Privacy Policy

Last updated: 2026-11-11 (version 2026-11-11)

This English translation is provided for convenience. The Portuguese version prevails.

GameTale takes your privacy seriously. This policy explains what personal data we collect, why we collect it, how we use it, who receives it, how long we keep it, and the rights you have over it. It is written for Brazilian law, the Lei Geral de Proteção de Dados (LGPD, Lei nº 13.709/2018), and also covers users in the European Economic Area under the GDPR. It forms part of our Terms of Service.

Paid subscriptions are on, in Brazil only and in reais, by card (Stripe) or Pix (Asaas). The Revenue Share Program is still switched off: the program data described in this policy are processed only once it is switched on, and we will tell you before that happens.

1. Who Is Responsible for Your Data

The controller of your personal data is the individual who operates GameTale: Leonardo da Silva Lopes, CPF 489.788.068-80, with address at Rua Ãtalo Valdomiro Gullo, 133, contact email support@gametale.app. The controller decides why and how your data is processed and answers for it under the LGPD and the GDPR.

The channel for every data-protection matter, including requests from data subjects and communications from the Autoridade Nacional de Proteção de Dados (ANPD), is support@gametale.app (LGPD Article 41). No data protection officer (encarregado) separate from the controller has been appointed: the controller answers that channel personally, as small-scale processing agents may do under Article 11 of ANPD Resolution CD/ANPD nº 2/2022.

1.1 Representative in the European Union

No representative in the European Union has been appointed under GDPR Article 27. If you are in the European Economic Area, contact us by email at support@gametale.app, and your request will be handled like any other.

2. Minimum Age

To hold a GameTale account you must be 17 or older (article 24 of Lei nº 15.211/2025, the ECA Digital). Sign-up asks for your date of birth and refuses anyone who is not yet 17. Reading published stories needs no account and is open to anyone. An account opened when the minimum age was 13, whose holder is not yet 17, is paused: nobody can sign in to it, its profile, stories and comments are hidden from the public, and nothing is deleted. It starts working again by itself on the holder’s 17th birthday. If you become aware that someone under the minimum age holds an account, please contact us at support@gametale.app so we can take appropriate action.

You must be 18 or older to subscribe to a paid plan or to take part in the Revenue Share Program (the latter once it is switched on). We check these ages against the date of birth you gave at sign-up (section 4.3). If a subscription reaches the account of someone under 18, or of an account with no date of birth, we record that fact so the operator can review a refund. The renewal of a paused account’s subscription is cancelled automatically. Our Minors and Parents page explains what a teenager can and cannot do on GameTale.

3. Data We Collect

We collect only what the Service needs, most of it from you directly and some of it generated as you use the Service:

Account data: username, email, hashed password, date of birth, the third-party sign-in providers (Google, Facebook or Instagram) you linked, and, if you turn on two-step verification, the authenticator key (stored encrypted) and recovery codes (stored only as hashes).
Profile data: display name, avatar, banner image, bio, social links, and whether your reading list, achievements, following and followers are public.
User-generated content: published stories, drafts, comments, likes, favorites, reading lists, and whether an account or a story carries the generated-by-AI label.
Social and safety data: who you follow, who you block, and the reports you send about stories, profiles or comments.
Reading and engagement data: chapters opened, save slot progress, story memories, reading history, achievements, and time spent reading.
Signup source: if you accepted analytics cookies before creating the account, we keep how you reached GameTale, for the first visit and the last visit that brought you here: the source, medium, campaign and content of a tagged link (for example, utm_source), the name of the platform you came from (such as Instagram or Google, never the page address) and the route pattern of the landing page (not the full address). We do not keep this record for anyone under 18, nor when the browser sends the Do Not Track or Global Privacy Control signal.
Preferred genres: up to three story genres you choose in the sign-up genre step or in Settings, used only for the “For you” shelf (section 4.5).
Billing data: subscription plan and status, trial and billing dates, a payment-processor customer identifier, and, if a subscription reaches the account of someone under 18, the date that was recorded for review. We do not store your full card number; card details are held by our payment processor, Stripe. When you pay by Pix, the payer’s name, email and CPF are sent to Asaas to create the charge; the CPF is not stored by GameTale. We keep the status of each Pix charge (amount, period, dates and the charge’s Asaas identifier). When you pay by card, checkout asks for your billing address, which Stripe keeps; we store only that address’s country, with the payment record, to apply the right refund rule and to prevent fraud (performance of a contract and legitimate interest).
Acceptance records: which version of the Terms of Service, this Privacy Policy, the Community Guidelines and the Revenue Share Program Terms you accepted, and when.
Technical data: IP address, user agent, device and browser metadata, product-analytics events recording which screens you opened and which steps of a flow succeeded or were refused, crash and error logs. We do not store your IP address as it arrives: where we keep it at all, we keep only a keyed hash of it, a one-way code that cannot be turned back into the address without a secret held on our servers.
Bot-verification signals: when you open sign-up, sign-in, "forgot password" or the feedback form, Cloudflare Turnstile reads browser and device signals to confirm you are a person (section 5). GameTale receives only the result and does not store those signals.
Cookies and similar storage used for authentication, preferences, and analytics.
Support communications: the messages you send to our support address and our replies.
Waitlist: if you join the waitlist for paid plans (available only when signed in), we keep the interests you ticked, the optional “Other” text (up to 280 characters), the plan you came from, and when and under which version of the notice you agreed. The administrator sees only the total number of people on the list, the count per interest and the 30 most recent “Other” texts.
Feedback: when you send feedback, we keep its type (bug, idea, praise or other), the text (up to 2,000 characters), the route pattern of the screen you were on (and not the full address), the language, a screen-size bucket, the app version, its review status and, if you are signed in, your account. Feedback sent while signed out stores no email address, no IP address and no page address.
Moderation records: when an account is suspended or banned, or a suspension or ban is lifted, we record the kind of decision, the reason (chosen from a fixed list), the moderator’s note, the date a suspension ends, whether the reason was payment fraud, and when the decision was taken.

The Revenue Share Program will pay authors out of subscription revenue. For now, the program is switched off, and none of the data below is collected. Once it is switched on, it will require some more data, about authors and about the subscribers whose reading funds them:

Payout profile, for authors who join: legal name, type and number of the tax document (CPF, CNPJ, or a foreign tax identifier), country, payout method, and the PIX key or the bank details (bank, branch, account and holder) we pay to. It is shown in full only to you and to the administrator who makes the payment, and masked everywhere else. Creating or changing it requires you to confirm your identity again, and we email you when it changes.
Payout requests: the amount, currency, status and dates of each request, and a copy of the payout destination as it was when you made the request, so a payment always goes where you asked.
Earnings records: the amounts credited to you per story and per period, amounts held for review, and amounts reversed after a refund or a payment dispute.
Revenue splits: when an author shares a story’s earnings with a collaborator, which account holds the share, the percentage, the dates it was offered, accepted and ended, who ended it, and the date from which it stopped applying. Both people on the split can see it, and it is deleted with the story or with either person’s account; the earnings already credited under it stay in the financial records below.
Reading time: when a subscriber reads, we record how many seconds they read each story on each day, linked to their account. That time is what divides the reading portion of subscription revenue among authors.
Fraud signals: the age of each reading account, and the keyed hash of the IP address the reading came from, used only to notice many accounts reading from the same connection or a burst of brand new accounts.
Writing-pattern signals, for authors in the program: how many new words each published chapter version adds, and, when a single save grows a chapter by more than 3,000 words at once, a record of the story, the chapter, the account, the number of words added and the time. Never the text itself. Pasting from a word processor is normal and is never held against anyone on its own; these records are context for a person reviewing a flagged story.
Your acceptance of the Revenue Share Program Terms, with the version and the date.

Authors see aggregated figures only, such as their totals per story and per period, and never learn which readers read their work. Reading time and fraud signals are never shown to anyone and are read only when a period is settled.

4. Purposes and Legal Bases

We process your data to: provide and operate the Service; authenticate your account; apply the age rules, including pausing the accounts of people not yet 17; render and protect user-generated content; deliver relevant features (reading progress, save slots, notifications); process subscriptions and payments and, once the Revenue Share Program is switched on, pay authors; suggest stories based on the genres you chose; enforce our Terms and Community Guidelines, including suspending or banning accounts; preserve, and report to the authorities, content reported as child sexual abuse or exploitation; tell the people on the waitlist when paid plans launch; receive and review the feedback you send; understand where the people who create an account come from; and improve the platform through aggregated, technical analysis.

