Privacy Policy

Universes ("we", "us", or "our") operates an AI-powered text adventure platform. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our service. We are committed to safeguarding your privacy and handling your data transparently.

We collect the following categories of information:

• Account Information: Your display name, email address, and password (stored as a secure hash, never in plain text). If you sign in via Google OAuth, we receive your name, email address, and profile picture from Google. Your display name is unique and permanent once set during registration.
• Profile & Preferences: Optional bio and profile image, your subscription tier, your marketing-email and product-update opt-in flags, two-factor-authentication status, the date your password was last changed, and your last-active timestamp.
• Age: We do not collect or store your date of birth. By signing up you confirm you are 18 or older; the platform is built for an adult audience and is gated only by that self-attestation plus the hard limits in the Terms.
• Adventure & Universe Data: Universes you create, including title, world description, world lore, generated world data, character data, full entry history, undo stack, and per-universe settings.
• AI Characters & Lorebooks: Characters you create or fork, including name, tagline, personality, backstory, appearance text, speech style, system prompt, scenario, greeting messages, example dialogue, category and tags, sampling configuration, lorebook entries, and per-character chat counters. When you upload an avatar, we also store an appearance caption — a short identity description generated once by Google Gemini 2.5 Flash from the avatar image — and the timestamp of any failed caption attempt.
• Character Chats: The full message history of every chat (user and assistant turns), the derived memory and editable summary, scenario overrides, author's notes, pinned message ids, persona references, and per-chat model and sampling overrides.
• Personas: Any user personas you author — name, description, and default flag.
• Image Generation History: For every image generation (pending, completed, or failed), we store the prompt, the chosen model, the resulting URL, the optional reference avatar URL, the generation status and any error message, and the calendar-month bucket key used to enforce the monthly cap.
• Uploaded & Generated Images: User-uploaded images (universe covers, character avatars) and AI-generated images are stored using Vercel Blob, a cloud-based object storage service, and served from public URLs.
• Social & Moderation: Follow relationships you create, reports you file or that are filed against you, and template votes you cast.
• Payment Information: Billing details are collected and processed entirely by Stripe. We store only your Stripe customer id, your Stripe subscription id, and your current period end date so we can route the right tier to your account. We do not store credit card numbers or full payment details on our servers.
• Usage Data: Session cookies, authentication tokens, daily prompt counts (split by universe vs. character message type), total tokens used, total prompts, total universes, and per-model usage counters used to enforce daily and monthly caps.

We use your information for the following purposes:

• To create and manage your account
• To provide and improve the text adventure and character chat experience
• To enforce daily message limits, monthly universe caps, and monthly image-generation caps
• To process payments and manage subscriptions through Stripe
• To send transactional emails (such as email verification codes) via Resend
• To generate AI-powered text by routing your prompts and stored chat context through the Vercel AI Gateway to Mistral models
• To generate character images by routing your prompts (and, when present, your character's avatar as an identity reference) through the Vercel AI Gateway to Black Forest Labs FLUX Kontext Max
• To generate the one-time avatar identity caption stored on each character, by sending the avatar URL to Google Gemini 2.5 Flash via the Vercel AI Gateway

We share data with the following third-party service providers, solely for operational purposes. Most AI traffic is routed through the Vercel AI Gateway, which proxies our requests to the underlying model providers (Mistral, Black Forest Labs, prodia, Google) using a single OpenAI-compatible endpoint. Vercel acts as a transit processor for those requests.

• Mistral AI (Mistral Small & Mistral Large 3): Routed via the Vercel AI Gateway. Your adventure and character chat content is sent to Mistral Small for interactive storytelling, memory extraction, and world evolution. Universe creation on paid tiers uses Mistral Large 3 (Drifter falls back to Mistral Small for creation). Mistral processes this data in accordance with their own privacy policy.
• Black Forest Labs (FLUX Kontext Max): Routed via the Vercel AI Gateway. Your image-generation prompts and, when present, the public URL of the character avatar (used as an identity reference) are sent to BFL for image generation on paid tiers. BFL applies its own safety filter and processes the request in accordance with their privacy policy.
• Google (Gemini 2.5 Flash + OAuth): Gemini 2.5 Flash is routed via the Vercel AI Gateway and is used to generate the one-time avatar identity caption stored on each character. Separately, if you choose to sign in with Google OAuth, Google shares your name, email address, and profile picture with us. Google's privacy policy governs how Google handles your data in both cases.
• Vercel Blob: User-uploaded images (universe covers, character avatars) and AI-generated images are stored using Vercel Blob and served from public URLs. Vercel processes this data in accordance with their privacy policy.
• Stripe: Handles all payment processing, subscription lifecycle (creation, renewal, cancellation), and the price reference used to grandfather existing subscribers. We store only your Stripe customer id, your Stripe subscription id, and your current period end date. Your payment information is governed by Stripe's privacy policy.
• Resend: Used to deliver transactional emails such as verification codes. Your email address is shared with Resend for this purpose.

