Privacy Policy

Wendfar is run by Wendfar, a company registered in the United Kingdom. We are the data controller for the personal data described here, which means we decide what is collected and why. You can reach us about anything in this policy at [email protected]. This policy covers the Wendfar website and app; it does not cover other sites we link to.

Account

Your email address, your name if you gave one, and your sign-in method (password or a social login). These are held by our sign-in provider; our own database stores only the account identifier it gives us.

Your play

Every session you play: your actions, the narrator’s replies, questions you ask the game master, regenerated variants until you move on, the memories Wendfar writes down, session summaries, and any author’s note. Also a per-turn record of which cards and memories were used, kept so the context inspector can show you.

Your creations

Worlds, cards, lore, links, tags and the images you upload for them. Images are re-encoded on upload and every embedded tag (camera, location, and so on) is discarded before storage.

Billing

Your plan, its status and renewal date, your credit balance and a ledger of every grant and spend with the token counts and cost behind it, plus the customer and subscription identifiers our payment provider assigns you. The payment provider holds your card; we never see the number.

Support and reports

Support tickets and their messages, and any content reports you file or that are filed about your published content.

Settings

Your chosen narrator and its sampling settings, bookmarks, per-session reading and mode preferences.

Technical

Our own code stores no IP addresses or browser details. The providers that host and secure Wendfar (listed below) keep ordinary request logs that include your IP address and browser, for a limited time, as any web host does. We use no analytics or advertising trackers.

Your play is private. Sessions are visible only to you. Nothing you write or the narrator writes in a session is ever shown to another player, listed on Discover or made public in any way. Publishing applies to worlds and cards you choose to submit, never to sessions or memories.

Nobody reads your play. Session transcripts are stored so that you can return to them, and no member of staff reads them. There is no review of private sessions, routine or random, by people or by automated systems.

The only exceptions. A person at Wendfar will open a session only when it is absolutely required: to act on a report that the Content Policy was broken, to comply with a legal obligation, or because you asked us to look at that session in a support request. When that happens we look at what is needed for that purpose and nothing else.

We do not train AI on your stories. We never use your play to train or tune a model. For most narrators and all background work we attach an instruction to every request that bars the model provider from storing the prompt or training on it. A few narrators run on a provider’s own service where we cannot attach that instruction; those requests are governed by that provider’s terms, and the next section says what that means.

To write a turn we must send the model a prompt. That prompt contains your world’s rules and lore, your character, the cards and memories relevant to the scene, the recent messages of the session and your new action. The same is true of the background work: writing memories, summarising a session, ranking what to remember, drafting a card, checking that a character is an adult, and turning text into search embeddings.

• Through a routing service. Most narrators and all background work go through a service that routes each request to a model provider. Every request we send carries an instruction that forbids routing to any provider that would store the prompt beyond the request or use it for training, and we do not allow fallback to providers outside that rule.
• Directly to a provider. Some narrators run directly on a model provider’s own service, because that is the only way to run them in the mode that makes them good. We cannot attach our no-storage, no-training instruction to those requests; they are governed by that provider’s own terms, and the provider may be based outside the United Kingdom. Narrators are shown by persona, not by vendor; write to us if you want to know which narrators work this way, and pick another narrator if that matters to you.

Prompts are sent to write an answer and are not kept by us beyond the session record you already have. Your account identity is never sent to a model provider; they receive the text of the prompt, not who you are.

UK data protection law asks us to say which legal basis each use rests on.

Running Wendfar

Signing you in, storing and replaying your sessions, writing turns and memories, showing you the context inspector, hosting your worlds and cards. Basis: performing our contract with you.

Billing

Charging your plan, granting and deducting credits, handling payment events, keeping the ledger that reconciles cost against credits. Basis: contract, and our legal duty to keep financial records.

Support

Answering tickets and emails, which may involve opening the session you asked about. Basis: contract.

Safety and moderation

Reviewing content submitted for Discover, acting on reports, checking that character cards describe adults, enforcing the Terms, rate-limiting abuse. Basis: our legitimate interest in keeping Wendfar lawful and safe, and legal obligations.

Improving the service

Reading aggregate usage and cost figures (how many turns, which narrators, what they cost) to tune plans and limits. This uses numbers, not your prose. Basis: legitimate interest.

Contacting you

Emails about your account, billing, and material changes to these documents. We do not send marketing email. Basis: contract and legitimate interest.

