Privacy Policy — Lorebound

Last updated: July 8, 2026

⚠️ Template notice (delete before publishing): This document is a tailored starting point, not legal advice. Because Lorebound is operated by a company, processes personal data of EU residents, and permits users as young as 13, have this reviewed by a qualified lawyer before you rely on it. Fill in every [BRACKETED] placeholder.

This Privacy Policy explains how Crested Tamarin LLC, doing business as MadAboutSoftware ("we", "us", "our"), the operator of the game Lorebound and the website lorebound.gg (together, the "Service"), collects, uses, and protects your personal data.

We are the data controller for the personal data described here. If you have any questions, contact us at admin@lorebound.gg.

1. Summary (the short version)

• We collect the minimum we need to give you an account and save your game progress: your email address, a display name, your language preference, and your in-game progression (characters, skills, inventory, story progress).
• We sign you in with Google or an email/password, handled by our authentication provider, Supabase.
• We never send Claude/AI any of your data, and we do not use your data to train AI models. All game content is authored in advance; there are no AI model calls while you play.
• We do not sell your personal data.
• We use essential cookies to keep you signed in, and — with your consent — analytics cookies to understand how the Service is used.
• You have rights over your data, including access and deletion. See Section 9.

2. Who we are

The Service is operated by Crested Tamarin LLC, doing business as MadAboutSoftware, a limited liability company organized under the laws of the State of Florida, USA (Florida document number L22000173456), with a principal address at 2980 McFarlane Rd, Miami, FL 33133.

Contact for privacy matters: admin@lorebound.gg.

3. What data we collect

3.1 Data you give us

3.2 Data generated by playing

• Game progression: your characters, levels, XP, stats, skills, inventory, in-game currency ("coins"), story and quest state, and similar save data.
• These are tied to your account so your progress persists across sessions and devices.

3.3 Data collected automatically

• Authentication cookies (essential): a session cookie set by our auth provider to keep you signed in, and a lang cookie storing your language so the interface doesn't flash the wrong language on load.
• Technical/log data: IP address, browser and device type, operating system, and timestamps, collected by our hosting and infrastructure providers for security, abuse prevention, and reliability.
• Bot-verification challenge: when you sign in as a guest ("Play now"), we run a Cloudflare Turnstile challenge to confirm you're not an automated script. Cloudflare processes your IP address and device/browser signals to solve the challenge; we never receive your Turnstile answers, only a pass/fail token.
• Analytics data (with your consent, where required): pages/screens viewed, session length, features used, and general usage patterns, so we can improve the game. See Section 7 (Cookies).

3.4 What we do not collect

• We do not knowingly collect data from anyone we know to be under 13 (Section 8).
• We do not process special-category data (e.g., health, biometric, or political data).
• We do not run any AI/LLM model calls on your data at runtime, and we do not use your data to train AI models.

4. How we use your data (and our legal bases)

Where the GDPR (or equivalent law) applies, we rely on the following legal bases:

You can withdraw consent (e.g., for analytics) at any time without affecting your ability to play; see Sections 7 and 9.

5. Who we share data with (processors & sub-processors)

We do not sell your personal data. We share it only with service providers ("processors") that help us run the Service, under contracts that require them to protect it and use it only on our instructions:

Our analytics are first-party and built in-house — we do not use a third-party analytics provider and do not share your usage data with any analytics company or ad network for that purpose.

We may also disclose data if required by law, to enforce our Terms, or to protect the rights, safety, and security of our users or the Service. If we are ever involved in a merger, acquisition, or asset sale, data may be transferred as part of that transaction; we will notify you of any change in control.

Keep this list current. Add each real sub-processor and, ideally, publish a separate up-to-date sub-processor list you can link to.

6. International data transfers

We are based in the United States, and our providers may process data in the United States and other countries. If you access the Service from the EEA, the UK, or elsewhere, your personal data will be transferred to and processed in the United States, where data-protection laws may differ from those in your country. Where we transfer personal data out of the EEA or UK, we rely on appropriate safeguards such as the European Commission's / UK's Standard Contractual Clauses or an adequacy decision. You can request details of these safeguards using the contact in Section 2.