Each processing activity rests on one of the legal bases below (LGPD Article 7; GDPR Article 6):

Performance of a contract with you (LGPD Art. 7, V; GDPR Art. 6(1)(b)): your account, the features you use, a paid subscription and, once the program is switched on, the payments of the Revenue Share Program.
Compliance with a legal obligation (LGPD Art. 7, II; GDPR Art. 6(1)(c)): tax and accounting records of payments and payouts; age rules, including the minimum age of 17 to hold an account (ECA Digital Art. 24); preserving content reported as child sexual abuse or exploitation and reporting it to the authorities (Marco Civil da Internet Art. 15; ECA Digital Art. 27); and answering lawful requests from authorities.
Legitimate interests (LGPD Art. 7, IX; GDPR Art. 6(1)(f)): keeping accounts and the Service secure, rate limiting, error reports sent by our servers, moderating accounts that break the Terms or the Community Guidelines, reviewing the feedback you send, and preventing fraud in the Revenue Share Program. We use this basis only where it does not override your rights, and you may object to it (section 8).
Your consent (LGPD Art. 7, I; GDPR Art. 6(1)(a)): analytics cookies, the signup source (section 3), error reports sent from your browser, story suggestions from the genres you choose (section 4.5), and the waitlist, whose only purpose is to send you one email when paid plans launch (LGPD Art. 8 §4). You can withdraw it at any time, as easily as you gave it.
Exercise of rights in legal, administrative or arbitration proceedings (LGPD Art. 7, VI): keeping the records we may need to defend a claim, such as the record of a balance waived at account deletion, and moderation records after an account is deleted, for the period in which a claim can still be brought (article 27 of the Brazilian Consumer Defence Code).

4.1 OAuth Sign-In

When you sign in with a third-party provider (such as Google), we receive your verified email and provider account identifier strictly to authenticate you, secure your account, and deliver essential service communications. We do not use OAuth data for advertising or marketing profiles.

4.2 Email and Password

Your email address and password (stored only as an Argon2id hash with a server-side pepper) are used strictly for authentication, account recovery, security alerts (for example a password change or an email change), and essential transactional communications. They are never sold, never used for ad targeting, and never shared with analytics partners. When you create, change or reset a password, we check whether it has appeared in a public breach using Have I Been Pwned's Pwned Passwords service. The password never leaves our server: we send only the first 5 characters of its SHA-1 hash, shared by hundreds of passwords, and the comparison happens here. If the service is down, the password is accepted without the check.

4.3 Date of Birth

We collect your date of birth exclusively to apply age rules: the minimum age of 17 to hold an account (article 24 of Lei nº 15.211/2025, the ECA Digital), including working out when a paused account starts working again; LGPD Article 14 on the data of children and adolescents; and the minimum age of 18 to pay for a subscription or to take part in the Revenue Share Program. Your date of birth is never displayed on your public profile and is not shared with other users.

Once it is set, you cannot change your date of birth yourself, so that nobody can alter it to unlock a paid feature. If it is wrong, write to support@gametale.app and we will correct it once you show us proof of the right date (section 8.1).

For now, the Revenue Share Program is switched off, and nothing this section describes happens. Once it is switched on, the payout profile, payout requests, earnings records and reading time described in section 3.1 will be processed to perform the Revenue Share Program Terms, a contract with each participating author, and to meet the tax and accounting obligations that attach to every payment. Accounts and stories marked as generated by AI are not eligible for payment; that is the only use of the AI label that affects anyone (section 11).

The fraud signals are processed on our legitimate interest, shared by every honest author and subscriber, in keeping fake reading from taking the money in the program. They are checked automatically when a period is settled, and a story they flag only has its payment held: a person reviews it, and no payment is reversed without a human decision. They are never used for any other purpose.

The writing-pattern signals, and the reports that a story’s text is AI-generated without the label, are processed on the same legitimate interest and to perform the program terms, which pay only for human-written text: they keep undeclared AI-generated stories from taking money meant for authors. They never decide anything by themselves. A story they point to only has its unpaid earnings held; a person reviews the case, may ask the author for evidence of the writing process such as drafts or notes, and decides. The author receives the reasons and may appeal.

4.5 Story suggestions (profiling)

In the genre step of sign-up, and later in Settings (“Your genres”), you can choose up to three story genres. GameTale uses only those genres, in an automated process, to build the “For you” shelf on the Browse page: it compares the chosen genres with the tags of published stories and shows the ones that fit best. Left out are your own stories, the ones you have already started reading, and those by accounts you blocked or that blocked you. This is a form of profiling for recommending stories. Your reading history and your likes are not used to choose what to recommend; reading progress is used only to avoid repeating what you have already started.

This profile is not used for advertising (we show no advertising; section 10), is not sold or shared with third parties, takes no part in any payment or earnings calculation, does not restrict access to any story and does not consider the AI label: a story that is AI-generated, or has AI-generated art, appears like any other, with its label. Only stories you could already see in Browse are suggested. The genres are kept on your account until you change them, clear them or delete the account, and they are part of the copy of your data.

Legal basis: your consent (LGPD Art. 7, I; GDPR Art. 6(1)(a)). Choosing genres is optional: you can tap “Skip” in the genre step and use the Service normally, without the “For you” shelf.

To change the genres, open Settings and go to “Your genres”. To stop receiving suggestions, use “Turn off suggestions” on the same page: the genres are erased from your account, the “For you” shelf stops appearing and the profile no longer exists. Withdrawing consent is as easy as giving it and does not affect the rest of the Service.

This processing does not decide anything with legal effect or that significantly affects you: it only decides which stories appear on a shelf, and all of them stay reachable in Browse. You can still ask for a review of the processing and for information about the criteria used (LGPD Article 20) by writing to support@gametale.app; a person will answer. The criteria are the ones described in this section.

We share data only with processors needed to operate the Service, and with the recipients below that a payment or the law requires:

