Privacy Policy

1. Who we are and scope

Third Oak Productions, LLC (“Third Oak,” “we,” “us,” or “our”) operates Roleplaycharacters.ai. This Privacy Policy explains how we collect, use, disclose, retain, and protect information when you use the website, game, support, payment, AI-image, and account services.

This policy should be read with the Terms of Service. The Service is intended only for people who are at least 18 years old.

2. Information we collect

• Account information: username, display name, email address, password hash, role, verification state, account status, preferences, and registration/login dates.
• Age and consent information: Date of Birth, 18+ confirmation, Terms/Privacy versions, consent source, and consent time. Exact Date of Birth is encrypted and is not displayed publicly.
• Profile and game information: profile description, Featured Character, collections, card ownership, Tokens, reservations, transactions, Marketplace activity, gifts, Awards, mating and ancestry records, notifications, restrictions, and other gameplay history.
• Content: Backstories, public and collector-private Character Journal entries, reports, support messages, Private Notes, image instructions, selected hair color, generated images, moderation records, and related metadata.
• Payment information: purchase amount, currency, product, provider customer/session/payment references, status, refunds, disputes, and risk evidence. Payment providers process complete card details; we do not intentionally store complete card numbers.
• Technical and security information: IP address, browser/user-agent, device and session information, request time, cookies, security events, provider responses, and diagnostic logs. Some sensitive identifiers are stored only as keyed hashes where practical.

3. How we use information

We use information to provide and personalize accounts and gameplay; verify age and email status; process payments and Token entitlements; generate and deliver images; operate Marketplace, messaging, moderation, support, security, fraud prevention, backups, and account deletion; maintain permanent character histories; comply with law; enforce the Terms; diagnose failures; and improve the Service.

We do not use mating, fertility, ancestry, pregnancy, or generated-character attributes to make decisions about a real person. Those fields describe fictional game characters.

4. Information visible to other people

Usernames, public profile descriptions, membership or game badges, Featured Characters, public character ownership, public card attributes, images, Backstories, public Character Journal entries, Life Events, Awards, ancestry, selected gameplay outcomes, and public histories may be visible to anyone, including visitors without accounts. Private Character Journal entries are visible only to the character’s current collector.

Wrapped Cards disclose only the public facts defined for their wrapper type until unwrapped. Private Notes, private Life Events, protected identity references, account email addresses, exact Date of Birth, security data, and unpublished prompts are not intentionally public.

Public and immutable submissions may remain in historical game records after ownership changes or account deletion, using retained historical identifiers where necessary.

5. Service providers and disclosures

We disclose information only as reasonably necessary to operate the Service, complete a transaction, protect users, comply with law, or exercise legal rights. Categories of recipients may include:

• Payment providers, including Stripe: account and transaction information needed for checkout, fraud review, refunds, and disputes.
• AI-image providers, including Black Forest Labs: controlled character attributes, permitted player scene instructions, safety settings, and protected character reference images required to generate the requested asset. Exact Date of Birth, account password, email address, and payment-card data are not part of an image prompt.
• Infrastructure and security providers: hosting, content delivery, firewall, bot protection, monitoring, backup, and diagnostic services, including cPanel infrastructure and Cloudflare where enabled.
• Communications providers: email or support delivery providers when configured.
• Professional and legal recipients: advisers, auditors, law enforcement, courts, regulators, or other parties when legally required or reasonably necessary to protect rights and safety.
• Business transfers: a buyer, successor, or adviser involved in a merger, financing, reorganization, or sale, subject to appropriate safeguards.

We do not currently sell personal information for money or use it for third-party cross-context behavioral advertising.

6. AI image processing and moderation

When you request a character image, the Service constructs a provider-bound prompt from immutable character identity, current permitted appearance values, aging information, and the scene details you submit. Natural Hair Color remains historical/genetic data; Current Hair Color is used for the visible generated appearance unless you purchase and successfully deliver a permitted change.

Requests and provider responses may be automatically screened and, when flagged or failed, reviewed by authorized administrators. Confirmed moderation outcomes may be retained to enforce daily limits, return reserved Tokens, explain a failure privately, investigate abuse, and protect the platform.

7. Retention

Retention depends on the record and why it is needed:

• Permanent Character IDs, immutable character attributes, ownership history, Life Events, Awards, ancestry, economic ledgers, consent evidence, and necessary moderation/audit evidence may be retained for the life of the Service.
• Ordinary Private Note content is scheduled for removal after 12 months; reports, evidence, abuse prevention, and legal holds may require longer retention.
• Ordinary closed support-message content is scheduled for removal after 24 months; permanent references, status history, evidence, and legal holds may remain.
• Payment, refund, dispute, tax, fraud, and accounting records are retained as required for legal, security, and business purposes.
• Backups may retain information temporarily after live deletion until the applicable backup cycle expires.

A player deletion request has a seven-day cooling period. At completion, the WordPress account, email, encrypted Date of Birth, public profile, and private preferences are removed, while the limited permanent or legally required records disclosed above retain only the identifiers necessary to preserve their integrity.

8. Cookies and similar technology

We use cookies and comparable storage for login sessions, security, account preferences, catalog filters, consent, bot protection, and essential site operation. Third-party payment or security pages may set their own cookies under their policies. Blocking essential cookies may prevent login or other features from working.

9. Security

We use safeguards appropriate to the Service, including password hashing, encrypted sensitive fields, access controls, private media storage, signed media delivery, hashed request fingerprints, audit logs, rate limits, provider-secret protection, backups, and transport encryption. No system is completely secure, and we cannot guarantee absolute security.

You are responsible for using a strong unique password, protecting your sessions, and notifying us of suspected unauthorized access.

10. Your choices and privacy requests

My Account → Privacy & Safety allows you to view current consent status, download a JSON copy of designated account data, revoke other sessions, and schedule account deletion. Some requests require your current password.

Depending on where you live, applicable law may provide rights to access, correct, delete, restrict, object to, or receive a portable copy of certain personal information. These rights may be limited by identity verification, immutable public game records, legal obligations, fraud prevention, freedom of expression, or other lawful exceptions.

To make another privacy request, use Support after login. Pre-registration requests may be directed through Third Oak Productions, LLC.

11. Location and international processing

The Service and its providers may process information in the United States and other countries. Those locations may have different privacy laws. Where required, we rely on contractual, consent-based, or other lawful transfer mechanisms.

12. Changes to this policy

We may update this Privacy Policy as the Service, providers, or legal requirements change. Material changes will receive a new version and, when appropriate, renewed consent. The effective version is displayed on this page.