Privacy policy

Who is responsible

GainTrack LLC, a Kansas company at 920 N. Tyler Rd Ste 304 #585, Wichita, Kansas 67212, US, operates Realmly and is responsible for the personal information described here. Contact contact@realmly.co for privacy requests, security reports or questions.

Information we use

• Accounts: email, account identifier, authentication information and terms acceptance. Supabase handles password hashing. An enabled sign-in provider may also supply a name, avatar and provider identifier. We use these to create and secure your account.
• Creative work: the worlds, maps, art, articles, private notes, relationships, revisions and settings you save. We process these to provide editing, storage, sharing and exports.
• Service activity: usage counts, rate-limit records, request metadata and errors needed to prevent abuse, enforce allowances and diagnose failures. Infrastructure providers may receive your IP address, browser information and request times.
• Payments: when paid plans are available, Stripe processes payment details. Realmly stores customer and subscription identifiers, plan/status and billing-event records. We do not store full card numbers or card security codes.
• Communications: information you send when requesting help and delivery information for account and service emails. Withdrawal and refund requests include your name, account email, contract reference, declaration, receipt time and resolution. These records may be retained after account deletion where needed for consumer obligations or disputes. Do not send passwords or payment card details to support.

Public generators and examples can be explored without an account. We do not ask for your postal address, phone number or birth date to create an account. Payment providers may require billing details for payments, taxes or fraud checks.

Optional AI and service providers

When you request AI-assisted lore, relevant entry text and selected world context are sent to Anthropic. These requests may include private information you put in that context. Ordinary procedural map, city and space generators do not need an AI provider. AI image generation is not enabled in the launch service.

We do not use private content to train our own AI models. Provider processing and retention depend on the service and contract in use; we do not promise that external providers retain no data. Review your context before requesting an AI feature.

Vercel hosts Realmly. Supabase supplies authentication, database and file storage; our production database is in its US East region. Stripe processes payments, Resend delivers account and service emails, and GitHub stores independently encrypted recovery archives. An enabled identity provider processes its sign-in service. These providers and their subprocessors may process information in the United States and other countries.

We do not sell personal information, run advertising trackers or share information for cross-context behavioral advertising. We may disclose information to meet legal obligations, address fraud or security threats, or complete a business transfer subject to applicable safeguards. Staff and contractor access is limited to service, support and security needs.

Sharing and external content

A world is private unless you enable sharing. Anyone with a sharing link can read its published view, excluding hidden lore and private session preparation. Revoking a link prevents future access through it but cannot recall copies already captured by recipients.

Images you reference from another website can send your IP address and request information to that host when loaded. Upload images if you prefer storage managed by Realmly. Do not publish sensitive information about yourself or others.

Retention and deletion

Account information and saved content remain while your account is active. Entry edits may remain in revision history. Deleting a world or account removes associated active content and files; account deletion first cancels recurring subscriptions. If a required step fails, the account remains so you can retry or contact support.

Deletion does not immediately erase disaster-recovery backups, legally required payment and tax records, or records needed for disputes or security incidents. Those records are restricted to their necessary purpose. Our daily encrypted recovery archives are scheduled to expire after seven days. After a recovery, we reapply deletion requests received since the snapshot before reopening access.

Routine hosting and database diagnostic logs are available to us for approximately one day under our current provider plans. Account security history, support correspondence, payment records and records preserved for an investigation may remain longer where needed to secure the service, resolve your request or meet legal obligations. Provider security and legal retention may also differ from our access to routine logs.

Controls and privacy rights

You can edit content, revoke sharing, export portable backups and delete your account in settings. Backups include supported stored images and private content within the file limit; external images may remain links. Keep exports secure.

Depending on your location, you may have rights to access, correct, delete or receive information, restrict or object to processing, withdraw consent, and appeal privacy-request decisions. Contact contact@realmly.co. We may verify account ownership but will not ask for your password. You may complain to your local data protection authority. We do not discriminate against you for exercising applicable rights.

International processing and legal bases

We operate in the United States; providers may process data in other countries. Where required, applicable data-processing agreements and transfer safeguards must cover that processing. Contact us for information about the safeguards applicable to your data. Where European or UK law applies, service processing is generally necessary for our contract with you, security processing serves our legitimate interests, required records meet legal obligations, and optional activities rely on consent where required.

Children, security and changes

Realmly is not directed to children under 13. Users must also meet higher local age or parental permission requirements. Contact us if a child has supplied information in breach of those requirements. We use access controls and technical safeguards but cannot guarantee absolute security.

We will update this notice as practices change and provide required notice of material changes. See the cookie and storage policy for browser controls and our Terms of service for the service agreement.