Privacy policy

Data controller

Théophile Branche, entrepreneur individuel, 11 Yrond, 63390 Saint-Gervais-d'Auvergne, France.

For any question about your data: support@icotale.com. Icotale has not appointed a data protection officer; this address is read directly by the data controller.

Data processed

Account: email address, nickname, friend code, language, avatar if you add one, age confirmation, encrypted password or linked account identifier (Discord, Google, Apple).

Game: tables and invitations, characters, declarations, messages and images shared at the table, stories, reviews, reports, friends and groups, Studio creations.

Purchases: packs bought, amounts, payment status, Dice movements; for the welcome Die, an irreversible hash of the card. Card numbers are processed by Stripe, never by Icotale.

Technical: IP address and browser of login sessions, technical request logs, Narrator usage log (amount of text and cost per session).

Purposes and legal bases

Providing the game, your account and the Studio (performance of the contract); collecting payments and keeping accounts (legal obligation); securing the service, preventing fraud and abuse, moderating content and handling reports (legitimate interest and legal obligation); sending you the emails your account needs (performance of the contract); tracking the Narrator’s cost to keep prices fair (legitimate interest). No advertising, no commercial profiling, no sale of data.

The Narrator writes the story from your declarations; it takes no decision with legal effects concerning you. The tool that helps sort reports never decides: a person does.

Providers and recipients

Anthropic (United States), provider of the Narrator’s language model: receives the game context, character sheets and declarations, without your email address. Its commercial terms exclude using this data to train its models.

OpenAI (United States): paints Studio covers from a description of the universe, with no data about you.

Stripe (Ireland, United States): registration of the welcome Die card; for Dice purchases, Link, its payment service, acts on its own behalf as merchant of record.

OVH (France): hosting of the service and sending of emails.

Discord, Google and Apple: if you choose to log in with them, they send us your identifier and email address, and act on their own behalf.

Transfers outside the European Union

Anthropic, OpenAI and Stripe may process data in the United States. These transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s standard contractual clauses.

Retention periods

Account: as long as it exists. When it is deleted, your identification data is erased; your published universes stay online under an anonymous author.

Game logs (rounds, declarations, rolls, messages, stories): 12 months.

Notifications: 6 months.

Reports and closed moderation cases: 12 months.

Login sessions (IP, browser): 30 days after they expire.

Narrator usage log: 24 months.

Irreversible hash of the welcome Die card, never its number: 3 years after the account is deleted.

Payments and Dice movements: 10 years (accounting obligation).

These periods are applied automatically every night.

Your rights

You can access your data and download it in a reusable format (My account, “Download my data”), correct it, erase it by deleting your account, object to processing based on legitimate interest or ask for it to be restricted, and set instructions for what happens to it after your death. Write to us at support@icotale.com: we reply within one month.

You can also lodge a complaint with the CNIL (cnil.fr) or your local data protection authority.

Minors

Icotale is open from the age of 15, the age at which a minor can consent alone to the processing of their data in France. Universes are age-rated, and those meant for an older audience stay hidden without confirming you are 18.

Cookies and local storage

Icotale only uses trackers needed for the service: session cookies (icotale_at, icotale_rt) and a language cookie, and, in your browser, the music volume setting and the installable app’s files. No advertising or audience measurement cookies: these trackers are exempt from consent, so no banner is shown.

Security

Encrypted passwords (Argon2), protected session cookies (httpOnly), encrypted connections (HTTPS), limits on login attempts, back-office accounts kept separate from player accounts. Players’ texts are passed to the Narrator as data, never as instructions.