Privacy Policy

Last updated: August 28, 2026

Overview

This policy explains what Fabulator, operated by Mystery Digital Limited, collects, how it's used, and the choices you have when playing or authoring on the platform.

Data we collect

We collect the minimum information needed to run the app and keep your campaigns available across sessions.

• Account data, such as your email address.
• Content you create or generate through play — campaigns, characters, World Seeds, and related metadata, including narration generated during your sessions.
• Aggregate usage counters (see Analytics below) to keep the app reliable.

How we use your data

We use your data to provide and improve the service, and to keep it secure.

• To provide core functionality like sessions, narration, and campaign sync.
• To understand aggregate usage and fix bugs.
• To prevent abuse and protect accounts.

AI narration and your content

Fabulator's narrator and rules engine run on AI providers you choose and configure yourself (bring-your-own-key), not a single house model that Fabulator operates for everyone.

• Your campaign context is sent only to the AI provider you've configured, solely to generate narration for your own turns.
• Your provider API key is encrypted on your device before it reaches our servers. We store only the encrypted blob and never see or log the plaintext key.
• Story details the narrator proposes during play (such as new lore) may be automatically added to your campaign's canon at low priority, with an optional review step to accept or revert them.
• Mechanical outcomes like dice rolls and rule checks are resolved by a sandboxed rules engine running on our servers, which never queries external services directly.

Analytics

We use first-party, self-hosted metrics to understand aggregate usage of the app — we do not use any third-party analytics vendor.

• Aggregate event counts, such as how often certain pages or actions are used.
• These counters do not include your account ID, email address, or campaign/World Seed identifiers.

Sharing

We do not sell your personal data. We may share limited information only in the situations below.

• With infrastructure providers who help us host the app and store data.
• With the AI provider you configure via bring-your-own-key, solely to generate narration for your own sessions, under that provider's own terms.
• If required to comply with law or to protect the rights and safety of users.

Security

Bring-your-own-key credentials are encrypted on your device before storage, and our servers never see the plaintext key. Beyond that, we use reasonable measures to protect your data, but no method of transmission or storage is completely secure.

Bot protection (Cloudflare Turnstile)

We use Cloudflare Turnstile in invisible mode on sign-up, sign-in, and password-reset forms to protect the service from automated abuse.

• Provider: Cloudflare, Inc. Turnstile runs silently in the background without a visible challenge in most cases.
• Turnstile may collect your IP address and browser/device signals (such as user agent and interaction patterns) to distinguish humans from bots. This data goes to Cloudflare, not to Fabulator.
• This processing is based on our legitimate interest in keeping the service secure and free of automated abuse; see Cloudflare's own privacy policy for how they handle this data.

Retention

We keep your data for as long as your account is active or as needed to provide the service, and for legitimate business or legal purposes.

Your choices

Depending on your location, you may have rights to access, export, or delete your data.

• Access and review your account information.
• Request deletion of your account and associated data.
• Export your campaign data.

Contact

If you have questions about this policy, contact us through the support option in the app.