Privacy Policy

Last updated: April 2025

Vibe Quest is an AI-powered choose-your-own-adventure game. This Privacy Policy explains what information is collected when you play, how it is used, and your rights under applicable privacy law including the EU General Data Protection Regulation (GDPR) and similar regulations.

1. Who We Are

Vibe Quest is an independent personal project. There is no registered company or formal data controller address. If you have privacy questions you can open a GitHub issue at github.com/zoink2000/VibeQuest.

2. What Information Is Collected

Information You Provide

• Character name and description — the name and description you type for your adventurer.
• Story choices and player prompts — the text you enter during a quest (e.g. what your character does next).
• Quest preferences — themes, genres, content rating, and gameplay options you select at the start of each quest.

Information Stored on Your Device

• Saved characters — if you click "Save Character", your character's name, description, stats, and quest chronicle are saved to your browser's localStorage. This data never leaves your device except as described below.
• Quest checkpoints — story turns, choices, and generated scene art are stored in your browser's IndexedDB to power the Quest Library. This data stays on your device.
• Session cookie — a single, temporary session cookie is set by the web server to link your browser to your in-progress quest. This cookie contains only an anonymous random ID (no personal information) and is deleted when you close your browser.

Information Sent to Third-Party Services

To generate story text and scene artwork, the following information is transmitted to third-party AI services on each game turn:

• OpenAI — your player prompts, character description, and the accumulated story history are sent to the OpenAI API to generate the Dungeon Master's narrative response. OpenAI's privacy policy is at openai.com/policies/privacy-policy.
• Replicate — a brief scene description is sent to the Replicate API (Flux Schnell model) to generate background artwork. Replicate's privacy policy is at replicate.com/privacy.

We do not store any of this data on our servers. We have no persistent server-side database. The server holds your active game state only for the duration of your session (typically under 20 minutes of inactivity before it expires).

3. Legal Basis for Processing (GDPR)

For users in the European Economic Area (EEA), we rely on the following legal bases:

• Legitimate Interest — processing your inputs to generate story responses is necessary to provide the core game service you have chosen to use.
• Consent — by voluntarily saving a character, you consent to that data being stored in your browser's localStorage. You can withdraw consent at any time by deleting your saved characters (clear browser localStorage for this site) or clearing all site data from your browser settings.

4. How We Use Your Information

• To generate personalised AI story content during your quest.
• To generate AI scene artwork.
• To maintain continuity of your active quest session.
• To restore your saved characters and quest history across visits (stored entirely on your device).

We do not use your information for advertising, profiling, or any purpose other than operating the game.

5. Data Retention

• Session data — deleted from the server when your browser session ends or after approximately 20 minutes of inactivity.
• localStorage / IndexedDB — stored on your device indefinitely until you clear it. You can remove all saved data at any time via your browser's "Clear site data" option.
• Third-party data — subject to OpenAI's and Replicate's respective data retention policies.

6. Your Rights

Under GDPR and similar laws, you have the right to:

• Access — all character and quest data we store is on your device in your browser's localStorage/IndexedDB, fully accessible to you.
• Erasure ("right to be forgotten") — clear your browser's localStorage and IndexedDB for this site to delete all locally stored data. No personal data persists on our servers.
• Portability — your saved character data is plain JSON in localStorage, which you can read and export via your browser's developer tools.
• Object to processing — simply stop using the service. There is no account to delete.

For questions about third-party data (OpenAI, Replicate) please contact those providers directly.

7. Children's Privacy

Vibe Quest is not directed at children under the age of 13. Users select a content rating at the start of each quest, and it is the user's (or parent's/guardian's) responsibility to select age-appropriate settings. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has submitted personal information, please contact us and we will take steps to remove it from any systems under our control.

8. Cookies

We use a single, strictly-necessary session cookie to maintain your active game session. This cookie:

• Contains only an anonymous random session ID — no personal information.
• Is not shared with any third party.
• Is deleted automatically when you close your browser.
• Is not a tracking or advertising cookie.

No analytics, marketing, or third-party cookies are set by Vibe Quest.

9. Security

Your game data is transmitted over HTTPS. Server-side session data is held in memory only and never written to a database. We do not store API keys in client-side code.

10. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page will reflect any changes. Continued use of Vibe Quest after a change constitutes acceptance of the updated policy.

11. Contact

For privacy-related questions, please open a GitHub issue at github.com/zoink2000/VibeQuest.