Privacy Policy

Lore & Play ("Lore & Play", "we", "us") is a web-based platform for running tabletop roleplaying games, available at https://lorenplay.com.

For the purposes of the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR") and Greek Law 4624/2019, the data controller is:

Kornilios Ampatzis

Thessaloniki 554 38, Greece

Email: privacy@lorenplay.com

We have not appointed a Data Protection Officer, as we do not meet the criteria in Article 37 GDPR. Contact us at the address above for any data protection matter.

This policy covers personal data we process when you:

• create and use a Lore & Play account;
• take part in a game session hosted on Lore & Play, including as a player who does not have an account;
• visit our public website.

3.1 Account data

3.2 Content you create

Campaigns, worlds, characters, homebrew creatures, items, notes, codex entries, uploaded images, maps and audio files.

Purpose: providing the service. Legal basis: Art. 6(1)(b).

This content may contain personal data if you choose to put it there. Please do not store other people's personal information in campaign notes.

3.2a Translation contributions

If you help check our Greek translations, we store your verdict on each entry, any wording you suggest, and any comment you write. Your username is shown beside these to other contributors and to administrators — they are not anonymous, and they are not shown inside the game text that ordinary readers see.

Purpose: improving the translated rules text. Legal basis: Art. 6(1)(b), and the licence you grant when you make your first contribution.

If you delete your account, contributions stay but the attribution to you is removed, because accepted wording may already form part of the text other people are reading.

3.3 Session transcripts and voice capture — please read this section

This is the most sensitive processing we carry out and we want to be explicit about it.

What happens. When a Dungeon Master switches on the table's microphones during a session, speech is converted to text and stored against that session. Each player opens their own microphone, on their own device, from the campaign's live table — so what you say is attributed to you by name. Everyone whose voice is transcribed has an account with us and is a member of that campaign; there is no way for an anonymous visitor to be recorded.

Two different modes, with very different privacy consequences:

What we store. The resulting text, a timestamp, and the speaker name shown in the session. We do not retain raw audio recordings after transcription.

Everyone at the table can read the transcript as it is written. This is deliberate: a live transcript is what lets a deaf or hard-of-hearing player follow the game. It is visible to the Dungeon Master and to the other members of that campaign, and to nobody else.

Sorting out who actually spoke. When several people sit in one room, every device hears every voice, and the same sentence arrives several times under the wrong names. To decide which microphone was closest to the person speaking, your device measures how loud the sound was relative to the quiet of your own room and sends that number — two decibel readings — alongside the text. This is a loudness measurement and not a voiceprint. It cannot identify anybody, it is not biometric data, no audio is kept, and nothing about the sound of your voice is stored or sent anywhere.

Uploaded recordings. A DM may also upload a recording of a past session instead of transcribing live. Because a long recording has to be split up before it can be transcribed, that file is written to our server for as long as the job runs — usually minutes — and each piece is deleted the moment it has been transcribed, along with the whole upload when the job finishes, fails, or is cancelled. Nothing is kept afterwards, the file is never served or shared, and it does not appear in a data export because by then it does not exist. If you would rather no audio reached us at all, transcribe on your own machine and import the resulting text file — that path costs nothing and the audio never leaves your computer.

Reading a transcript back against your campaign notes. Once a session has been transcribed, a Dungeon Master can ask us to compare it — along with their notes, recap and battle maps — against the campaign's own Codex, and list the names that came up but were never written down. This comparison runs entirely on our own servers and involves no AI provider: it is text matching, not interpretation, and nothing about the session leaves us in order to produce it. It reads only content belonging to that campaign, it writes nothing on its own, and every suggestion is discarded unless the DM explicitly accepts it. Purpose: helping a DM keep their own campaign records complete. Legal basis: Art. 6(1)(b), as a feature of the service the DM signed up for; the underlying transcript remains covered by the consent described below.

Vocabulary hints. So that invented names are transcribed correctly, we may send the list of names already in a campaign's Codex to the transcription provider along with the audio. These are place and character names from a work of fiction; where a name happens to be a real person's, it is one already written into the campaign by the DM.

Legal basis. Art. 6(1)(a) — your consent, given before your microphone ever starts.

You are asked once, not on every visit. We record that you gave it: the time, which version of the on-screen notice you were shown, whether you agreed to on-device recognition or to cloud transcription, and your IP address and browser at that moment. Each session in which you then actually open your microphone gets its own short record, so that a transcript can still show consent was in force on the night it was made.

Withdrawing. Go to Settings → Table microphone. You can read there exactly what you agreed to and withdraw it with one button; your microphone stops on every device immediately, and you will not be recorded again unless you agree afresh. Closing the page or pressing Stop also ends that session's recording. Withdrawal does not delete text already captured — ask your DM to delete your lines, or contact us.

Agreeing to on-device recognition is not agreeing to cloud transcription. Cloud is a separate confirmation, and your DM has to permit it for you individually; it is never switched on for you automatically.

