Privacy Policy

Who we are

Loomweaver is a product of Quinci Games, operated by an individual sole proprietor based in New Mexico, United States. For privacy questions or to exercise any of the rights described below, contact us at support@loomweaver.app.

In this policy, “we” and “us” refer to Quinci Games. “The marketing site” refers to loomweaver.app. “The app” refers to the Loomweaver application served at app.loomweaver.app.

What we collect

On the marketing site

This site is a static marketing page. It does not require an account, set tracking cookies, or store information about you in our database. The only data collected directly through this site is:

• Early access signups — If you choose to give us your email address through the early access form, we store it for the sole purpose of inviting you to Loomweaver and letting you know when it opens to everyone. The form is hosted by Tally (see Third-party services).
• Server-level access logs — Our hosting provider, Cloudflare, records standard web-server information (IP address, request URL, user agent, timestamp) for security and abuse prevention. We do not have direct access to these logs; they are retained per Cloudflare’s policy.
• Anonymous analytics — We use Cloudflare Web Analytics, which counts page views and basic usage patterns without setting cookies and without collecting personally identifying information.

In the Loomweaver app

When you create a Loomweaver account, we collect:

• Account profile — Your email address, display name, and profile photo as provided by your sign-in method (e.g. Google or Discord). Authentication is handled by Firebase Authentication (see Third-party services).
• The content you create — Campaign data, NPCs, locations, items, sessions, notes, uploaded images, and audio recordings you choose to store. This is your content; we hold it on your behalf so you can use the app.
• Payment information — If you subscribe to a paid plan, billing details are collected and processed by our payment processor (see Third-party services). We never see or store your full payment card number.
• AI prompts and responses — When you use AI-powered features (the Oracle, AI Suggest, AI image generation, etc.), the text or images you submit are sent to an AI provider to generate a response. Loomweaver chooses the provider for each feature:
  • Text features (the Oracle, AI Suggest, session summaries and notes, and similar tools): Google AI Studio (Gemini) or Anthropic (Claude). Per Google’s terms for paid API use, content sent to Gemini is not used to train Google’s models. Per Anthropic’s data policy, inputs and outputs sent through its API are not used to train its models by default, and Anthropic deletes them within 30 days, except where it must keep them longer (for example, to enforce its usage policy).
  • Premium AI images: the image prompt is sent to Google AI Studio (Gemini), under the same terms as the text features.
  • Standard AI images: the image prompt, built from your campaign text (names, descriptions and the chosen art style), is sent to Replicate, which runs the Z-Image Turbo model. Per Replicate’s data retention policy, the inputs and outputs of these requests are deleted after one hour.
  • Image safety checks: before a Standard image is saved, its prompt and the finished picture are each checked by one of the text providers above (Gemini or Claude), under the same terms as the text features.
• Session recordings and transcription — Audio you or your players record in a session is stored in Loomweaver’s storage on Cloudflare so it can be replayed. How it is transcribed is the DM’s choice, made once in Settings for the whole account, including recordings made by players (players see a notice saying so when they record):
  • Cloud transcription: the audio, plus a short list of names from your campaign (characters, places, factions) used as spelling hints, is processed by Cloudflare Workers AI running OpenAI’s Whisper speech-to-text model. Per Cloudflare’s Workers AI data policy, your inputs and outputs remain your content and are not used to train any models.
  • On-device transcription: runs entirely in your browser; the audio is not sent to any AI service for transcription.
  • Transcript cleanup (optional, DM opt-in): the transcript text and your campaign’s names are sent to one of the text providers above (Gemini or Claude) to correct spellings, under the same terms as the other AI features.
• Operational logs — Standard application logs for debugging, security, and performance monitoring. These may contain timestamps, account identifiers, and request metadata.

Third-party services we use

The services below process data on our behalf. We choose them because they offer strong privacy protections and operate under their own published privacy policies.

We do not sell or rent your personal data to anyone, ever.

How we use your data

We use the data we collect to:

• Operate the app and the marketing site
• Authenticate you and keep your account secure
• Process subscription payments
• Provide the AI features you explicitly request
• Send you essential service notifications (e.g. account verification, billing receipts, security alerts)
• Invite you to Loomweaver, and tell you when it opens to everyone, if you signed up for early access
• Diagnose bugs and improve reliability
• Comply with legal obligations

We do not send marketing emails beyond the early access invitation and launch notice you signed up for. We send service emails only: a welcome email when you create an account, a notice before a session recording’s audio is removed under the 12-month retention policy, and replies to your support requests. These come from welcome@loomweaver.app and support@loomweaver.app.

Your rights

You have the right to:

• Access the personal data we hold about you
• Correct inaccurate or incomplete data
• Delete your account and all associated personal data
• Export a copy of your data in a portable format
• Object to or restrict certain processing
• Withdraw consent at any time where processing is based on consent
• Lodge a complaint with your local data protection authority

If you are in the European Economic Area, the United Kingdom, or California, these rights are guaranteed by the GDPR, UK GDPR, and CCPA / CPRA respectively. They are available to all Loomweaver users regardless of where you live.

To exercise any of these rights, email support@loomweaver.app with your request. We will respond within 30 days.

Deleting your account

You can delete your Loomweaver account and all the data associated with it from within the app’s account settings, or by emailing support@loomweaver.app. When you delete your account, your campaign data, NPCs, locations, sessions, uploaded media, and AI conversation history are permanently removed within 30 days. Backups may retain copies for up to 90 days for disaster-recovery purposes, after which they are also overwritten.

If you signed up for early access but never created an account, you can have your email removed by emailing support@loomweaver.app.

Data retention

• Account and content data — Retained for as long as your account is active. Deleted within 30 days of account deletion (with up to 90 days in backups).
• Session audio recordings — Removed automatically 12 months after the recording date. Transcripts, notes, and recaps are kept with your campaign. About 30 days before removal, we email the account that made the recording with time-limited download links so you can keep a copy.
• Early access email — Retained until you ask us to remove it, or until 12 months after public launch, whichever comes first.
• Server access logs — Retained per Cloudflare’s standard policy (typically a few days for security purposes).
• AI prompt history — Stored alongside your other content; deleted with your account.
• Copies held by AI providers — Replicate deletes Standard image requests and results after one hour. Anthropic deletes API inputs and outputs within 30 days, except where it must keep them longer to enforce its usage policy or comply with the law.

International data transfers

Loomweaver is operated from the United States, and our service providers may store or process data in the United States or other countries. When personal data of EU/UK users is transferred outside the EU/UK, we rely on Standard Contractual Clauses or equivalent safeguards offered by our service providers.

Cookies

The marketing site itself does not set tracking cookies. Cloudflare may set strictly necessary cookies for security and bot detection. The Loomweaver app uses cookies that are strictly necessary for authentication and session management.

Children

Loomweaver is not directed to children under 13, and we do not knowingly collect personal data from children under 13. If we become aware that we have, we will delete it. If you believe a child has provided us with personal data, please contact support@loomweaver.app.

Changes to this policy

We will update this policy when we change how we handle data. The “Last updated” date at the top of this page reflects the most recent revision. Substantive changes will be announced through the app or via email to affected users before they take effect.

Contact

Email support@loomweaver.app for any privacy question, request, or concern.