Privacy Policy

1. Who We Are

LoreHub is operated by Twilight Works Ltd, a company incorporated in England and Wales (company number 17373842), whose registered office is at Suite RA01, 195-197 Wood Street, London, E17 3NU, United Kingdom. That company is the data controller for personal data collected through LoreHub.ai. Data protection contact: [email protected]

2. Data We Collect

Account data

Name, email address, password hash, plan type, locale preference, profile information you provide.

Cookies and similar technologies

A session cookie and CSRF token to keep you signed in and secure; a small set of functional cookies that remember your language, currency, and country. See our Cookie Policy for the full list, and for the consent-gated cookies described below.

Product usage events

We record a small set of first-party events tied to your account — for example, that you started a wizard, created a world, or generated a chapter — so we can see where people get stuck in the product and improve it. These events are stored for up to 12 months and then deleted automatically.

Session replay data (with consent)

If you grant the Analytics & Replay consent category, Microsoft Clarity records session replays and heatmaps of how you use the Platform — mouse movement, clicks, scrolling. Clarity never loads until you consent, and we configure it to strict masking so page text like your name and email address is hidden before it ever leaves your browser. Full disclosure in "Third-Party Services" below.

Content data

World entities, books, characters, and generation directives you create. Private content is not accessible to LoreHub staff except when required for support at your explicit request.

Uploaded and imported content

If you use the import feature, we process the files and works you upload to provide the service — parsing them, extracting structure, and generating content on top of them. You confirm the legal basis for each upload (author, public domain, or personal use). Uploaded content remains yours; see our Content & IP Policy for how ownership works.

Payment data

Payment is processed by Stripe. We receive only a payment confirmation token — we never store your card details.

Technical data

IP address, browser type, device type, session data, and error logs. Retained for up to 90 days for security and debugging purposes.

3. How We Use Your Data

• To provide and maintain the Platform services
• To process payments and manage subscriptions
• To send service notifications, security alerts, and billing updates
• To send the Journal newsletter (if subscribed — opt-out any time)
• To detect and prevent fraud, abuse, and security incidents
• To understand product usage and improve activation and retention, using first-party account-linked events and, only with your consent, Microsoft Clarity session replay

4. Your Rights

Under applicable data protection law, you have the right to:

• Access — request a copy of the personal data we hold about you
• Rectification — correct inaccurate data
• Erasure — request deletion of your account and associated data
• Portability — receive your content in a machine-readable format
• Objection — object to processing based on legitimate interests, and withdraw cookie consent at any time via "Cookie preferences"
• Restriction — request that we limit processing in certain circumstances

To exercise any of these rights, email [email protected]. We will respond within 30 days.

5. Data Retention

Active account data is retained for the lifetime of your account. On account deletion, personal data is removed within 30 days. Content you published to the Marketplace may be retained in anonymized form for platform integrity. Billing records are retained for 7 years as required by tax law. Product usage events are retained for up to 12 months. Records of your cookie-consent choice are kept for as long as your account exists, as evidence of what you consented to.

6. Third-Party Services

We use Stripe for payments, server infrastructure in Frankfurt, Germany (European Union) for hosting, and Resend for transactional email. Each is bound by an appropriate data processing agreement. We do not sell your personal data.

Microsoft Clarity — with your Analytics & Replay consent, we use Microsoft Clarity for session replay and heatmaps, to understand how LoreHub is actually used. Clarity is a Microsoft product, and Microsoft may use the resulting data in connection with Microsoft Advertising; Clarity also sets its own third-party cookies. This involves an international transfer — some Clarity data is processed by Microsoft outside the UK, under Microsoft's appropriate safeguards for that kind of transfer. Clarity never loads until you grant the Analytics & Replay category, and we configure it to strict masking.

Google AdSense (planned) — we intend to show advertising through Google AdSense to help keep books free to read. AdSense is not enabled yet; when it is, it will run only for visitors who grant the Advertising consent category.

You can review, change, or withdraw any of these consent-gated categories at any time via "Cookie preferences" — see our Cookie Policy.

We keep these documents under review and recommend you take independent legal advice on any that affect you.