Hosting (Oracle Cloud, by Oracle Corporation, in São Paulo, Brazil, on a virtual machine we operate) and test and contingency environments (Vercel). The test environments receive no real user data; Vercel would serve GameTale in production again only if we had to roll the hosting back temporarily.
Delivery and protection network (Cloudflare): all traffic between your browser and GameTale passes through Cloudflare's network, which receives your IP address, the page address and the connection's content (including cookies) to deliver it and block attacks. It also runs our domain and forwards email sent to support.
Bot verification (Cloudflare Turnstile), on the forms that can be sent without being signed in or that open an account or a session: sign-up, sign-in, "forgot password" and the feedback form. To decide whether the sender is a person, Cloudflare receives your IP address and reads browser and device signals while the form is open; we get back only a yes or a no. We store none of it. It is a security measure, so it does not depend on the cookie banner.
Database and storage (PostgreSQL operated by us on the same Oracle Cloud virtual machine that hosts the Service, in São Paulo, Brazil; Cloudflare R2, in North America, for uploaded images and audio, which are delivered through Cloudflare's network, which receives your IP address when your browser loads them).
Database backup copies: a continuous copy (Cloudflare R2, in North America) and a full daily copy (GitHub, Inc., in the United States, and our server on Oracle Cloud, in São Paulo, Brazil), all encrypted before they leave the server, with a key that neither Cloudflare, nor GitHub, nor that server has.
Email delivery (Resend and, only when Resend refuses a message because of a limit or a failure on its side, Brevo).
Web push notifications, only on a device where you turned them on in your notification settings: your browser's push service (Google, Mozilla, Apple or Microsoft, depending on the browser) receives an encrypted message to deliver to that device, with the delivery address your browser gave us for it. It cannot read the message. Turning the switch off, signing out on that device or deleting your account removes that address from our records.
Card payment processing (Stripe). Stripe acts as our processor to handle the charges and, to prevent fraud, verify identity and meet its own legal obligations, such as those on preventing money laundering, as an independent controller, under its own privacy policy (stripe.com/privacy). We never see or store your full card number.
Pix payment processing (Asaas Gestão Financeira S.A., a payment institution in Brazil). Asaas acts as our processor to create and collect Pix charges and, to meet its own legal obligations, such as those on preventing money laundering, as an independent controller, under its own privacy policy (asaas.com). It receives the payer’s name, email and CPF.
Analytics: Google Analytics 4, Vercel Analytics, Vercel Speed Insights, and PostHog Inc., loaded only after you opt in via the cookie banner, and never while your browser sends a Do Not Track or Global Privacy Control signal (section 9), nor for the account of someone under 18 (section 13). PostHog is the product-analytics processor, and it receives more than a list of pages, so what reaches it is set out here in full rather than summarized:
- Which screen you opened, as the route and not the address you visited. A chapter you are reading is reported as /[locale]/read/[storySlugAndId]/[chapterSlugAndId] with the story’s and the chapter’s database identifiers beside it, never the story’s title, never an author’s username, and never the words you typed into the search box.
- Signing in and signing up: that the form was viewed, that it was submitted, and whether it succeeded or was refused, with a fixed reason label when it was refused; that a sign in with Google, Facebook or Instagram was started, and which of the three; that a password reset was requested; that the account activation link was opened; and whether the activation was accepted or refused. On the home page and the pages for writers, developers and readers: which of their buttons you pressed (to sign up, to browse stories, or to the pricing or revenue-share page), which of those pages it was on and where on the page it sat.
- Onboarding: that the genre screen was viewed, which genres you turned on or off, that your choice was saved, and whether you skipped the step.
- Authoring: starting the create a story flow, creating the story itself, creating a chapter, opening the editor, opening the publish comparison, and whether a publish was confirmed or refused, including whether it was your first; and, in the editor, whether the guided tour was started, finished or skipped and at which step, opening or hiding the first-steps list or asking it to show you where a step is, and which of its ten steps you completed and when all ten were done; whether you played a help clip and whether you watched it to the end, by clip name; and whether you opened your copy of the example story, a new one or the one you already had, and from which button; all of it by fixed names and counts only.
- Reading: opening a story, opening a chapter, finishing a chapter, which branch you chose at a decision point in a story, and creating or branching a save slot. This is reading behaviour and it is the most revealing category in this list: the branches you pick are a record of choices you made inside somebody else’s story. It is recorded as identifiers and fixed labels only, it is never recorded for a visitor who has not opted in, and it is covered by the access and deletion rights in section 8 like everything else here; these events are not in the file you download from Settings, but a copy can be requested from support (section 8).
- Sharing: that you shared a story or a profile, which way you shared it (a named network, copying the link, or your device’s own share sheet) and which screen you shared it from. Who you sent it to is never known to us: the network or the app you picked receives the link directly from your browser.
- Payment intent: opening the pricing page, starting a checkout and completing a purchase, with the plan you chose and, for a completed purchase, its billing period, whether you paid by card or Pix, and the amount. Your payment details go to Stripe and never to PostHog.
- Your consent itself: that you granted analytics consent. A refusal cannot be recorded there, because nothing is loaded to record it.
Every item above is identified by database identifiers and fixed labels. PostHog receives no email address, no username, no story title, and no free text; it does not read the text on a page (autocapture is off); and it creates a profile for you only if you are signed in, keyed by your account’s internal identifier and never by your email or name. When you sign in, the events this browser sent earlier while you were not signed in are linked to that profile; this happens only with your analytics consent, and signing out ends the link for whatever the browser sends next. Session recording, which replays what happened on your screen, runs on a closed list of screens and nowhere else: the home page, signing up, signing in, the "forgot password" form and the page confirming its email was sent, the page confirming a password was changed, the onboarding steps, the pricing page and the checkout. It does not run on the two screens opened by a link in an email, account activation and the page where you choose a new password, because those addresses carry a single-use token and a recording captures the address. It never runs on the reader, the chapter editor, the story creation wizard, a profile, your account settings, or the catalogue and its search, so no unpublished draft and nobody’s profile is ever filmed. The home page shows only stories already published, which any visitor can see. What you type into a field is masked before the recording leaves your browser, and the whole of it sits behind the same analytics consent as every other item in this section. Google Analytics 4 receives the first item above and none of the others: the same route, the same identifiers, produced by the same code, so the two cannot differ. We send that route in place of the page title as well, because the title of a GameTale page is a story title, an author’s username, or the name of a draft nobody has published; Google Analytics’ own automatic page measurement, which would have read your browser tab and your address bar instead, is switched off in the first line of its configuration. It receives no email address, no username, no story title, and no free text either. See our Cookie Policy, and section 6.1 below for where it stores that data.
Error reports (PostHog Inc.). When the Service hits an error it did not expect, the error is reported to PostHog so that it can be found and fixed. A report sent by our servers carries only the error code (a fixed label such as email.send_failed), the error’s type, the lines of our code it passed through, the route it happened on, as a pattern and not an address, and the reference number the error page shows you. It never carries the error’s message, it is sent under one fixed identifier for the whole server and with no location, and it carries no account, no IP address and no page address. These reports are sent whatever you chose in the cookie banner, on our legitimate interest in keeping the Service working, because they describe our code and not you. A report from your browser is sent only after you opt in to analytics cookies, never for the account of someone under 18 (section 13), and it travels with the other analytics events described above, with the route in place of the address; it also carries the error’s message, with email addresses, credentials and long tokens removed first, and that message can on rare occasions quote something you entered. They are stored where the analytics above are (section 6.1). Your browser’s IP address reaches PostHog with every analytics event and every error report, but PostHog is configured to discard it on arrival, without storing it; before it is discarded, it may be used to estimate your approximate location (country and city).
Logs, traces and performance metrics (Grafana Labs, Inc., through Grafana Cloud, hosted in Brazil). To find and fix faults and to see how fast the Service runs, our servers send operational telemetry: log lines, each with a fixed event code such as email.send_failed; the route a request used, as a pattern and not an address; how long it took and whether it succeeded; and the technical detail of errors, including the lines of our code they passed through. Before anything leaves our servers, email addresses, IP addresses, credentials and long tokens are removed from it, and it carries no account name, no page address and no cookie. It is sent whatever you chose in the cookie banner, on our legitimate interest in keeping the Service working and secure, because it describes our code and not you. It is stored in Brazil and kept for 14 days.
Authentication providers when you sign in via OAuth.
Banks and payment institutions that carry a Revenue Share payout by PIX or bank transfer, which receive the payee’s name, tax document number and payout destination, as any transfer requires.
Public authorities, courts and the ANPD, when the law or a lawful order requires it, and only what it requires. This includes reporting content reported as child sexual abuse or exploitation to the Polícia Federal (section 7).

We do not sell your personal data, and we do not share it for advertising (section 10).

6. International Transfers

The processors below are United States companies, a country the ANPD does not recognise as adequate; for some of them, such as Grafana Labs, the data is stored in Brazil and the transfer is their staff’s remote access from the United States. None of them offers the ANPD’s standard contractual clauses (Resolution CD/ANPD nº 19/2024) for the services we use, so the basis for each transfer under the LGPD is the one shown beside its name: the need to perform the contract with you (Article 33, IX, read with Article 7, V) or your specific consent (Article 33, VIII). For those in the European Economic Area, we also state the safeguard under Chapter V of the GDPR.

Vercel Inc. (test environments, temporary hosting contingency and performance measurement): LGPD Article 33, IX, read with Article 7, V, for the test environments and the contingency; your specific consent (Article 33, VIII) for the usage and performance measurement, which is switched on only if you accept analytics cookies. GDPR: the European Commission’s standard contractual clauses (Decision 2021/914), incorporated into Vercel’s Data Processing Addendum.
Neon (Databricks, Inc. and Neon, LLC), where the database was kept until it moved to our server, stored in Brazil in Amazon Web Services’ São Paulo region: a frozen copy of the database is kept there for up to 14 days after the move, only in case we need to move back, and then erased; their technical staff in the United States may reach it remotely to provide support, under Databricks’ contractual terms. LGPD Article 33, IX, read with Article 7, V. GDPR: the safeguards set out in Databricks’ contractual terms; a copy can be requested from support@gametale.app.
Cloudflare, Inc. (reverse proxy and content delivery for all traffic to the Service, storage and delivery of uploaded images and audio (R2), encrypted database backup copies and the record of account deletions (R2), DNS, email routing and the Turnstile bot verification, which processes your IP address and browser signals on Cloudflare’s global network): LGPD Article 33, IX, read with Article 7, V, because delivering and protecting the traffic and the verification protect the sign-up and sign-in you use. GDPR: the European Commission’s standard contractual clauses, incorporated into Cloudflare’s Data Processing Addendum.
Plus Five Five, Inc. (Resend), transactional email: LGPD Article 33, IX, read with Article 7, V. GDPR: the European Commission’s standard contractual clauses, incorporated into Resend’s Data Processing Addendum.
Brevo SAS (Brevo), in France, fallback transactional email, used only when Resend refuses a message; it receives your address, the subject and the text of that e-mail, keeps the delivery record and may record, anonymously, whether the e-mail was opened. Its servers are in France and Belgium; some of its sub-processors (such as Google Cloud and Cloudflare) are United States companies. LGPD Article 33, I (ANPD Resolution No. 32/2026, which recognises the European Union as adequate). GDPR: the European Commission’s standard contractual clauses, in Brevo’s Data Processing Addendum.
Google LLC, Mozilla Corporation, Apple Inc. and Microsoft Corporation (browser push services, only for the push notifications you turn on): each receives an encrypted message it cannot read and your device's delivery address. LGPD Article 33, IX, read with Article 7, V. GDPR: the transfer is necessary to deliver the notifications you asked for (Article 49(1)(b)).
Stripe, LLC, card payments: processor and, for its own purposes, independent controller (section 5); LGPD Article 33, IX, read with Article 7, II and V. GDPR: the European Commission’s standard contractual clauses (Modules 1 and 2) in Stripe’s Data Processing Addendum.
PostHog, Inc. (product analytics, session recording and browser error reports): LGPD: your specific consent (Article 33, VIII). GDPR: the European Commission’s standard contractual clauses (Decision 2021/914, Module 2) in the Data Processing Addendum we signed with PostHog on 4 October 2026. Error reports sent by our servers contain no personal data (no account, IP address, page address or error message), so they are not a transfer of personal data.
Grafana Labs, Inc. (logs, traces and performance metrics, stored in Brazil): the data is stored in Grafana Cloud’s Brazil region for up to 14 days, and e-mail and IP addresses are removed before it is sent, as described under sharing. Grafana Labs’ technical staff in the United States may reach it to provide support, under Grafana Labs’ Data Processing Addendum; for the GDPR, that addendum incorporates the European Commission’s standard contractual clauses.
Google LLC (Google Analytics 4): LGPD: your specific consent (Article 33, VIII). GDPR: the European Commission’s standard contractual clauses incorporated into the Google Ads Data Processing Terms, accepted for our Google Analytics account.
GitHub, Inc. (encrypted backup copies): LGPD Article 33, IX, read with Article 7, V. The content is encrypted with a key GitHub does not have.
Oracle Corporation (hosting of the Service and of the database, and the encrypted daily backup copy, on a virtual machine we operate on Oracle Cloud, stored in Brazil, in São Paulo): Oracle's technical staff in the United States may access the infrastructure to provide support; the content of the backup copies is encrypted with a key neither Oracle nor that server has. LGPD Article 33, IX, read with Article 7, V.
Google and Meta (sign-in with Google, Facebook or Instagram): independent controllers. You send your data to them directly when you choose that sign-in.