We use cookies strictly for authentication and session management. When you log in (via email/password or Google OAuth), NextAuth sets a session cookie (authjs.session-token) to maintain your authenticated state. We do not set tracking cookies, advertising cookies, or third-party analytics cookies, and we do not currently display a separate cookie banner because the only cookies in use are strictly necessary for the service to function.

Your data is stored in our PostgreSQL database hosted securely. User-uploaded images are stored using Vercel Blob. We implement industry-standard security measures including password hashing, secure session management, and encrypted connections. While we take reasonable precautions to protect your data, no method of electronic storage is 100% secure.

We retain your data for as long as your account is active. We do not currently apply a time-based retention cap to chat history, adventure entries, or image-generation history — these grow with your account until you delete them or delete the account.

Export: You can download a full machine-readable export of your account data at any time from account settings. The export is a single JSON file covering your user record, accounts, sessions metadata, verification-code metadata, adventures, universe templates, template votes, AI characters and lorebook entries, character chats (including full message history and derived memory), personas, follow relationships, and reports. Password hashes, OAuth tokens, raw session tokens, raw verification code values, and embedding vectors are excluded for security.

Deletion: Drifter (free) accounts can self-delete from account settings. Deletion permanently removes your user record and cascades to your adventures, universe templates, characters, lorebook entries, personas, character chats, image-generation history, follows, reports, and embedding vectors.

Paid subscribers (Explorer, Voyager) must first cancel the Stripe subscription from account settings; the in-app delete control becomes available once the subscription has lapsed and the tier returns to Drifter. If you need account deletion before the period ends, contact us and we'll process it manually.

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: Request a copy of the personal data we hold about you.
• Rectification: Request correction of inaccurate personal data.
• Erasure: Request deletion of your personal data and account.
• Data Portability: Request your data in a portable format.
• Objection: Object to certain processing of your data.

To exercise any of these rights, please contact us at the address provided below. We will respond to your request within 30 days.

We do not sell, rent, or trade your personal data to third parties. Data is shared only with the service providers listed in Section 4, and only to the extent necessary to operate the platform.

Universes is an 18+ platform. You must be at least 18 years old to create or use an account. We do not collect or verify your date of birth — eligibility is established by your self-attestation at signup, combined with the platform-level safeguards in our Terms of Service.

We will never knowingly store the content of a minor. We do not knowingly collect personal information from anyone under 18. If we become aware that we have collected data from a minor, or that any chat, character, image, or other artifact on the platform involves a minor in a manner prohibited by our Terms (§8), we will remove that content and the responsible account from our systems and from our backups, and we will report to law enforcement when applicable law requires it. If you become aware of any such content, report it to us immediately.

Universes permits adult content (including consenting-adult sexual content, conflict, darkness, and morally complex scenarios) within universe adventures and character chats. There is no opt-in toggle and no per-character content rating — every chat is treated the same. All characters involved in such content must be depicted as adults (18+). User-generated content is processed by our AI providers (Mistral via Vercel AI Gateway for text; BFL FLUX Kontext Max via Vercel AI Gateway for images) in the same manner as other content.

Prohibited content as listed in our Terms (§8) — including sexual content involving minors, detailed self-harm instructions, and real-world violence or weapons instructions — is not permitted, and the AI models are instructed to refuse such requests. Image-generation prompts mentioning minors are rejected by an input filter before any provider sees them. We do not manually review or monitor private adventure or chat content. We reserve the right to remove content that violates our Terms of Service.

We may update this Privacy Policy from time to time. When we make significant changes, we will notify you by posting the updated policy on this page and updating the "Last updated" date. Your continued use of the service after changes constitutes acceptance of the updated policy.