Privacy Policy

1. Who we are

Paracosm Studio is a worldbuilding workspace for creating and organising maps, worlds, wiki entries and stories. It is operated by Louis Goldsbrough, trading as Firethorn Digital, the controller of personal information described in this policy.

For privacy questions or requests, contact support@paracosmstudio.io. Our business contact address is 35 Ringway, Bolton upon Dearne, S63 8BN.

2. Information we collect

• Account and profile: your email address, account identifier, sign-in details and the names, display name and profile picture you provide. Email/password authentication is handled by Supabase Auth. We also record the terms version you accept, when you accept it, and your confirmation that you meet the age requirements.
• Google sign-in: your Google account identifier, email address and basic profile information, such as your name and profile picture, when supplied by Google.
• Your workspace: the worlds, maps, writing, wiki entries, uploaded media, preferences and other content you save. Creative content may contain personal information if you put it there.
• Sharing: the content and creator/display name you select for a shared view, its access settings, and recipient email addresses if you restrict a link to invited accounts.
• Support and reports: messages, content reports, appeals, feedback, ratings and screenshots or files you choose to submit. The public support form prepares an email in your email app; it does not itself submit a report. A shared-world link is included only if you choose to include it. Please avoid including unnecessary personal or sensitive information.
• Service and security records: account-linked service events, feature and release identifiers, relevant world/job identifiers, and access or security records. Hosting and authentication providers may also process connection information such as IP addresses and browser details.
• Optional usage analytics: feature names, screen views, visible screen duration and associated account/session identifiers when you opt in. These events do not include your creative text or free-form feedback.

3. How we use information

We use information to create and secure accounts, provide and save your workspace, restore your sessions and preferences, deliver sharing you request, answer support requests, investigate content reports and appeals, investigate faults and operate the service.

We rely on the following legal bases, according to the purpose of the processing:

Information needed for an account and saved cloud workspace is required to provide those features. Optional profile pictures, analytics, feedback and promotional permissions are not required to use an account.

4. Sign in with Google

Google sign-in is optional. We use its basic identity and profile information to authenticate you, associate your session with your Paracosm account and populate your profile. This integration requests OpenID, email and basic profile access. It does not request access to your Gmail, Google Drive, Calendar or Contacts.

Supabase handles the sign-in exchange and the Paracosm session. Where Supabase’s verified-identity rules permit, a matching email address can link Google sign-in to an existing account. Using a different email address may create a separate account.

Google information obtained for sign-in is not used for advertising or AI model training. Our use and transfer of information received from Google APIs will comply with the Google API Services User Data Policy, including its Limited Use requirements.

You can remove the app’s access through your Google account connections. Removing that access does not itself delete your Paracosm account or saved worlds. Contact us for account or data-deletion requests; sign out of existing Paracosm sessions separately.

5. Who can see your information

Your creative work is not made public simply because you sign up. Publishing a shared view makes the selected snapshot available according to the access option you choose. A link-access view can be read by anyone who obtains its link; invited-only access requires an eligible signed-in account. Readers may copy, capture or redistribute anything they can view. Revocation stops future access through the service but cannot recall copies.

Authorised staff may access relevant account, workspace and support information to provide support, administer the service, protect it or investigate faults. Promotional showcasing is a separate permission from operational staff access.

Uploaded profile pictures use a public-read storage location: people who have the picture’s URL can view it. Do not use a sensitive image as your profile picture.

We use service providers to host and operate Paracosm. Confirmed core services are Supabase for authentication, database and storage, and Vercel for application hosting. Google processes sign-in information when you use Google sign-in. Bundled web fonts are served from Paracosm’s own hosting; displaying them does not make a separate Google Fonts request. Media you choose to load from another website can disclose connection information to that website.

Where service email delivery is enabled, an email provider may process the information necessary to deliver it. We use providers to operate the service, rather than granting them permission to use your private creative work for their own promotion. We may disclose information when legally required or where necessary and lawful to protect users and the service.

6. Browser storage and analytics

Paracosm uses browser storage, including local storage and IndexedDB, for sessions, settings, locally saved work and pending uploads. Clearing browser data can remove local-only work. Signing out does not necessarily erase all cached workspace data from the device, so use a trusted device and review its stored data before sharing or disposing of it.

When signup requires email confirmation, a selected profile picture may be retained in that browser for up to seven days to complete its upload after login. It is not a password or token queue.

Optional product analytics are off by default and are enabled through your creator preferences. You may withdraw that consent in the app. Essential service diagnostics and provider security logs are separate from optional analytics.

7. Retention and deletion

We retain account details and cloud creative work while needed to provide your account and workspace. You can ask us to delete your account or personal information using the contact above. We assess and respond to verified requests within applicable legal time limits.

Support messages and evidence are retained for as long as needed to resolve the request and deal with related disputes. Service, security and audit records are retained for as long as needed to investigate faults or abuse, secure the service and meet legal obligations. We review retention against those purposes. Terms-acceptance records may be retained where needed to establish which agreement applied or deal with a legal claim.

Deletion from active systems may not immediately remove copies from backups or provider logs. Those copies remain subject to the provider’s retention arrangements and are not kept as an alternative active account. Where a lawful exception requires us to keep information, we limit it to what is necessary and explain the exception where appropriate.

Removing Google access, revoking a shared link and deleting a whole account are separate actions. Contact us if you need help identifying the correct one.

8. Storage locations and transfers

Our primary Supabase database is hosted in Ireland. This does not mean every provider, log, backup or support operation is confined to Ireland. Hosting, authentication and support providers may process information in other countries. Where UK transfer restrictions apply, the applicable provider arrangements must supply an appropriate transfer mechanism, such as an adequacy decision or approved contractual safeguards. Contact us for information about the arrangements relevant to your data.

9. Your choices and rights

Depending on the circumstances and applicable law, you may request access to, correction or deletion of personal information; restrict or object to processing; obtain a portable copy of eligible information; and withdraw consent without affecting earlier lawful processing. Some rights have conditions or lawful exceptions.

You can edit profile information and privacy preferences in the app. For other requests, use the privacy contact above. We may need proportionate information to verify your identity. You can also complain to the UK Information Commissioner’s Office or the supervisory authority applicable to you.

Paracosm is for people aged 13 and over. If you are under 18, ask a parent or guardian to review the terms and privacy information with you and agree to your use. We do not knowingly offer accounts to children under 13. Contact us if you believe an under-13 account or inappropriate use of a child’s information needs investigating.

10. Updates

We will update this policy when our practices change and give appropriate notice of material changes. The effective date will be shown at the top of the published version.