Between Brazil and the European Economic Area, data flows without additional clauses: the European Union recognised Brazil as adequate (Commission Implementing Decision (EU) 2026/179) and the ANPD recognised the European Union (Resolution CD/ANPD nº 32/2026), both of 26 January 2026.

6.1 Product Analytics Is Hosted in the United States

PostHog Inc. operates the instance GameTale uses from its United States cloud, so when you opt in to analytics cookies the events described in section 5 are transmitted to and stored on servers in the United States. That transfer happens only because you opted in, and we set it out here so that the choice is an informed one, as LGPD Article 33 and Chapter V of the GDPR both require. If you do not opt in, no request to PostHog leaves your browser at all, and withdrawing consent from the “Cookie Preferences” link in the site footer stops the capture immediately. The error reports described in section 5 are stored in the same United States cloud; the ones our servers send do not depend on your choice, and carry no account, IP address or page address.

The basis for that transfer is your specific consent (LGPD Article 33, VIII) and, for those in the European Economic Area, your consent (Article 49(1)(a) GDPR), as section 6 sets out. PostHog discards your IP address on arrival, without storing it (section 5).

7. Data Retention

We keep personal data only as long as needed for the purposes described, or as required by law. Concretely:

Account, profile and content data: for as long as your account exists. Deleting your account (in Settings) is normally immediate and permanent: the account and everything tied to it, including your stories, comments, reading progress, the reports you sent and your payout profile, are erased at once. Your uploaded files are removed right after, and a weekly clean-up removes anything left behind. If a deletion is interrupted after it has started, it is completed automatically within about an hour. The exceptions are the items below (financial records, moderation records and the preservation tied to a child sexual abuse report), the backup copies, where erased data can remain for up to 10 days (the “Backup copies” item below), and the deferral described in the notice in this section.
Sessions: until the session ends or expires, at most 90 days after sign-in, plus one day before the expired record is deleted.
Signup source (how you reached GameTale): for as long as the account exists. It is erased with the account and included in the copy of your data.
Backup copies: the database is copied continuously, encrypted, to Cloudflare R2 (in North America), where each copy is kept for up to 10 days (longer only if the full daily copy fails, until the next one succeeds); a full encrypted copy is also made once a day on our server on Oracle Cloud, in São Paulo, which keeps the newest 3, and kept for 7 days on GitHub (GitHub, Inc., in the United States). Erased data can remain in these copies until they expire. They are used only to restore the Service after a failure. So that a restore cannot bring back a deleted account, we keep for 30 days, in private Cloudflare R2 storage, a record of each account deletion holding only the account's identifier and the moment it was deleted, and a restore re-applies the deletions requested after the point restored.
Images and audio you replace or delete without deleting your account (a swapped cover, a deleted chapter): they go offline at once, but are kept out of public reach for 11 days, so that a database restore after a failure does not leave stories without their images; then they are erased. When you delete your account, your files are erased at once, without that period.
Chapter view records, which carry a keyed hash of the IP address: 30 days.
Revenue Share reading time and its fraud signals: 400 days, because a settlement, a refund or a dispute can reach back into earlier months; deleted sooner if the account is deleted.
Writing-pattern signals: the records of a single save adding more than 3,000 words are deleted after 400 days (about 13 months); the word count of each published chapter version is kept with that version and deleted with it.
Billing data: your subscription records while your account exists. The payment notifications Stripe sends us have their personal details (name, email, phone, address and card details) removed after 30 days. The accounting record of each subscription payment (amount, date and invoice reference) is part of GameTale’s own books and stays in them after account deletion, but no longer linked to your account. When the tax period in the next item ends, the payment processor’s customer and subscription references are removed too, and nothing in that record links the payment to you any more. Pix charges (amount, period, dates, status and the charge’s Asaas identifier) follow the same rule as subscription records. Asaas keeps the payer’s name, email and CPF for the periods the law requires of it, such as those on preventing money laundering, under its own privacy policy; deleting your GameTale account does not erase that record at Asaas.
Financial records (Revenue Share earnings records, each paid payout with the destination it was paid to, and the records of a subscription being ended): a record from a given year is kept until 1 January of the sixth year after it, the period during which the tax authorities may review it (article 173, I, of the Brazilian National Tax Code), and then erased. For example, a record from 2027 is kept until 1 January 2033. It may be kept longer if the law or a pending proceeding requires. These records are kept even after the account is deleted, no longer linked to it. A payout request that was rejected loses its copy of the payout destination when the account is deleted.
Waiver records: if you delete your account while you still have Revenue Share amounts and choose to waive them, we keep a record of the amounts waived, the version of the terms and the date. It holds no personal data other than the identifier of the former account and follows the same period as the previous item: it is kept until 1 January of the sixth year after the year of the waiver (article 173, I, of the Brazilian National Tax Code), or longer if the law or a pending proceeding requires, and then erased.
Retired usernames: when an account is deleted or renamed, the old username is kept on a list so that nobody else can take it and pass themselves off as you. The list holds the name and the date, not your data.
Reports: kept while needed to handle the report and any appeal, and deleted with the account that sent it, except a report of child sexual abuse or exploitation, which follows the preservation item below. A report also reaches our support inbox by email, and that copy is kept as long as needed to handle it.
Moderation records (suspensions, bans and their lifting): for as long as the account exists. After the account is deleted, they lose their link to it and are kept for 5 years from the date of each decision, the period in which a claim can still be brought (article 27 of the Brazilian Consumer Defence Code), and then erased.
Preservation of child sexual abuse or exploitation reports: when a story, a profile or a comment is reported for that reason, we preserve, beyond the reach of any deletion including account deletion: the report, with the reporting account’s identifier, email and username; the reported content, including the text of every chapter, published and draft; copies of the media files (images and audio); and the responsible account’s identifier, email, username, name, account creation date and date of birth. This material is kept for 6 months (Marco Civil da Internet Art. 15; ECA Digital Art. 27 §2), or longer if an authority asks, and then erased. The operator reports the case to the Polícia Federal through the Centro Nacional de Triagem de Notificações, the national notification triage centre (ECA Digital Art. 27; Decreto nº 12.880/2026, Arts. 36 to 39).
Waitlist: until you leave the list (on the waitlist page itself) or delete your account. It is used only to send one email when paid plans launch.
Feedback: 2 years from when it was sent, and then erased. Feedback sent while signed in is erased sooner, with the account, if the account is deleted first.
Analytics and error reports: kept by each processor under the retention settings of its service; session recordings are deleted after 30 days. Logs, traces and performance metrics: 14 days, in Brazil. Write to support@gametale.app to learn the current period for the rest.
Server logs: kept on the machine we operate on Oracle Cloud. Access logs hold your truncated IP address and no URL query, cookies or referring page, for up to 7 days; system logs, which include the address of anyone who tries to connect to the server, for up to 14 days; application logs hold no IP address, email or message content and are size-limited. The operational logs sent to Grafana Labs follow the retention described for it. We make no other copy.
Support emails: as long as needed to resolve your request, and afterwards only while we may need them to defend a claim.

If, when you ask to delete your account, a Revenue Share payout request is still open or a month’s earnings are not yet settled, you choose one of three paths: request the payout and delete the account once it is paid; waive the amounts expressly and delete the account now, knowing that a waived amount cannot be recovered; or defer the deletion. With a deferral, the account is hidden and locked at once and erased only once the payout is paid and the month is settled, at the latest around the first day of the second month after the request. Until then, all the account’s data is kept.

When data is no longer needed, we delete or anonymize it.

