Privacy Policy

This policy explains how Anira (“we”, “us”) processes personal data when you use Forge at forge.anira.io (“the Service”). We are the data controller for this processing. Contact: toni@anira.io.

Account data. When you sign in with Google or GitHub we receive your email address, display name, and avatar from that provider. When you sign in by magic link we process the email address you enter. We assign your account an internal ID and a role.

Gameplay data. The text you type in the world, the actions you take, and the resulting game state (sessions, characters, items, events, in-game memories) are stored to run your game. Your in-game text is processed by third-party AI model providers to generate the world’s responses — do not enter personal data about yourself or others into the game.

Payment data. Purchases are processed by Stripe. We receive confirmation of the purchase (amount, currency, credits, a Stripe reference) but never your card details. We keep a record of your credit balance and purchase history.

Usage data. With your consent we collect analytics (pages viewed, feature usage, errors, session replays) via PostHog. If you decline, we collect only anonymous, cookieless usage statistics that are not linked to you (see section 6).

Technical data. Our servers and hosting providers process IP addresses and request logs as part of operating and securing the Service.

• To provide the Service: accounts, sign-in, running your game (contract).
• To process purchases and maintain credit balances (contract, legal obligations).
• To send sign-in emails you request (contract).
• To understand usage and improve the game — analytics (consent).
• To keep the Service secure and prevent abuse (legitimate interest).

We do not sell personal data and do not use it for third-party advertising.

We use these processors and services to run Forge:

• Google / GitHub — sign-in (their privacy policies apply to the sign-in step itself).
• Resend — sending magic-link sign-in emails.
• Stripe — payment processing.
• PostHog (EU Cloud) — analytics and error tracking, hosted in the EU.
• AI model providers — your in-game text and the surrounding game context are sent to third-party AI providers to generate character behavior and dialogue. This content is transmitted for processing, not for the providers’ own advertising.
• Hosting and infrastructure providers — running the servers and databases behind the Service.

Some providers process data outside the EU/EEA; where they do, transfers rely on safeguards such as the EU Standard Contractual Clauses or an adequacy decision.

Account and gameplay data are kept while your account exists. Game sessions and in-world state are ephemeral and may be deleted at any time as the Service evolves. Purchase records are kept as long as accounting law requires. Analytics data is kept per PostHog’s retention settings. When your account is deleted, associated personal data is deleted or anonymized unless we must keep it for legal reasons.

Strictly necessary. We set a session cookie to keep you signed in, and a cookie remembering your analytics choice. These are required for the Service to work and need no consent.

Analytics (optional). With your consent, PostHog sets cookies to recognize returning visits, measure feature usage, and record sessions so we can improve the game. If you decline, analytics runs in cookieless mode: no analytics cookies or identifiers are stored on your device, and events are anonymous and not linked to your account. You can change your mind at any time by clearing the site’s cookies and site data, which brings the consent banner back.

Under the GDPR (and similar laws) you can ask for access to your data, correction, deletion, restriction of processing, portability, and you can object to processing based on legitimate interest. Where processing is based on consent, you can withdraw it at any time without affecting past processing. Email toni@anira.io to exercise any of these rights — including deleting your account. You can also lodge a complaint with your local data-protection authority.

The Service is not directed at children and requires you to be at least 16 (or your country’s age of digital consent, if higher). We do not knowingly collect data from children below that age; if you believe we have, contact us and we will delete it.

We may update this policy as the Service evolves; the “Last updated” date above always reflects the current version. Material changes will be signposted in the Service or by email. See also our Terms of Service.