Privacy Policy

Introduction

CrownForge LLC ("we," "us," or "our") operates multiple products and services, including Questwright (questwright.app), CrownForge Business Portal (crownforge.work/portal), and any future products accessible through your CrownForge account (collectively, "the Services"). This Privacy Policy explains how we collect, use, and protect your personal information when you use any of our Services.

We believe in transparency. We collect only what we need to provide our Services, we don't sell your data, and we'll tell you exactly what happens with your information.

Information We Collect

Account Information

When you create a CrownForge account, we collect:

• Username - Your unique login identifier
• Display Name - How your name appears to others
• Email Address (optional) - For account recovery
• Password - Stored securely using industry-standard hashing

OAuth Login Data

If you sign in with Discord, Google, or Twitch, we receive:

• Discord - Your Discord ID, username, and avatar URL
• Google - Your Google ID, email, name, and profile picture
• Twitch - Your Twitch ID, username, and profile picture

We only request the minimum permissions needed. We do not access your friends lists, server memberships, or any other data beyond basic profile information.

Content You Create

When you use our Services, we store content you create within each product. This may include:

• Questwright - Characters, campaigns, game sessions, NPCs, locations, and related game data
• Business Portal - Expenses, invoices, clients, projects, time entries, and uploaded documents
• Future Products - Content specific to each product as described in their documentation

Communications

When you use messaging and notification features, we store:

• Messages - Direct messages between users, party chats, and conversations
• Notifications - Alerts about activity, requests, announcements, and other events

Automatic deletion: Messages and notifications are automatically deleted after 30 days. Read notifications may be deleted sooner (after 7 days).

Usage and Cost Data

When you use AI-powered features, we log:

• AI request metadata - Which feature was used, which AI provider and model handled the request, and the number of tokens consumed
• Estimated cost - A calculated cost estimate for each AI request
• User association - Your user ID so we can attribute usage to the correct account

We do not log the content of your messages or the AI's responses in usage records. Usage logs contain only metadata and are used to manage platform costs, detect abuse, and ensure fair access for all users.

How We Use Your Information

We use your information to:

• Provide and maintain the Services
• Create and manage your CrownForge account
• Save your content and data across all products
• Generate AI-powered content where applicable
• Respond to support requests
• Send service-related communications (password resets, account notices)
• Improve the Services based on how they are used
• Monitor AI usage and associated costs to manage platform resources

We do not sell your personal information. We do not share your data with advertisers or third-party marketers.

Third-Party Services

Some CrownForge products use third-party AI providers to power features. The specific provider used for any given request may vary based on availability, cost management, and configuration.

Anthropic (Claude AI) - Primary Provider

When you use AI-powered features, your relevant content is sent to Anthropic's API to generate responses.

What Anthropic does NOT receive:

• Your email address, password, or account credentials
• Your OAuth login tokens
• Your IP address or location

Anthropic's data practices:

• API data is retained for up to 30 days
• API customer data is not used to train Anthropic's models
• See Anthropic's Privacy Policy for full details

Google (Gemini AI) - Secondary Provider

Google's Gemini AI may be used as a secondary provider for load balancing and cost management. The same types of data described above may be sent to Google's API.

Google's data practices:

• Gemini API data is not used to train Google's models when accessed via paid API
• See Gemini API Terms and Google's Privacy Policy for details

OAuth Providers

When you sign in with a third-party provider, you are subject to their respective privacy policies:

• Discord Privacy Policy
• Google Privacy Policy
• Twitch Privacy Notice

Data Retention

We retain your data for the following periods:

Data Type	Retention Period
Account information	Until you delete your CrownForge account, or 6 months of inactivity
User-created content	Until you delete it or your CrownForge account
Messages	30 days (automatically deleted)
Notifications	30 days unread, 7 days if read (automatically deleted)
AI usage logs	1 year

Account Deletion

You can request deletion of your CrownForge account at any time by contacting us. Because your CrownForge account provides single sign-on (SSO) access to all CrownForge products, deleting your account affects all Services. When you delete your account:

• Your CrownForge account and access to all Services is permanently removed
• All content you created across all products is permanently deleted
• Your contributions to other users' shared content are removed
• We may retain anonymous, aggregated statistics that cannot identify you

Data Security

We protect your data using:

• HTTPS encryption for all data in transit
• Secure password hashing (passwords are never stored in plain text)
• OAuth tokens that are securely managed and not stored long-term
• Database access restricted to essential services only

No system is 100% secure. While we take reasonable precautions, we cannot guarantee absolute security. If we become aware of a data breach affecting your personal information, we will notify you promptly.

Age Requirements and COPPA Compliance

CrownForge Services are only available to users 18 years of age or older, except where individual products specify a different minimum age (e.g., Crowncade allows users 13+).

In compliance with the Children's Online Privacy Protection Act (COPPA), we do not knowingly collect, use, or disclose personal information from children under 13. We verify age at registration through date of birth collection. If we learn that we have collected data from someone under the applicable minimum age, we will delete it promptly and terminate the associated account.

If you believe a child under 13 has provided us with personal information, please contact us immediately at [email protected].

Your Rights

You have the right to:

• Access - Request a copy of the personal data we hold about you
• Correction - Request correction of inaccurate data
• Deletion - Request deletion of your CrownForge account and associated data across all Services
• Data Portability - Request your data in a portable format
• Withdraw Consent - Unlink OAuth accounts or close your CrownForge account at any time

To exercise any of these rights, contact us using the information below.

Cookies

We use essential cookies only:

• Session cookies - Each CrownForge product may set its own session cookie to keep you logged in
• OAuth state cookies - Temporary cookies used during the login process for security

We do not use tracking cookies, advertising cookies, or third-party analytics cookies.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting the new policy on this page with an updated effective date. Your continued use of the Services after changes take effect constitutes acceptance of the updated policy.

Jurisdiction

CrownForge LLC is operated from Pennsylvania, United States. By using our Services, you consent to the processing of your data in the United States. If you are accessing from outside the US, please be aware that your data may be transferred to and processed in the US.