8. Your Rights

Under LGPD Article 18 and GDPR Articles 15 to 22, and subject to applicable law, you have the right to:

Confirm whether we process data about you, and access that data.
Correct incomplete, inaccurate, or outdated data.
Have unnecessary or excessive data, or data processed unlawfully, anonymized, blocked or deleted.
Request portability of your data in a machine-readable format.
Request deletion of your account and personal data, except the records the law requires us to keep (section 7).
Know which public and private entities we share your data with.
Know that you may refuse consent and what follows if you do, and withdraw consent at any time.
Object to or restrict certain processing activities, in particular those based on legitimate interests.
Ask for a review of a decision taken solely by automated means that affects your interests (LGPD Article 20). The “For you” shelf is built automatically from the genres you chose, but it decides nothing that affects your interests; you can ask for a review and turn it off at any time in Settings (section 4.5). Besides it, GameTale runs three automatic checks. The Revenue Share fraud signal and the writing-pattern signals only hold earnings for a person to decide. The pause of an account whose holder is not yet 17 is worked out automatically from the date of birth; if the date is wrong, you can ask for a review by writing to support@gametale.app with proof of the correct date (section 8.1).
Lodge a complaint with the competent data-protection authority: in Brazil, the ANPD; in the European Economic Area, the supervisory authority of the country where you live or work.

You can do much of this yourself: Settings lets you delete your account and download a copy of your data. The file holds your profile, your settings, your billing data, your stories and chapters, the Revenue Share, the waitlist, the feedback you sent, your account’s moderation history and your activity: comments, chapter and comment likes, who you follow (and how many people follow you), who you blocked, reading lists, reading progress and save slots, achievements, reports you sent, acceptance records (the versions and the dates you accepted them) and the sign-in providers linked to your account. It never holds who blocked you, the hashed IP address of your reports or the sign-in providers’ tokens. Each list holds at most the 10,000 most recent entries, and the file says which lists reached that limit. Analytics events (PostHog) are not in the file: ask support@gametale.app and we will send them within the legal deadline. For any other request, contact the same address. The same support inbox handles privacy, legal, and account-support requests. We may ask you to confirm your identity before we act, so that nobody else can obtain or erase your data.

We answer within 15 days (LGPD Article 19), and never later than the period the law that protects you allows. Exercising these rights is free.

8.1 Right to Rectification (Art. 16 GDPR / Art. 18 III LGPD)

You can correct inaccurate personal data at any time. Your display name, username, bio, avatar, banner and social links (Instagram, X, Facebook and a website) are editable from your profile; your email address, your password and who can see your reading list, achievements, following and followers are editable under Profile → Settings; and a Revenue Share payout profile is editable in the Revenue Share area of your account.

Your date of birth cannot be changed from the Service once it is set. To correct it, email support@gametale.app from the address on file with proof of the correct date; we use the proof only to make the correction.

For anything else you cannot update yourself, for example a story attribution dispute or an audit-log correction, email support@gametale.app from the address on file.

9. Cookies, Do Not Track and Global Privacy Control

We use cookies and similar storage to authenticate sessions, remember preferences (such as language and theme), and, only with your consent, measure aggregate usage of the Service. Our Cookie Policy lists them.

If your browser sends a Do Not Track signal or a Global Privacy Control (GPC) signal, GameTale loads no analytics at all: Google Analytics 4, PostHog, Vercel Analytics and Vercel Speed Insights are never started, even if you accepted analytics cookies in our banner. We treat both signals the same way, as a standing refusal you gave your browser.

10. No Sale of Data and No Advertising

We do not sell your personal data. We do not share your data for third-party advertising, we do not build advertising profiles, and we do not use your data for behavioural advertising. GameTale is not funded by ads: it is funded by subscriptions.

11. What Other People Can See

Your username, display name, avatar, banner, bio, social links, published stories, comments and follower counts are public, and so are your reading list, achievements, following and followers unless you make them private in Settings. Your email address and date of birth are never public.

An account or a story can carry a public label saying it was generated by AI. It is a disclosure shown to every reader, and authors must disclose it truthfully (see Content Ratings and AI Disclosure). The label does not change how an account or a story is ranked, shown or filtered; its only other effect is that labelled accounts and stories are not eligible for Revenue Share payments.

While an account is suspended, banned or paused for age, its profile, stories and comments are hidden from the public. Nothing is deleted because of it, and they reappear when the measure ends.

12. Security

We use industry-standard measures (encryption in transit, hashed passwords, keyed hashes of IP addresses, access controls, a second identity check before sensitive changes such as your payout details, audit logging) to protect your data, but no system is perfectly secure. If we become aware of a security incident that may cause you significant risk or harm, we will notify you and the ANPD, or the competent authority, as the law requires (LGPD Article 48; GDPR Articles 33 and 34).

13. Minors

You must be 17 or older to hold an account (section 2), and reading published stories needs no account. We process the data of 17-year-olds in their best interest (LGPD Article 14). Nobody under 18 can subscribe or take part in the Revenue Share Program. The account of someone under 18 is never measured: no usage analytics, no session recording and no browser error reports, whatever the choice in the cookie banner. A story’s “Teen (13+)” rating says who the content is suitable for, not the age needed to hold an account. We do not allow explicit adult content at any rating, sexual content involving minors, or other content prohibited by our Community Guidelines, which limits the kinds of data the platform processes about you and others. Parents and guardians can find more on our Minors and Parents page, and can write to support@gametale.app about a minor’s account.

14. Changes to This Policy

We may update this Privacy Policy from time to time. The version date at the top reflects the most recent update. Material changes will be announced inside the Service, and where a change needs your agreement we will ask for it.

15. Contact

For privacy questions and general support, contact support@gametale.app. You can also reach the controller at support@gametale.app.

15.1 Brazil (LGPD) Notice

Under the Lei Geral de Proteção de Dados (Lei nº 13.709/2018), users in Brazil have the rights described in section 8. The data controller is the operator identified in section 1, and the unified contact channel for data-protection matters is support@gametale.app. The Portuguese version of this policy prevails over this translation.

Privacy Policy

Last updated: 2026-11-11 (version 2026-11-11)

This English translation is provided for convenience. The Portuguese version prevails.

1. Who Is Responsible for Your Data

1.1 Representative in the European Union

2. Minimum Age

3. Data We Collect

We collect only what the Service needs, most of it from you directly and some of it generated as you use the Service:

Account data: username, email, hashed password, date of birth, the third-party sign-in providers (Google, Facebook or Instagram) you linked, and, if you turn on two-step verification, the authenticator key (stored encrypted) and recovery codes (stored only as hashes).
Profile data: display name, avatar, banner image, bio, social links, and whether your reading list, achievements, following and followers are public.
User-generated content: published stories, drafts, comments, likes, favorites, reading lists, and whether an account or a story carries the generated-by-AI label.
Social and safety data: who you follow, who you block, and the reports you send about stories, profiles or comments.
Reading and engagement data: chapters opened, save slot progress, story memories, reading history, achievements, and time spent reading.
Signup source: if you accepted analytics cookies before creating the account, we keep how you reached GameTale, for the first visit and the last visit that brought you here: the source, medium, campaign and content of a tagged link (for example, utm_source), the name of the platform you came from (such as Instagram or Google, never the page address) and the route pattern of the landing page (not the full address). We do not keep this record for anyone under 18, nor when the browser sends the Do Not Track or Global Privacy Control signal.
Preferred genres: up to three story genres you choose in the sign-up genre step or in Settings, used only for the “For you” shelf (section 4.5).
Billing data: subscription plan and status, trial and billing dates, a payment-processor customer identifier, and, if a subscription reaches the account of someone under 18, the date that was recorded for review. We do not store your full card number; card details are held by our payment processor, Stripe. When you pay by Pix, the payer’s name, email and CPF are sent to Asaas to create the charge; the CPF is not stored by GameTale. We keep the status of each Pix charge (amount, period, dates and the charge’s Asaas identifier). When you pay by card, checkout asks for your billing address, which Stripe keeps; we store only that address’s country, with the payment record, to apply the right refund rule and to prevent fraud (performance of a contract and legitimate interest).
Acceptance records: which version of the Terms of Service, this Privacy Policy, the Community Guidelines and the Revenue Share Program Terms you accepted, and when.
Technical data: IP address, user agent, device and browser metadata, product-analytics events recording which screens you opened and which steps of a flow succeeded or were refused, crash and error logs. We do not store your IP address as it arrives: where we keep it at all, we keep only a keyed hash of it, a one-way code that cannot be turned back into the address without a secret held on our servers.
Bot-verification signals: when you open sign-up, sign-in, "forgot password" or the feedback form, Cloudflare Turnstile reads browser and device signals to confirm you are a person (section 5). GameTale receives only the result and does not store those signals.
Cookies and similar storage used for authentication, preferences, and analytics.
Support communications: the messages you send to our support address and our replies.
Waitlist: if you join the waitlist for paid plans (available only when signed in), we keep the interests you ticked, the optional “Other” text (up to 280 characters), the plan you came from, and when and under which version of the notice you agreed. The administrator sees only the total number of people on the list, the count per interest and the 30 most recent “Other” texts.
Feedback: when you send feedback, we keep its type (bug, idea, praise or other), the text (up to 2,000 characters), the route pattern of the screen you were on (and not the full address), the language, a screen-size bucket, the app version, its review status and, if you are signed in, your account. Feedback sent while signed out stores no email address, no IP address and no page address.
Moderation records: when an account is suspended or banned, or a suspension or ban is lifted, we record the kind of decision, the reason (chosen from a fixed list), the moderator’s note, the date a suspension ends, whether the reason was payment fraud, and when the decision was taken.