Your name in a transcript is the character you play at that table, or a name you set yourself. You can change it at any time from the live table; changing it does not rewrite lines already recorded.

*Until 4 September 2026 a player could be recorded without an account, through a link their DM shared. That path has been removed. The consent records made under it are kept, because they are the evidence for transcripts that still exist; they are deleted with the session they belong to.*

Your responsibilities as a DM. If you enable transcription, you are responsible for telling everyone present that the session is being transcribed, and for not enabling it if anyone objects. In some jurisdictions, recording a conversation without the knowledge of all participants is a criminal offence. Do not enable transcription covertly.

3.4 AI features

When you use the in-session assistant, DM briefs, smarter transcript search, or AI art generation, the relevant content — your prompt, and context drawn from the session transcript, codex and character sheets — is sent to an AI provider for processing.

Importing a campaign. If you use Import my campaign, the notes you paste or upload are sent to the same AI provider so that entries can be extracted from them. We keep the original text only until you finish reviewing the result, and delete it then; if you never finish, it is deleted automatically after 7 days. What is saved to your campaign is what you approved, not the file. Please only import notes you are entitled to hold — published adventure text you have bought is fine to keep as your own private notes, but do not upload material you do not have the right to.

Legal basis: Art. 6(1)(b), as these are features of the service you have signed up for.

If you supply your own API key, your content is sent directly to that provider under your own account and your own agreement with them. In that case we act as a technical conduit and that provider's terms and privacy policy govern the processing. We do not receive or retain a copy for AI purposes.

We do not use your content to train AI models, and we require the same of our providers via their API terms.

3.5 Technical data

IP address, browser type and version, and pages visited, recorded in server logs.

Purpose: security, abuse prevention, diagnosing faults. Legal basis: Art. 6(1)(f). Retention: 30 days.

3.6 Cookies

We use only cookies that are strictly necessary to operate the service: a session cookie to keep you logged in, and preference cookies storing your chosen language, theme, dice appearance, and whether pages animate and make a sound. If you turn on two-step verification, a short-lived cookie carries your sign-in between the password step and the code step, and is discarded as soon as you finish. Administrators additionally receive a short-lived cookie while they are using the "view as" support tool, which is never set on anyone else's browser. Every form you submit is guarded by a security token cookie: it holds a random value with nothing in it that identifies you, and it exists so that another website cannot make your browser act on your behalf. These do not require consent under Article 5(3) of the ePrivacy Directive.

We do not use advertising or third-party analytics cookies. If that changes we will publish a cookie policy and ask for your consent first.

3.7 Bug reports and suggestions

If you press Report a bug or Suggest an improvement, we store what you wrote, and — for a bug report only — a small, fixed set of technical facts collected automatically: the page you were on, your browser and its version, your screen size, your language and time zone, the build of the app your browser was running, and the last request that failed, meaning its method, path, status code and a short extract of the error message. Any browser console errors from the preceding 30 seconds are included. The form lists all of this before you send it.

We never send the contents of your campaigns. Two things are attached only if you choose them, each with its own tick: a screenshot, which you take through your browser's own window picker and can paint over before sending, and the identifier of the campaign you were in — the id alone, never anything inside it.

Purpose: finding and fixing faults, and deciding what to build. Legal basis: Art. 6(1)(f) — legitimate interests, and Art. 6(1)(a) — your consent, for the screenshot and the campaign identifier. Retention: 24 months for the report; 90 days for any screenshot, which is deleted while the report itself is kept.

We reply to every report we can. If you are signed in we use your account's email address; if you are not, we use whatever address you give us, and without one there is nowhere for an answer to go.

• Your campaigns, characters and notes are visible to you, to players you invite to that campaign, and to Lore & Play administrators where necessary for support or security.
• Content you publish — homebrew you mark as published, characters you make public, gallery assets you share — becomes visible to other users. Publishing is always your choice and reversible.
• Session transcripts are visible to the DM of that campaign and to players in it.
• Administrators can access account data and, where strictly necessary, user content, for support, security and abuse investigation. Administrator access is limited to 1 people, and every occasion on which an administrator views the service as another user is recorded with a timestamp and a record of anything changed.

We do not sell personal data. We do not share it for advertising.

• Your picture, if you upload one, is shown next to your name to people who share a table with you: your friends, the members of your guilds, the players in your campaigns, and campaign chat. You can remove it at any time from your profile, and without one you appear as your initials.
• The group finder is a separate, opt-in surface, described in section 4a below.
• Friends and presence are described in section 4b below.

The group finder is the one place in Lore & Play where you may be seen by people you have never met, so it works differently from everything else and is switched off for your account until you choose otherwise.