We do not sell personal data, and we share it only with the service providers below, each of which processes it on our instructions to run Wendfar. Most are based in the United States; see the transfers section.

Sign-in

Account records and the cookie that keeps you signed in.

Payments

Subscriptions, invoices, receipts and the billing portal. We pass it your account identifier and email so the checkout is yours.

Database and hosting

The database that holds everything listed above, and the servers that deliver the site and app, with ordinary request logs.

Image storage

Storage and delivery of uploaded images. They are served at an unguessable address; anyone with the address can load the image, so treat card art as something that could be seen.

Model providers

The routing service and the model providers described above. They receive prompt text and nothing that identifies you.

We may also disclose data where the law requires it, to a court, regulator or law enforcement body with a lawful request, to protect someone from serious harm, or to a successor if Wendfar is sold or merged, in which case this policy continues to apply.

The providers above are established outside the United Kingdom, mostly in the United States. Where a transfer leaves the UK we rely on the safeguards the law recognises: the UK’s adequacy arrangements where they apply, and otherwise the provider’s standard contractual clauses with the UK addendum. Ask us at [email protected] if you want a copy of the safeguard for a particular provider.

Wendfar sets no cookies of its own. The only cookies are the ones our sign-in provider sets to keep you signed in, which are strictly necessary for the service and are why there is no cookie banner: we use nothing that would need your consent. Our payment provider sets its own cookies on its checkout and billing pages, which are on its own domain.

Your browser’s local storage holds a few conveniences that never leave your device: your reading text size, whether new text animates, and the unsent draft in the composer for each session so a reload does not lose it. Clearing site data removes them.

Sessions and memories

Until you delete them, or the world they belong to. Ending a session keeps it readable in the world’s history.

Worlds and cards

Until you delete them. A trashed world or card can be restored for 30 days, then it and everything inside it (sessions, memories, images no longer used elsewhere) is permanently removed.

Account

Until you close it. Closing an account deletes your worlds, sessions, cards, memories, settings and support tickets, and removes your account from our sign-in provider.

Billing records

Six years after the transaction, as UK tax and accounting law requires. These are kept even after you close your account and are then held only for that purpose.

Moderation records

Reports, moderation decisions and the reason for a ban are kept for as long as needed to enforce them, including to stop a banned person returning.

Backups

Database backups held by our hosting provider expire on a rolling schedule measured in days to a few weeks; deleted data leaves backups when they expire.

Provider logs

Request logs held by our sign-in, hosting and image providers expire on their own short schedules.

• Content: delete any world or card yourself from your Library. Inside a session you can delete messages from the end, remove an ask, and edit or delete any memory.
• Published copies: unpublishing takes your item off Discover. Copies other players already imported are theirs and are not deleted.
• Your account: write to [email protected] from your account email, or open a support ticket, and ask for the account to be closed. We do it by hand within 30 days and confirm when it is done. Billing and moderation records are kept as described above.

Under UK data protection law (and the GDPR if you are in the European Union) you can ask us to:

• tell you what personal data we hold about you and give you a copy;
• correct anything inaccurate;
• delete your data, subject to the records we must keep;
• restrict or object to a particular use, where the basis is legitimate interest;
• give you your data in a portable form;
• withdraw consent, where consent is the basis (it currently is not, for anything).

Write to [email protected] from your account email. We answer within one month and do not charge. If you are unhappy with our answer you can complain to the Information Commissioner’s Office at ico.org.uk, or to the data protection authority where you live.

We do not make automated decisions with legal or similarly significant effects about you. The one automated check we run is whether a character card describes an adult; a blocked card can be edited and resubmitted, and you can ask a person to look.

Data is encrypted in transit and at rest with our providers. Model keys and payment secrets live only on the server. Access to the admin tools that can open sessions is limited to our team and is gated on a separate role. No system is perfectly secure; if we learn of a breach that puts your data at risk we will tell you and the regulator as the law requires.

Wendfar is for people aged 18 and over and we do not knowingly collect data from anyone younger. If you believe someone under 18 has an account, tell us at [email protected] and we will close it and delete its data.

When we change how we handle your data in a way that matters (a new provider that sees your text, a new purpose, a longer retention) we will tell you by email or a notice in Wendfar before it takes effect. Smaller changes take effect when posted. The date at the top is the current version’s.

Wendfar, United Kingdom. For anything about your data: [email protected].