Payout profile, for authors who join: legal name, type and number of the tax document (CPF, CNPJ, or a foreign tax identifier), country, payout method, and the PIX key or the bank details (bank, branch, account and holder) we pay to. It is shown in full only to you and to the administrator who makes the payment, and masked everywhere else. Creating or changing it requires you to confirm your identity again, and we email you when it changes.
Payout requests: the amount, currency, status and dates of each request, and a copy of the payout destination as it was when you made the request, so a payment always goes where you asked.
Earnings records: the amounts credited to you per story and per period, amounts held for review, and amounts reversed after a refund or a payment dispute.
Revenue splits: when an author shares a story’s earnings with a collaborator, which account holds the share, the percentage, the dates it was offered, accepted and ended, who ended it, and the date from which it stopped applying. Both people on the split can see it, and it is deleted with the story or with either person’s account; the earnings already credited under it stay in the financial records below.
Reading time: when a subscriber reads, we record how many seconds they read each story on each day, linked to their account. That time is what divides the reading portion of subscription revenue among authors.
Fraud signals: the age of each reading account, and the keyed hash of the IP address the reading came from, used only to notice many accounts reading from the same connection or a burst of brand new accounts.
Writing-pattern signals, for authors in the program: how many new words each published chapter version adds, and, when a single save grows a chapter by more than 3,000 words at once, a record of the story, the chapter, the account, the number of words added and the time. Never the text itself. Pasting from a word processor is normal and is never held against anyone on its own; these records are context for a person reviewing a flagged story.
Your acceptance of the Revenue Share Program Terms, with the version and the date.

4. Purposes and Legal Bases

Each processing activity rests on one of the legal bases below (LGPD Article 7; GDPR Article 6):

Performance of a contract with you (LGPD Art. 7, V; GDPR Art. 6(1)(b)): your account, the features you use, a paid subscription and, once the program is switched on, the payments of the Revenue Share Program.
Compliance with a legal obligation (LGPD Art. 7, II; GDPR Art. 6(1)(c)): tax and accounting records of payments and payouts; age rules, including the minimum age of 17 to hold an account (ECA Digital Art. 24); preserving content reported as child sexual abuse or exploitation and reporting it to the authorities (Marco Civil da Internet Art. 15; ECA Digital Art. 27); and answering lawful requests from authorities.
Legitimate interests (LGPD Art. 7, IX; GDPR Art. 6(1)(f)): keeping accounts and the Service secure, rate limiting, error reports sent by our servers, moderating accounts that break the Terms or the Community Guidelines, reviewing the feedback you send, and preventing fraud in the Revenue Share Program. We use this basis only where it does not override your rights, and you may object to it (section 8).
Your consent (LGPD Art. 7, I; GDPR Art. 6(1)(a)): analytics cookies, the signup source (section 3), error reports sent from your browser, story suggestions from the genres you choose (section 4.5), and the waitlist, whose only purpose is to send you one email when paid plans launch (LGPD Art. 8 §4). You can withdraw it at any time, as easily as you gave it.
Exercise of rights in legal, administrative or arbitration proceedings (LGPD Art. 7, VI): keeping the records we may need to defend a claim, such as the record of a balance waived at account deletion, and moderation records after an account is deleted, for the period in which a claim can still be brought (article 27 of the Brazilian Consumer Defence Code).

4.1 OAuth Sign-In

4.2 Email and Password

4.3 Date of Birth

4.5 Story suggestions (profiling)

Legal basis: your consent (LGPD Art. 7, I; GDPR Art. 6(1)(a)). Choosing genres is optional: you can tap “Skip” in the genre step and use the Service normally, without the “For you” shelf.

We share data only with processors needed to operate the Service, and with the recipients below that a payment or the law requires:

Hosting (Oracle Cloud, by Oracle Corporation, in São Paulo, Brazil, on a virtual machine we operate) and test and contingency environments (Vercel). The test environments receive no real user data; Vercel would serve GameTale in production again only if we had to roll the hosting back temporarily.
Delivery and protection network (Cloudflare): all traffic between your browser and GameTale passes through Cloudflare's network, which receives your IP address, the page address and the connection's content (including cookies) to deliver it and block attacks. It also runs our domain and forwards email sent to support.
Bot verification (Cloudflare Turnstile), on the forms that can be sent without being signed in or that open an account or a session: sign-up, sign-in, "forgot password" and the feedback form. To decide whether the sender is a person, Cloudflare receives your IP address and reads browser and device signals while the form is open; we get back only a yes or a no. We store none of it. It is a security measure, so it does not depend on the cookie banner.
Database and storage (PostgreSQL operated by us on the same Oracle Cloud virtual machine that hosts the Service, in São Paulo, Brazil; Cloudflare R2, in North America, for uploaded images and audio, which are delivered through Cloudflare's network, which receives your IP address when your browser loads them).
Database backup copies: a continuous copy (Cloudflare R2, in North America) and a full daily copy (GitHub, Inc., in the United States, and our server on Oracle Cloud, in São Paulo, Brazil), all encrypted before they leave the server, with a key that neither Cloudflare, nor GitHub, nor that server has.
Email delivery (Resend and, only when Resend refuses a message because of a limit or a failure on its side, Brevo).
Web push notifications, only on a device where you turned them on in your notification settings: your browser's push service (Google, Mozilla, Apple or Microsoft, depending on the browser) receives an encrypted message to deliver to that device, with the delivery address your browser gave us for it. It cannot read the message. Turning the switch off, signing out on that device or deleting your account removes that address from our records.
Card payment processing (Stripe). Stripe acts as our processor to handle the charges and, to prevent fraud, verify identity and meet its own legal obligations, such as those on preventing money laundering, as an independent controller, under its own privacy policy (stripe.com/privacy). We never see or store your full card number.
Pix payment processing (Asaas Gestão Financeira S.A., a payment institution in Brazil). Asaas acts as our processor to create and collect Pix charges and, to meet its own legal obligations, such as those on preventing money laundering, as an independent controller, under its own privacy policy (asaas.com). It receives the payer’s name, email and CPF.
Analytics: Google Analytics 4, Vercel Analytics, Vercel Speed Insights, and PostHog Inc., loaded only after you opt in via the cookie banner, and never while your browser sends a Do Not Track or Global Privacy Control signal (section 9), nor for the account of someone under 18 (section 13). PostHog is the product-analytics processor, and it receives more than a list of pages, so what reaches it is set out here in full rather than summarized:
- Which screen you opened, as the route and not the address you visited. A chapter you are reading is reported as /[locale]/read/[storySlugAndId]/[chapterSlugAndId] with the story’s and the chapter’s database identifiers beside it, never the story’s title, never an author’s username, and never the words you typed into the search box.
- Signing in and signing up: that the form was viewed, that it was submitted, and whether it succeeded or was refused, with a fixed reason label when it was refused; that a sign in with Google, Facebook or Instagram was started, and which of the three; that a password reset was requested; that the account activation link was opened; and whether the activation was accepted or refused. On the home page and the pages for writers, developers and readers: which of their buttons you pressed (to sign up, to browse stories, or to the pricing or revenue-share page), which of those pages it was on and where on the page it sat.
- Onboarding: that the genre screen was viewed, which genres you turned on or off, that your choice was saved, and whether you skipped the step.
- Authoring: starting the create a story flow, creating the story itself, creating a chapter, opening the editor, opening the publish comparison, and whether a publish was confirmed or refused, including whether it was your first; and, in the editor, whether the guided tour was started, finished or skipped and at which step, opening or hiding the first-steps list or asking it to show you where a step is, and which of its ten steps you completed and when all ten were done; whether you played a help clip and whether you watched it to the end, by clip name; and whether you opened your copy of the example story, a new one or the one you already had, and from which button; all of it by fixed names and counts only.
- Reading: opening a story, opening a chapter, finishing a chapter, which branch you chose at a decision point in a story, and creating or branching a save slot. This is reading behaviour and it is the most revealing category in this list: the branches you pick are a record of choices you made inside somebody else’s story. It is recorded as identifiers and fixed labels only, it is never recorded for a visitor who has not opted in, and it is covered by the access and deletion rights in section 8 like everything else here; these events are not in the file you download from Settings, but a copy can be requested from support (section 8).
- Sharing: that you shared a story or a profile, which way you shared it (a named network, copying the link, or your device’s own share sheet) and which screen you shared it from. Who you sent it to is never known to us: the network or the app you picked receives the link directly from your browser.
- Payment intent: opening the pricing page, starting a checkout and completing a purchase, with the plan you chose and, for a completed purchase, its billing period, whether you paid by card or Pix, and the amount. Your payment details go to Stripe and never to PostHog.
- Your consent itself: that you granted analytics consent. A refusal cannot be recorded there, because nothing is loaded to record it.
Every item above is identified by database identifiers and fixed labels. PostHog receives no email address, no username, no story title, and no free text; it does not read the text on a page (autocapture is off); and it creates a profile for you only if you are signed in, keyed by your account’s internal identifier and never by your email or name. When you sign in, the events this browser sent earlier while you were not signed in are linked to that profile; this happens only with your analytics consent, and signing out ends the link for whatever the browser sends next. Session recording, which replays what happened on your screen, runs on a closed list of screens and nowhere else: the home page, signing up, signing in, the "forgot password" form and the page confirming its email was sent, the page confirming a password was changed, the onboarding steps, the pricing page and the checkout. It does not run on the two screens opened by a link in an email, account activation and the page where you choose a new password, because those addresses carry a single-use token and a recording captures the address. It never runs on the reader, the chapter editor, the story creation wizard, a profile, your account settings, or the catalogue and its search, so no unpublished draft and nobody’s profile is ever filmed. The home page shows only stories already published, which any visitor can see. What you type into a field is masked before the recording leaves your browser, and the whole of it sits behind the same analytics consent as every other item in this section. Google Analytics 4 receives the first item above and none of the others: the same route, the same identifiers, produced by the same code, so the two cannot differ. We send that route in place of the page title as well, because the title of a GameTale page is a story title, an author’s username, or the name of a draft nobody has published; Google Analytics’ own automatic page measurement, which would have read your browser tab and your address bar instead, is switched off in the first line of its configuration. It receives no email address, no username, no story title, and no free text either. See our Cookie Policy, and section 6.1 below for where it stores that data.
Error reports (PostHog Inc.). When the Service hits an error it did not expect, the error is reported to PostHog so that it can be found and fixed. A report sent by our servers carries only the error code (a fixed label such as email.send_failed), the error’s type, the lines of our code it passed through, the route it happened on, as a pattern and not an address, and the reference number the error page shows you. It never carries the error’s message, it is sent under one fixed identifier for the whole server and with no location, and it carries no account, no IP address and no page address. These reports are sent whatever you chose in the cookie banner, on our legitimate interest in keeping the Service working, because they describe our code and not you. A report from your browser is sent only after you opt in to analytics cookies, never for the account of someone under 18 (section 13), and it travels with the other analytics events described above, with the route in place of the address; it also carries the error’s message, with email addresses, credentials and long tokens removed first, and that message can on rare occasions quote something you entered. They are stored where the analytics above are (section 6.1). Your browser’s IP address reaches PostHog with every analytics event and every error report, but PostHog is configured to discard it on arrival, without storing it; before it is discarded, it may be used to estimate your approximate location (country and city).
Logs, traces and performance metrics (Grafana Labs, Inc., through Grafana Cloud, hosted in Brazil). To find and fix faults and to see how fast the Service runs, our servers send operational telemetry: log lines, each with a fixed event code such as email.send_failed; the route a request used, as a pattern and not an address; how long it took and whether it succeeded; and the technical detail of errors, including the lines of our code they passed through. Before anything leaves our servers, email addresses, IP addresses, credentials and long tokens are removed from it, and it carries no account name, no page address and no cookie. It is sent whatever you chose in the cookie banner, on our legitimate interest in keeping the Service working and secure, because it describes our code and not you. It is stored in Brazil and kept for 14 days.
Authentication providers when you sign in via OAuth.
Banks and payment institutions that carry a Revenue Share payout by PIX or bank transfer, which receive the payee’s name, tax document number and payout destination, as any transfer requires.
Public authorities, courts and the ANPD, when the law or a lawful order requires it, and only what it requires. This includes reporting content reported as child sexual abuse or exploitation to the Polícia Federal (section 7).

