FANTASIA PRIVACY POLICY

Effective Date: October 1, 2025
Last Updated: November 11, 2026
Version: 2.0

1. WHO WE ARE

Fantasia is a Play by Post role-playing platform with AI features. It consists of a desktop application (Windows and macOS), a web app at app.fineapps.gr (which you can install on a phone as a web app), and our cloud services.

The data controller is Dimitrios Daskaleas, trading as fineapps, Kallikratida 53 Piraeus 18544, Greece ("we", "us"). Privacy contact: fantasia@fineapps.gr (subject line "PRIVACY - …"). We have not appointed a Data Protection Officer; this address reaches the controller directly.

This policy explains what personal data Fantasia processes, why, with whom it is shared, how long it is kept, and your rights.

2. WHAT WE COLLECT

2.1 Your account

• Email address and username (required); display name, bio, profile picture, favourite games (optional).
• Password, stored only as a one-way hash. If you sign in with Google, Facebook or Apple, the provider's account id instead.
• Discord account, if you link it: Discord id, username, avatar, and the sign-in tokens Discord issues (stored encrypted, refreshed automatically).
• Settings: language, font, privacy choices, romance-content preferences, and whether you have turned on Young Adult (YA) protection.
• Your Claude plan tier (for example Pro or Max), so Fantasia knows which AI features your desktop can run. Your Claude sign-in itself never leaves your device.
• Ranks and status: your user and Game Master ranks, last sign-in and last-online times (your friends can see when you are online).

2.2 What you create and do in Fantasia

• Games, worlds, levels, posts, characters, character sheets and their history, notes, reactions, objections and votes.
• Private messages, friendships, friend requests, blocks and notifications.
• Your conversations with the Familiar (the AI companion) and the memory it keeps about you: facts and preferences you share, notes on your relationship with it, summaries of past conversations and of the games you work on. These are stored on our servers so they follow you across devices.
• Player analysis (Herodotus): unless you turn it off in Settings, the AI of the games you play in builds a profile of your play style and preferences, plus per-session and per-character summaries. See section 7.
• Translations of posts, cached so every reader of a language gets the same translation.

2.3 Payments

Payments are made through Stripe. We store your Stripe customer id, your subscriptions and their status and history. Stripe holds your card and billing details; we never see your card number. If you are a Game Master who charges for a game, we also store your Stripe Connect account id and its status; the identity checks Stripe requires happen at Stripe.

2.4 Technical data

• Your signed-in sessions and "remember me" sign-ins, with a short description of the device and platform. Sign-in tokens are stored only as hashes.
• Which version of the desktop or web app your account uses.
• Your IP address is used briefly to rate-limit requests and prevent abuse. We do not store it in our database; our hosting providers keep it in their logs.
• Server logs of requests and errors.

2.5 Safety and moderation records

Records of content violations in Young Adult games, warnings, bans and their reasons, removals from games, and the automated messages sent to you about them.

2.6 People who never signed up: Discord imports

A Game Master can import a game's history from Discord. For each Discord author who has no Fantasia account, Fantasia creates a placeholder account holding their Discord id, username and display name, and their real email address if the Game Master provides it, so that the imported posts keep their author. Fantasia's AI may also link posts by deleted Discord users across sessions. If this is you, you have every right described in section 10; write to us to see, correct or delete this data.

2.7 What we do not collect

Card numbers, government ID numbers, biometric data, or your Claude password or sign-in tokens (these stay on your device).

3. WHY WE USE IT, AND ON WHAT LEGAL BASIS

• To provide Fantasia (accounts, games, posts, messages, the Familiar, sync across devices): performance of our contract with you (GDPR Art. 6(1)(b)).
• Payments and Game Master payouts: performance of contract; keeping payment records: legal obligation (Art. 6(1)(c)).
• Player analysis (Herodotus): our and the Game Master's legitimate interest in a story that responds to its players (Art. 6(1)(f)). It is on by default and you can object at any time by turning it off in Settings.
• Security, abuse prevention and enforcing our Terms, including Young Adult safety: legitimate interests and, for child safety, the protection of minors.
• Account emails (verification, password reset): performance of contract. We send no marketing.

4. WHO RECEIVES YOUR DATA

4.1 Our service providers (processors)

• Render (United States, Ohio): our servers, database and cache.
• Cloudflare (global network): the web app, an edge service that serves game data quickly, and storage of game snapshots.
• Cloudinary (United States): profile pictures and uploaded images.
• Resend: account emails.
• Stripe: payments and Game Master payouts.
• Google, Meta (Facebook), Apple and Discord: sign-in and account linking, when you use them.

4.2 Anthropic (Claude), through the person running the AI

Fantasia's AI features (the Familiar, the AI storyteller Aeschylus, the Herodotus analysis, the Young Adult content scan, AI Rewrite and AI translation) run on a user's own computer, through the Claude account signed in there. When they run, the content they work on is sent to Anthropic under that person's Claude account and Anthropic's terms. This includes other players' posts, characters and profiles when a Game Master's AI runs a game. Fantasia itself has no AI account and its servers do not send your content to any AI provider.