• It is opt-in. You appear on the board only after you create a group-finder profile. Deleting that profile removes you from the board entirely and takes your posts down with it; your account, campaigns and characters are untouched.
• It is visible only to signed-in members. There is no public view, it is excluded from our sitemap and marked "noindex", and search engines are not invited to it.
• It is for adults. Members under 18 cannot use it, even though the rest of the service is open from 15. Where your account has no date of birth on record we ask for one before letting you in, and store it once.
• What other members see: the display name, blurb, country, city or area, time zone, languages, availability and experience level on your profile, plus whatever you write in a post. If you attach a character to a post, other members see only its name, class, level, ancestry and portrait — never the sheet, the inventory or anything else.
• We ask you not to put contact details in a post, and the form will refuse an email address, phone number or invite link rather than quietly removing it. Share those directly once you have agreed to play together.
• Posts expire after 30 days unless you renew them, and we email you once, three days before, to ask whether you still want the post up.
• Blocking removes you from each other's view and prevents any further contact between you in either direction. Private notes you write about a connection are visible only to you and are never shown to the person they are about.
• Reports you make are kept, along with a copy of the reported content as it was at the time, so that deleting a post does not destroy the record. Reports are retained even if the account they concern is deleted, because an abuse record that disappears on request is not a record.

You can connect to other members you already play with. This is separate from the group finder: it does not put you on a board and it is not restricted to adults.

• A friend list is a social graph. We store who you are connected to, and when the connection was made. Both sides of a connection are recorded, because a friendship that only one person can see is not one.
• Connecting takes both people. A request is sent, and nothing durable is stored until it is accepted. Declining leaves nothing behind.
• Private notes you write about a friend are visible only to you. They are never shown to the person they are about, they are included in *your* data export, and they are excluded from theirs.
• Presence. Your friends can see whether you are online, roughly when you were last here, and whether you are at a table right now. We do not keep a history of it — there is no record of where you were and when, only the current state and a single "last seen" timestamp. You can turn presence off entirely in Settings, and your friends then simply see nothing.
• Blocking works the same way it does in the group finder: it removes you from each other's view and prevents any further contact in either direction, including invitations to campaigns and guilds.
• Deleting your account deletes your connections, your blocks and your private notes, on both sides.

We use these third parties to deliver the service. Each processes personal data on our instructions under a data processing agreement.

If you supply your own provider key, that provider (OpenAI, Anthropic or Google, as you choose) processes your content under your own account, not ours.

We will update this list before adding any new sub-processor.

Our hosting and database are located in the European Economic Area.

Transfers to OpenAI in the United States are made under the Standard Contractual Clauses adopted by the European Commission, and/or the EU–US Data Privacy Framework where the recipient is certified. You may request a copy of the relevant safeguards at privacy@lorenplay.com.

When you delete your account, we delete your personal data and content within 30 days, except where we are legally required to retain something. Backups are purged on a rolling 30-day cycle. You can start this yourself from Settings → Your account → Delete my account.

Export. You can export your data at any time from Settings → Your account → Export my data, as a ZIP archive of JSON files plus your uploaded images and maps.

Tabletop roleplaying is played by people of all ages, and we take this seriously.

Lore & Play is not intended for children under 15. Under Greek Law 4624/2019, Article 21, a child in Greece may consent to information society services from the age of 15; below that age, consent must be given or authorised by a person with parental responsibility.

We ask for your date of birth at registration. If you are under 15, you may not create an account.

Important for DMs: if minors play at your table, do not enable session transcription without the informed agreement of a parent or guardian. Voice data of a child is a serious matter and we would rather you turned the feature off.

If we learn that we hold data of a child under 15 without proper authorisation, we will delete it promptly. Contact privacy@lorenplay.com.

Under the GDPR you have the right to:

• access the personal data we hold about you (Art. 15);
• rectify inaccurate data (Art. 16);
• erase your data — "the right to be forgotten" (Art. 17);
• restrict processing (Art. 18);
• data portability — receive your data in a machine-readable format (Art. 20);
• object to processing based on legitimate interests (Art. 21);
• withdraw consent at any time, where processing is based on consent (Art. 7(3)).

Access, erasure and portability are available directly in the product, under Settings → Your account. For anything else, email privacy@lorenplay.com. We will respond within one month.

Right to complain. If you believe we have handled your data unlawfully, you may lodge a complaint with the Greek Data Protection Authority:

Αρχή Προστασίας Δεδομένων Προσωπικού Χαρακτήρα

Λ. Κηφισίας 1-3, 115 23 Αθήνα

+30 210 6475600 · contact@dpa.gr · www.dpa.gr

You may also complain to the supervisory authority in your own EU country of residence.

We protect your data with encryption in transit (TLS), hashed passwords, access controls limiting administrator access to those who need it, and regular backups.

No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the Greek DPA within 72 hours and, where the risk is high, notify you directly without undue delay.

We will post any changes here and update the date at the top. For material changes we will notify you by email or an in-app notice at least 14 days before they take effect.

privacy@lorenplay.com Thessaloniki 554 38, Greece