We do not sell your personal data, and we do not share it for advertising (section 10).

6. International Transfers

Vercel Inc. (test environments, temporary hosting contingency and performance measurement): LGPD Article 33, IX, read with Article 7, V, for the test environments and the contingency; your specific consent (Article 33, VIII) for the usage and performance measurement, which is switched on only if you accept analytics cookies. GDPR: the European Commission’s standard contractual clauses (Decision 2021/914), incorporated into Vercel’s Data Processing Addendum.
Neon (Databricks, Inc. and Neon, LLC), where the database was kept until it moved to our server, stored in Brazil in Amazon Web Services’ São Paulo region: a frozen copy of the database is kept there for up to 14 days after the move, only in case we need to move back, and then erased; their technical staff in the United States may reach it remotely to provide support, under Databricks’ contractual terms. LGPD Article 33, IX, read with Article 7, V. GDPR: the safeguards set out in Databricks’ contractual terms; a copy can be requested from support@gametale.app.
Cloudflare, Inc. (reverse proxy and content delivery for all traffic to the Service, storage and delivery of uploaded images and audio (R2), encrypted database backup copies and the record of account deletions (R2), DNS, email routing and the Turnstile bot verification, which processes your IP address and browser signals on Cloudflare’s global network): LGPD Article 33, IX, read with Article 7, V, because delivering and protecting the traffic and the verification protect the sign-up and sign-in you use. GDPR: the European Commission’s standard contractual clauses, incorporated into Cloudflare’s Data Processing Addendum.
Plus Five Five, Inc. (Resend), transactional email: LGPD Article 33, IX, read with Article 7, V. GDPR: the European Commission’s standard contractual clauses, incorporated into Resend’s Data Processing Addendum.
Brevo SAS (Brevo), in France, fallback transactional email, used only when Resend refuses a message; it receives your address, the subject and the text of that e-mail, keeps the delivery record and may record, anonymously, whether the e-mail was opened. Its servers are in France and Belgium; some of its sub-processors (such as Google Cloud and Cloudflare) are United States companies. LGPD Article 33, I (ANPD Resolution No. 32/2026, which recognises the European Union as adequate). GDPR: the European Commission’s standard contractual clauses, in Brevo’s Data Processing Addendum.
Google LLC, Mozilla Corporation, Apple Inc. and Microsoft Corporation (browser push services, only for the push notifications you turn on): each receives an encrypted message it cannot read and your device's delivery address. LGPD Article 33, IX, read with Article 7, V. GDPR: the transfer is necessary to deliver the notifications you asked for (Article 49(1)(b)).
Stripe, LLC, card payments: processor and, for its own purposes, independent controller (section 5); LGPD Article 33, IX, read with Article 7, II and V. GDPR: the European Commission’s standard contractual clauses (Modules 1 and 2) in Stripe’s Data Processing Addendum.
PostHog, Inc. (product analytics, session recording and browser error reports): LGPD: your specific consent (Article 33, VIII). GDPR: the European Commission’s standard contractual clauses (Decision 2021/914, Module 2) in the Data Processing Addendum we signed with PostHog on 4 October 2026. Error reports sent by our servers contain no personal data (no account, IP address, page address or error message), so they are not a transfer of personal data.
Grafana Labs, Inc. (logs, traces and performance metrics, stored in Brazil): the data is stored in Grafana Cloud’s Brazil region for up to 14 days, and e-mail and IP addresses are removed before it is sent, as described under sharing. Grafana Labs’ technical staff in the United States may reach it to provide support, under Grafana Labs’ Data Processing Addendum; for the GDPR, that addendum incorporates the European Commission’s standard contractual clauses.
Google LLC (Google Analytics 4): LGPD: your specific consent (Article 33, VIII). GDPR: the European Commission’s standard contractual clauses incorporated into the Google Ads Data Processing Terms, accepted for our Google Analytics account.
GitHub, Inc. (encrypted backup copies): LGPD Article 33, IX, read with Article 7, V. The content is encrypted with a key GitHub does not have.
Oracle Corporation (hosting of the Service and of the database, and the encrypted daily backup copy, on a virtual machine we operate on Oracle Cloud, stored in Brazil, in São Paulo): Oracle's technical staff in the United States may access the infrastructure to provide support; the content of the backup copies is encrypted with a key neither Oracle nor that server has. LGPD Article 33, IX, read with Article 7, V.
Google and Meta (sign-in with Google, Facebook or Instagram): independent controllers. You send your data to them directly when you choose that sign-in.