7. Cookies and similar technologies

We use a small number of cookies and similar technologies:

• Strictly necessary (always on): the authentication/session cookie that keeps you signed in, and the lang cookie that remembers your language. The Service cannot function without these, so they are not subject to consent.
• Analytics (optional): our analytics are first-party and built in-house (no third-party analytics provider or ad network). Where consent is required, we collect analytics only after you consent, via a cookie banner or settings control, and you can change or withdraw your choice at any time.

You can also block or delete cookies in your browser settings, though blocking essential cookies will prevent you from signing in.

Before relying on the analytics language above, wire a consent banner (or settings toggle) that actually gates the in-house analytics, and list here the specific first-party cookies/identifiers you set.

8. Children's privacy

The Service is intended for users aged 13 and over. Consistent with the US Children's Online Privacy Protection Act (COPPA), we do not knowingly collect personal data from children under 13. If you are under 13, please do not use the Service or provide any personal data.

Depending on where you live, the minimum age to consent to data processing may be higher (for example, up to 16 in parts of the EU). Where a higher age applies and you are below it, a parent or guardian must provide consent on your behalf.

If you believe a child under 13 has provided us with personal data, contact us at admin@lorebound.gg and we will delete it.

9. Your rights

Subject to your local law (including the GDPR, UK GDPR, and similar laws), you may have the right to:

• Access the personal data we hold about you;
• Rectify inaccurate or incomplete data;
• Erase your data ("right to be forgotten");
• Restrict or object to certain processing;
• Port your data to another service in a structured, machine-readable format;
• Withdraw consent at any time (e.g., analytics), without affecting prior lawful processing;
• Lodge a complaint with your local data protection authority.

To exercise any of these, contact admin@lorebound.gg. You can also delete your account at any time from the in-game Profile panel, which removes your account and associated game data (subject to the retention exceptions below).

We will respond within the timeframe required by law (generally one month under the GDPR). We may need to verify your identity before acting on a request.

9.1 US state privacy rights (California and other states)

If you are a resident of California or another US state with a comprehensive privacy law (such as Colorado, Connecticut, Virginia, or Utah), you may have the right to know what personal information we collect, to access or delete it, to correct it, and to not be discriminated against for exercising these rights.

• We do not "sell" your personal information, and we do not "share" it for cross-context behavioral advertising, as those terms are defined under California law. We have not sold or shared personal information in the preceding 12 months.
• We do not use or disclose sensitive personal information beyond the purposes permitted under applicable law.
• To exercise your rights, contact admin@lorebound.gg. You may use an authorized agent, and we will not discriminate against you for exercising your rights.

The categories of personal information we collect, our purposes, and the parties we disclose to are described in Sections 3–5 of this policy.

10. Data retention

• We keep your account and game data for as long as your account is active.
• If you delete your account, we delete or anonymize your personal data within [e.g., 30 days], except where we must retain certain data to comply with legal obligations, resolve disputes, prevent abuse, or enforce our agreements.
• Backups containing your data are purged on our normal backup rotation, after which the data cannot be restored.

11. Security

We take reasonable technical and organizational measures to protect your data, including encrypted connections (HTTPS), hashed passwords, database access controls (row-level security), and server-authoritative validation of anything that affects your account. No system is perfectly secure, so we cannot guarantee absolute security. If we become aware of a data breach affecting your personal data, we will notify you and the relevant authorities as required by law.

12. Changes to this policy

We may update this Privacy Policy from time to time. If we make material changes, we will notify you through the Service or by email before the changes take effect where required. The "Last updated" date at the top shows the latest revision. Continuing to use the Service after changes take effect means you accept the updated policy.

13. Contact

Crested Tamarin LLC (d/b/a MadAboutSoftware) 2980 McFarlane Rd, Miami, FL 33133 Florida, USA Email: admin@lorebound.gg

If you are in the EEA/UK and have concerns we cannot resolve, you may contact your local data protection supervisory authority.