Privacy and cookies

Who operates Lanternbound

Direwrought operates Lanternbound at direwrought.com/lanternbound. This notice covers the Lanternbound account and solo adventure service.

Information collected

Lanternbound collects information you provide when creating and using an account:

• Your display name and email address.
• Your password in one way hashed form. The readable password is not stored.
• Your character sheet, journal entries, Oracle questions and results, scenes, Chaos value, story threads, and characters met.
• Account timestamps, email confirmation status, and security token records.

The application also creates a one way derived identifier from the attempted email address and network address for abuse prevention. GoDaddy web server logs may record network address, browser details, requested pages, response status, and timestamps.

Why the information is used

Information is used to create and secure your account, preserve your private journey, provide character and solo play tools, restore your adventure when you return, deliver account email, prevent abuse, investigate technical or security problems, and respond to privacy requests.

Lanternbound account information is not used for behavioural advertising and is not added to a marketing list merely because you created an account.

Cookies and browser storage

Lanternbound uses only storage needed to operate the account service and remember this notice.

The essential session cookie cannot be disabled while remaining signed in. Clearing site cookies signs you out. Clearing local browser storage makes the cookie notice appear again.

Transactional email through Brevo

Brevo is used to deliver email confirmation, password recovery, and account deletion receipts. Direwrought sends Brevo the recipient email address, display name, message content, and the secure single use link needed for the requested account action.

These messages are operational account email, not newsletter subscriptions. Brevo may retain delivery and related email event records under its own service terms and retention practices. Read the Brevo privacy policy.

Hosting and service providers

Lanternbound application files, account records, and journeys are hosted through GoDaddy. Brevo provides transactional email delivery. These providers process information on Direwrought’s behalf to provide their services.

Provider infrastructure may process information outside your country. Exact processing locations depend on the current provider infrastructure and account configuration. Review the GoDaddy privacy notice and the Brevo policy linked above for current details.

Security

Lanternbound uses password hashing, prepared database requests, session protection, request verification tokens, rate limiting, restrictive browser security rules, and encrypted HTTPS transport when correctly deployed. Account confirmation and password reset links are single use, expire automatically, and are stored by Lanternbound only as one way hashes.

No internet service can promise absolute security. Use a unique password and protect access to your email account.

Retention, export, and deletion

Account and journey information is retained while the account exists so the service can preserve the adventure. Security and delivery records may be retained for operational, abuse prevention, backup, or legal purposes.

You can download a journey export from the play screen. The export excludes your account email and password data.

You can permanently delete the account from Account settings using the current password and confirmation phrase. This removes the account and linked journey records from the active application database. Copies may remain temporarily in routine hosting backups and server logs until those systems complete their normal rotation.

Access, correction, and complaints

You can correct character and journey information directly in Lanternbound. For account information, access requests, corrections that cannot be completed in the interface, or a privacy complaint, reply to a Direwrought account email or use the contact route published on the Direwrought website.

Include the account email address and a clear description of the request. Direwrought may ask for reasonable verification before disclosing or changing account information. A complaint will be reviewed and answered using the available contact route. If Australian privacy law applies and a concern remains unresolved, information about further options is available from the Office of the Australian Information Commissioner.

Children’s information

Lanternbound does not intentionally request sensitive information from children. If you believe a child has created an account without appropriate permission, contact Direwrought so the account can be reviewed and deleted where appropriate.

Changes to this notice

This notice may be updated when Lanternbound, its providers, or applicable privacy practices change. The updated date at the top will identify the current version.