6.1 Product Analytics Is Hosted in the United States

7. Data Retention

We keep personal data only as long as needed for the purposes described, or as required by law. Concretely:

Account, profile and content data: for as long as your account exists. Deleting your account (in Settings) is normally immediate and permanent: the account and everything tied to it, including your stories, comments, reading progress, the reports you sent and your payout profile, are erased at once. Your uploaded files are removed right after, and a weekly clean-up removes anything left behind. If a deletion is interrupted after it has started, it is completed automatically within about an hour. The exceptions are the items below (financial records, moderation records and the preservation tied to a child sexual abuse report), the backup copies, where erased data can remain for up to 10 days (the “Backup copies” item below), and the deferral described in the notice in this section.
Sessions: until the session ends or expires, at most 90 days after sign-in, plus one day before the expired record is deleted.
Signup source (how you reached GameTale): for as long as the account exists. It is erased with the account and included in the copy of your data.
Backup copies: the database is copied continuously, encrypted, to Cloudflare R2 (in North America), where each copy is kept for up to 10 days (longer only if the full daily copy fails, until the next one succeeds); a full encrypted copy is also made once a day on our server on Oracle Cloud, in São Paulo, which keeps the newest 3, and kept for 7 days on GitHub (GitHub, Inc., in the United States). Erased data can remain in these copies until they expire. They are used only to restore the Service after a failure. So that a restore cannot bring back a deleted account, we keep for 30 days, in private Cloudflare R2 storage, a record of each account deletion holding only the account's identifier and the moment it was deleted, and a restore re-applies the deletions requested after the point restored.
Images and audio you replace or delete without deleting your account (a swapped cover, a deleted chapter): they go offline at once, but are kept out of public reach for 11 days, so that a database restore after a failure does not leave stories without their images; then they are erased. When you delete your account, your files are erased at once, without that period.
Chapter view records, which carry a keyed hash of the IP address: 30 days.
Revenue Share reading time and its fraud signals: 400 days, because a settlement, a refund or a dispute can reach back into earlier months; deleted sooner if the account is deleted.
Writing-pattern signals: the records of a single save adding more than 3,000 words are deleted after 400 days (about 13 months); the word count of each published chapter version is kept with that version and deleted with it.
Billing data: your subscription records while your account exists. The payment notifications Stripe sends us have their personal details (name, email, phone, address and card details) removed after 30 days. The accounting record of each subscription payment (amount, date and invoice reference) is part of GameTale’s own books and stays in them after account deletion, but no longer linked to your account. When the tax period in the next item ends, the payment processor’s customer and subscription references are removed too, and nothing in that record links the payment to you any more. Pix charges (amount, period, dates, status and the charge’s Asaas identifier) follow the same rule as subscription records. Asaas keeps the payer’s name, email and CPF for the periods the law requires of it, such as those on preventing money laundering, under its own privacy policy; deleting your GameTale account does not erase that record at Asaas.
Financial records (Revenue Share earnings records, each paid payout with the destination it was paid to, and the records of a subscription being ended): a record from a given year is kept until 1 January of the sixth year after it, the period during which the tax authorities may review it (article 173, I, of the Brazilian National Tax Code), and then erased. For example, a record from 2027 is kept until 1 January 2033. It may be kept longer if the law or a pending proceeding requires. These records are kept even after the account is deleted, no longer linked to it. A payout request that was rejected loses its copy of the payout destination when the account is deleted.
Waiver records: if you delete your account while you still have Revenue Share amounts and choose to waive them, we keep a record of the amounts waived, the version of the terms and the date. It holds no personal data other than the identifier of the former account and follows the same period as the previous item: it is kept until 1 January of the sixth year after the year of the waiver (article 173, I, of the Brazilian National Tax Code), or longer if the law or a pending proceeding requires, and then erased.
Retired usernames: when an account is deleted or renamed, the old username is kept on a list so that nobody else can take it and pass themselves off as you. The list holds the name and the date, not your data.
Reports: kept while needed to handle the report and any appeal, and deleted with the account that sent it, except a report of child sexual abuse or exploitation, which follows the preservation item below. A report also reaches our support inbox by email, and that copy is kept as long as needed to handle it.
Moderation records (suspensions, bans and their lifting): for as long as the account exists. After the account is deleted, they lose their link to it and are kept for 5 years from the date of each decision, the period in which a claim can still be brought (article 27 of the Brazilian Consumer Defence Code), and then erased.
Preservation of child sexual abuse or exploitation reports: when a story, a profile or a comment is reported for that reason, we preserve, beyond the reach of any deletion including account deletion: the report, with the reporting account’s identifier, email and username; the reported content, including the text of every chapter, published and draft; copies of the media files (images and audio); and the responsible account’s identifier, email, username, name, account creation date and date of birth. This material is kept for 6 months (Marco Civil da Internet Art. 15; ECA Digital Art. 27 §2), or longer if an authority asks, and then erased. The operator reports the case to the Polícia Federal through the Centro Nacional de Triagem de Notificações, the national notification triage centre (ECA Digital Art. 27; Decreto nº 12.880/2026, Arts. 36 to 39).
Waitlist: until you leave the list (on the waitlist page itself) or delete your account. It is used only to send one email when paid plans launch.
Feedback: 2 years from when it was sent, and then erased. Feedback sent while signed in is erased sooner, with the account, if the account is deleted first.
Analytics and error reports: kept by each processor under the retention settings of its service; session recordings are deleted after 30 days. Logs, traces and performance metrics: 14 days, in Brazil. Write to support@gametale.app to learn the current period for the rest.
Server logs: kept on the machine we operate on Oracle Cloud. Access logs hold your truncated IP address and no URL query, cookies or referring page, for up to 7 days; system logs, which include the address of anyone who tries to connect to the server, for up to 14 days; application logs hold no IP address, email or message content and are size-limited. The operational logs sent to Grafana Labs follow the retention described for it. We make no other copy.
Support emails: as long as needed to resolve your request, and afterwards only while we may need them to defend a claim.

When data is no longer needed, we delete or anonymize it.

8. Your Rights

Under LGPD Article 18 and GDPR Articles 15 to 22, and subject to applicable law, you have the right to:

Confirm whether we process data about you, and access that data.
Correct incomplete, inaccurate, or outdated data.
Have unnecessary or excessive data, or data processed unlawfully, anonymized, blocked or deleted.
Request portability of your data in a machine-readable format.
Request deletion of your account and personal data, except the records the law requires us to keep (section 7).
Know which public and private entities we share your data with.
Know that you may refuse consent and what follows if you do, and withdraw consent at any time.
Object to or restrict certain processing activities, in particular those based on legitimate interests.
Ask for a review of a decision taken solely by automated means that affects your interests (LGPD Article 20). The “For you” shelf is built automatically from the genres you chose, but it decides nothing that affects your interests; you can ask for a review and turn it off at any time in Settings (section 4.5). Besides it, GameTale runs three automatic checks. The Revenue Share fraud signal and the writing-pattern signals only hold earnings for a person to decide. The pause of an account whose holder is not yet 17 is worked out automatically from the date of birth; if the date is wrong, you can ask for a review by writing to support@gametale.app with proof of the correct date (section 8.1).
Lodge a complaint with the competent data-protection authority: in Brazil, the ANPD; in the European Economic Area, the supervisory authority of the country where you live or work.

We answer within 15 days (LGPD Article 19), and never later than the period the law that protects you allows. Exercising these rights is free.

8.1 Right to Rectification (Art. 16 GDPR / Art. 18 III LGPD)

For anything else you cannot update yourself, for example a story attribution dispute or an audit-log correction, email support@gametale.app from the address on file.

9. Cookies, Do Not Track and Global Privacy Control

10. No Sale of Data and No Advertising

11. What Other People Can See

While an account is suspended, banned or paused for age, its profile, stories and comments are hidden from the public. Nothing is deleted because of it, and they reappear when the measure ends.

12. Security

13. Minors

14. Changes to This Policy

15. Contact

For privacy questions and general support, contact support@gametale.app. You can also reach the controller at support@gametale.app.

Privacy Policy

1. Who Is Responsible for Your Data

1.1 Representative in the European Union

2. Minimum Age

3. Data We Collect

3.1 Revenue Share Data

4. Purposes and Legal Bases

4.1 OAuth Sign-In

4.2 Email and Password

4.3 Date of Birth

4.4 Revenue Share

4.5 Story suggestions (profiling)

5. Sharing With Third Parties

6. International Transfers

6.1 Product Analytics Is Hosted in the United States

7. Data Retention

8. Your Rights

8.1 Right to Rectification (Art. 16 GDPR / Art. 18 III LGPD)

9. Cookies, Do Not Track and Global Privacy Control

10. No Sale of Data and No Advertising

11. What Other People Can See

12. Security

13. Minors

14. Changes to This Policy

15. Contact

15.1 Brazil (LGPD) Notice

Privacy Policy

1. Who Is Responsible for Your Data

1.1 Representative in the European Union

2. Minimum Age

3. Data We Collect

3.1 Revenue Share Data

4. Purposes and Legal Bases

4.1 OAuth Sign-In

4.2 Email and Password

4.3 Date of Birth

4.4 Revenue Share

4.5 Story suggestions (profiling)

5. Sharing With Third Parties

6. International Transfers

6.1 Product Analytics Is Hosted in the United States

7. Data Retention

8. Your Rights

8.1 Right to Rectification (Art. 16 GDPR / Art. 18 III LGPD)

9. Cookies, Do Not Track and Global Privacy Control

10. No Sale of Data and No Advertising

11. What Other People Can See

12. Security

13. Minors

14. Changes to This Policy

15. Contact

15.1 Brazil (LGPD) Notice