  • Secure authentication through trusted providers
  • Regular security reviews and updates
  • Access controls limiting who can access personal data

However, no system is completely secure. We cannot guarantee absolute security of your information. You are responsible for maintaining the security of your account credentials.

7A. Your Sessions Are Private

Your sessions - the actions and words you type, your conversations with characters, and the story generated in response - are private to you.

  • We do not open or read your sessions. No one at Forgeworks Labs opens, reads or reviews your sessions, your conversations with characters, or anything you type during play. We do not use your sessions for marketing, advertising or profiling, and we do not use them to train or tune AI models.
  • Your sessions are encrypted. They are encrypted in transit (TLS) between your device, our servers and our AI technology partners, and encrypted at rest (AES-256) in the databases where they are stored. This is not end-to-end encryption: our servers must be able to read what you type in order to run your game.
  • Processed automatically, only to run your game. What you type is processed automatically by our servers and sent to our AI technology partners (Section 4A) to generate your story. The parts your game needs to remember - your progress, and what the characters you meet remember about you - are stored so you can continue.
  • Kept out of analytics and error reports. The analytics and error-monitoring services described in Section 4 do not receive what you type or the story generated for you, and they mask all on-screen text in recordings.
  • The only exceptions. A person at Forgeworks Labs will see the contents of a session only if you ask us to - for example, when you report a bug or ask for help with a session - or if we are required by law to disclose it.

8. Your Rights

Rights for All Users

You have the following rights regarding your personal information:

  • Access — Request a copy of the personal data we hold about you
  • Correction — Request correction of inaccurate or incomplete data
  • Deletion — Request deletion of your personal data
  • Portability — Request your data in a portable format (such as JSON or CSV) where technically feasible
  • Objection — Object to certain processing activities

Additional Rights for EU/EEA, UK, and Swiss Residents (GDPR)

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, you have the following additional rights under the General Data Protection Regulation:

  • Right to restriction of processing — Request that we limit how your data is processed in certain circumstances
  • Right to withdraw consent — Where we rely on your consent as a legal basis, you may withdraw it at any time. Withdrawal does not affect the lawfulness of processing carried out before withdrawal
  • Right not to be subject to automated decision-making — You have the right not to be subject to decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects. Our AI systems generate gameplay content only and do not make decisions that legally or significantly affect you
  • Right to lodge a complaint — You have the right to lodge a complaint with a data protection supervisory authority in your country of residence. A list of EEA supervisory authorities is available at the European Data Protection Board website

How to Exercise Your Rights

To exercise any of these rights, please contact us at contact@fableforge.gg. We will respond to your request within 30 days. If we need additional time due to the complexity of your request, we will notify you within the initial 30-day period and may extend by up to 60 additional days.

We will not charge a fee to process your request unless it is manifestly unfounded or excessive.

You may also have additional rights under your local laws. We will honour requests in accordance with applicable legal requirements.

Rights of minors and parental requests

If you are a parent or legal guardian and wish to exercise rights on behalf of a minor in your care — including access to, correction of, or deletion of the minor's data, or closure of their account — please contact us at contact@fableforge.gg with reasonable evidence of your relationship to the minor and your identity. We will respond to verified parental requests within the same 30-day timeframe described above.

9. International Data Transfers

Forgeworks Labs is based in Australia. The Service is hosted on infrastructure that may be located in the United States or other countries.

If you access the Service from outside Australia, your information may be transferred to, stored in, and processed in Australia, the United States, or other locations where our service providers operate.

Safeguards for EU/EEA, UK, and Swiss Residents

If you are located in the European Economic Area (EEA), United Kingdom, or Switzerland, we ensure that transfers of your personal data to countries outside the EEA are protected by appropriate safeguards, including:

  • Adequacy decisions — Where the European Commission has determined that the destination country provides an adequate level of data protection
  • EU-U.S. Data Privacy Framework (DPF) — For transfers to U.S.-based service providers that are certified under the DPF
  • Standard Contractual Clauses (SCCs) — Approved by the European Commission, incorporated into our agreements with service providers where other mechanisms are not available

You may request a copy of the safeguards we use for international transfers by contacting us at contact@fableforge.gg.

We take steps to ensure that your information receives appropriate protection in accordance with this Privacy Policy and applicable law.

10. Third-Party Links and Services

The Service may contain links to third-party websites, applications, or services. This Privacy Policy does not apply to those third parties. We encourage you to review the privacy policies of any third-party services you interact with.

11. Minors and Children's Privacy

The Service admits users aged 13 and over globally, and aged 16 and over in the European Economic Area, the United Kingdom, and any other jurisdiction where the digital age of consent under GDPR Article 8 (or equivalent law) is above 13.

Users under 18

Mature content within the Service is gated behind an account-level opt-in that requires self-attestation that you are at least 18 years of age (or the local age of majority, where higher). Users between 13 and 17 cannot enable the mature-content option and we do not knowingly process mature content for them.

Users below the applicable minimum age

We do not knowingly collect personal information from anyone below the applicable minimum age — 13 globally, or 16 in the EEA, UK, and other jurisdictions where the local digital-consent age is above 13. If we learn that we have collected personal information from a user below the applicable minimum age, we will take steps to delete that information promptly and close the account.

For parents and guardians

If you believe your child has provided us with personal information without your consent, or if you wish to request that we close a minor's account or delete their data, please contact us at contact@fableforge.gg. We will action verified requests promptly. See also Section 8 ("Rights of minors and parental requests").

Reference frameworks

  • COPPA (Children's Online Privacy Protection Act, United States) protects children under 13. Our 13+ minimum aligns with COPPA's threshold.
  • GDPR Article 8 (General Data Protection Regulation, European Union) sets the digital age of consent between 13 and 16 depending on the member state. Our 16+ minimum for EEA and UK users meets the highest applicable threshold without requiring per-country gating.

12. Creator Content (Future)

When creator tools become available, additional privacy considerations will apply to user-generated Universes and Experiences. We will update this Privacy Policy to address how creator content is handled, including options for public, private, and draft visibility states.

13. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. When we make changes, we will update the "Last Updated" date at the top of this page.

For material changes, we will make reasonable efforts to provide notice through the Service or via email. Your continued use of the Service after changes take effect constitutes acceptance of the updated Privacy Policy.

14. Contact Us

If you have questions, concerns, or requests regarding this Privacy Policy or your personal information, please contact us at:

Email: contact@fableforge.gg

Company: Forgeworks Labs PTY LTD

We aim to respond to all enquiries within a reasonable timeframe.

Your privacy matters to us. Thank you for trusting FableForge with your adventures.

Browse in Fable Forge