4.3 Other users

• Your username, display name, profile (unless you hide it), characters and posts are visible to the people in your games, and public game listings to everyone signed in.
• Your player analysis is visible to other users by default; you can make it private in Settings.
• When you subscribe to a Game Master's game, the payment is made to the Game Master's own Stripe account: the Game Master is the seller and can see your billing name, email and payment status in Stripe.
• A warning badge appears in the app on accounts with repeated violations in Young Adult games, shown to Game Masters and Young Adult accounts.

4.4 Embedded third-party content

Some games embed TikTok videos. Playing one loads TikTok's player, and TikTok may then set its own cookies and receive data about you under its own policy. The fineapps.gr website loads Google's sign-in script, which may do the same.

4.5 What we never do

We do not sell personal data, show advertising, or share your email address or payment data with other players.

5. WHERE YOUR DATA IS

Our servers and database are in the United States (Ohio); game data is also served and stored on Cloudflare's global network. Transfers outside the European Economic Area rely on the EU-US Data Privacy Framework where the provider is certified under it, and otherwise on the European Commission's Standard Contractual Clauses in our providers' data processing terms.

6. HOW LONG WE KEEP IT

• Your account data is kept until you delete your account. We do not delete inactive accounts.
• When you delete your account (in the app: Settings → Delete account), your profile, private messages, Familiar conversations and memory, analyses, settings, sessions and notifications are deleted at once.
• Your posts in shared games stay, no longer linked to you, because they are part of the other players' story. Your characters stay in their games as non-player characters, but their character sheets are deleted. Games and worlds you ran are kept for their players under a system account.
• Cancel any paid subscription before deleting your account: deleting the account does not yet cancel subscriptions at Stripe. We are fixing this.
• Payment records are kept by Stripe and, unlinked from your account, by us, for as long as tax and accounting law requires.
• Copies may remain in our database backups and in stored game snapshots for a limited period after deletion.

7. AI, PROFILING AND AUTOMATED DECISIONS

• You are talking to an AI. The Familiar and the AI storyteller are AI systems, not people, and they can be wrong.
• Player analysis: Herodotus builds a profile of your play style to help Game Masters run better stories. It is on by default; turn it off in Settings → Privacy and it stops.
• Young Adult games: when the Game Master of a game marked suitable for minors runs Fantasia's AI tools, the game's posts are checked by AI on that Game Master's computer for content unsuitable for minors. This is not continuous and cannot catch everything.
• Automated decisions: confirmed violations in Young Adult games lead automatically to a warning, then a 7-day suspension, then a permanent ban, and suspended or banned accounts lose their paid subscriptions. These decisions are made by software. You can contest any of them by writing to fantasia@fineapps.gr (subject "APPEAL"), and a person will review it.
• AI Rewrite: your draft goes from your computer to Anthropic under your own Claude account. Our servers do not receive the draft, only the post you publish.

8. CHILDREN

If you are under the age of digital consent in your country (15 in Greece), you may use Fantasia only with the consent of a parent or guardian. Fantasia does not yet ask for age at sign-up.

Young Adult (YA) protection is a setting a young person (or a parent, using the child's account) turns on in Settings → System. It is self-declared. While it is on: privacy settings are set to maximum, romance features are off, the profile is hidden from non-friends, only the user can start conversations or send friend requests, player analysis is off, only games marked suitable for minors can be seen and joined, and a green "YA" badge is shown.

Parents and guardians can write to fantasia@fineapps.gr (subject "PRIVACY - Parental Request") to access or delete their child's data, or to ask for YA protection to be turned on. Fantasia has no separate parent account today.

9. SECURITY

Data travels encrypted (TLS). Our providers encrypt stored data. Passwords are hashed, sign-in tokens are stored only as hashes, and third-party sign-in tokens are encrypted. Access to administrative functions is limited by role. We log and rate-limit access to detect abuse.

If a personal-data breach occurs, we notify the Hellenic Data Protection Authority within 72 hours where the law requires it, and affected users without undue delay when the breach is likely to put them at high risk.

10. YOUR RIGHTS

• Access and portability: ask us for a copy of your data in a machine-readable format.
• Correction: edit your profile in the app, or ask us.
• Deletion: delete your account yourself in Settings, or ask us if you cannot sign in (see the Data Deletion page).
• Objection and restriction: turn off player analysis in Settings, or ask us to restrict or stop other processing.
• Contest an automated decision (section 7).
• Complain to the Hellenic Data Protection Authority (www.dpa.gr) or the authority in your country.

Write to fantasia@fineapps.gr with the subject "PRIVACY - [your request]" from your account's email address. We reply within one month, extendable by two further months for complex requests, as GDPR Art. 12 allows. California residents have the equivalent CCPA rights; we do not sell personal information.

11. COOKIES AND LOCAL STORAGE

Fantasia sets no cookies and uses no analytics or advertising trackers. The web app keeps your sign-in token and preferences in your browser's local storage. Embedded TikTok videos and Google's sign-in script are third-party content and may set their own cookies (section 4.4).

12. CHANGES

We will post any change to this policy here with a new version number and date. For material changes we will also tell you in the app.