Privacy policy

MAKEMEWEB SRL (makemeweb.net), Avenue de la Couronne 236B, 1050 Bruxelles, Belgique (see the legal notice). Contact: [email protected] or the contact form (topic “Personal data”)..

• Account: username, e-mail address, password (stored hashed, never in clear text), role, sign-up and sign-in dates.
• Player profile (optional): alias, avatar, bio, experience level, city and country, availability.
• Game content: worlds, campaigns, sessions, events, characters, documents, images and files you publish.
• Private messages and notifications between the members of a campaign.
• AI assistant (optional): your instructions, the items of your world you choose to send, the answer produced, the number of tokens used and your monthly usage.
• Subscription and payments: plan, dates, amounts, tax applied and billing country, promo codes used, payment status and your customer id at Stripe. Your billing address is entered at Stripe, which prints it on the invoice. Your bank details are entered at Stripe and never go through our servers.
• Online presence: the members of a campaign see when another member is connected to the table.
• Messages from the team: when the team writes to you from the back-office (maintenance notice, reply to a request, information about a subscription…), we keep the subject, the text and the date it was sent. Once your account is deleted, that message is no longer linked to you.
• Referrals: every account has a referral code; if you sign up with somebody’s code, we record that link. A code’s owner only sees how many accounts signed up with it, never which ones.
• Contact form: name, e-mail address, topic and message, and your account id if you are signed in.
• Technical data: server connection logs (IP address, date, page requested), needed for security.

We do not ask for any sensitive data. Please don’t publish any in your game content.

• Creating and managing your account, running campaigns, messages and notifications: performance of the contract (the Terms).
• Sending service e-mails (sign-up confirmation, password reset, subscription due date, AI assistant result): performance of the contract.
• Managing your subscription, collecting payments and providing the AI assistant: performance of the contract.
• Crediting referral codes (members’ achievements, partner sellers’ commissions): legitimate interest in rewarding recommendations.
• Answering your requests through the contact form: legitimate interest in replying to you.
• Securing the Service and fighting abuse and bots (logs, reCAPTCHA, rate limits), and monitoring the usage, quality and cost of the AI assistant: legitimate interest.
• Keeping connection data and accounting records, and answering requests from the authorities: legal obligation.

No data is used for advertising, sold or used for profiling.

• Other Users, as you choose: a GM sees the profile of the players they invite; the members of a campaign see each other’s profile and character; players only see the parts of the world the GM revealed to them.
• Our processors, strictly to run the Service: the host (Amazon Web Services (AWS)) and the e-mail provider (Amazon Web Services (AWS)).
• Google (reCAPTCHA), to protect sign-up and the contact form from bots.
• Mistral AI (France), our AI provider, only when you use the assistant: it receives the context items you chose and your instructions.
• Stripe (Stripe Payments Europe, Ireland), for payment and invoicing.
• The Service’s administration team, who can view requests sent to the AI and payments, for support, abuse prevention and accounting.
• Authorities, upon lawful request.

Google, Stripe and some of our providers’ subprocessors may process data in the United States. These transfers rely on the EU–US Data Privacy Framework or on the European Commission’s standard contractual clauses.

• Account, profile and content: as long as the account exists. An account inactive for 3 years is deleted, after a warning e-mail.
• After an account is deleted: your personal data (e-mail, name, password, profile, notifications) is erased immediately. The content you created stays, signed “Compte supprimé”, for 90 days at most so that other players’ games are not broken, then is deleted.
• Referral link: kept without personal data (ids and the code only) for commission accounting; the code of a deleted account is switched off, then erased at purge.
• Requests sent to the AI assistant (instructions, context sent, answer): as long as the account exists; erased with the personal data when the account is deleted.
• Payments and invoices: 10 years, under accounting obligations; once the account is deleted these records have no link to you any more and the Stripe customer is kept without name or e-mail.
• Contact form messages: 12 months after the request has been handled.
• Connection logs: 1 year.
• Sign-ups never confirmed: deleted after 30 days.

Chronicarium uses no advertising cookies and no audience measurement. Your browser stores locally:

• your sign-in tokens, to keep you signed in;
• your theme (light or dark) and language choice, the latter also in a “locale” cookie that lets the server redirect you to the right language;
• a few interface preferences (collapsed menu, ticked tutorial steps, plan chosen before signing up).

These are strictly necessary to the Service and need no consent. Fonts are hosted on our own servers: no IP address is sent to a third-party font service.

Google reCAPTCHA is only loaded once you start filling in the sign-up or contact form. It may then set its own cookies to tell humans from bots (see Google’s policy).

Exchanges are encrypted (HTTPS), passwords hashed, payments handled by Stripe without your bank details going through our servers, and private images and files only reachable by authorised members. In case of a data breach presenting a risk, the Data Protection Authority and the people concerned will be informed within the legal deadlines.

You have the rights of access, rectification, erasure, restriction, objection and portability, and the right to give instructions on what happens to your data after your death. Much of this can be done from your profile; for the rest, write to us through the contact form (topic “Personal data”) or at [email protected]. We answer within one month; proof of identity may be requested if in doubt.

You can also lodge a complaint with the Belgian Data Protection Authority (autoriteprotectiondonnees.be) or with the authority of your country of residence (in France, the CNIL).

The Service is meant for people aged 15 and over. Below that age, signing up requires the consent of a holder of parental authority.

This policy may change; the date of the last update is shown at the top of the page. You will be notified of any significant change.