Privacy Policy

Slug: /legal/privacy Version: 0.2.0 Status: OWNER APPROVED — 0.2.0 Proposed effective date: [PROPOSED EFFECTIVE DATE] Audience: Visitors, account holders, beta participants, Members, supporters, Store customers, guardians, and people contacting Eidolon Gaming.

Plain-language summary

This Privacy Policy explains what personal data Eidolon Gaming processes, why it is processed, how AI interaction data is handled, which categories of service providers receive data, how long records are generally kept, and what choices may be available. The policy distinguishes Eidolon Gaming's own application retention from provider-side processing. It also reflects the product's data-minimization rule for participant eligibility.

Table of contents

1. Scope and controller identity

1. Our public privacy commitment

1. Data we collect or receive

1. Age eligibility and data minimization

1. AI interaction processing

1. OpenAI provider-side processing

1. Payments, subscriptions, support contributions, and Store data

1. Support, contact, and uploaded material

1. Cookies and local storage

1. Why we process data

1. Service providers and disclosures

1. Retention

1. Security

1. Your choices and privacy rights

1. Account closure and deletion

1. International processing

1. Changes to this policy

1. Contact

1. Related documents

1. What changed / version notes

1. Scope and controller identity

This policy applies to Echoes of Eidolon and related account, beta, membership, support, donation, Store, and company-contact services operated by [LEGAL ENTITY NAME], doing business as Eidolon Gaming. The public business address is 5400 Kearny Mesa Rd, 1712, San Diego, CA 92111, United States.

The legal role of Eidolon Gaming for a particular processing activity depends on applicable law. Where this policy uses “we,” “us,” or “Eidolon,” it refers to the operator identified above.

2. Our public privacy commitment

One of Eidolon Gaming's public promises is: never sell you. This statement is preserved as a public commitment. The concrete collection, disclosure, provider, and rights practices that apply to personal data are described in this policy; statutory terms such as “sale,” “sharing,” “controller,” and “processor” have the meanings assigned by applicable law.

3. Data we collect or receive

Depending on the features you use, we may process:

• account and profile data, such as account identifier, display name, email address, settings, and account status;

• authentication, session, and security data, such as session identifiers, login events, security signals, and records needed to investigate compromise;

• minimum age-eligibility state and guardian-consent evidence where the participant is age 14–17;

• structured gameplay and progression data needed to operate branching and multiple-story gameplay;

• membership, subscription, donation/support, and entitlement-ledger records;

• merchandise order, shipping, payment-status, refund, cancellation, replacement, and fulfillment metadata;

• support tickets, Store/order support communications, company-contact submissions, privacy/legal requests, accessibility feedback, security reports, and cultural/research correction submissions;

• files or attachments you intentionally upload to a feature that accepts them;

• cookie, local-storage, device, browser, and operational data described in the Cookie Policy; and

• structured security, audit, tax, or accounting records where required for legitimate operation or legal obligations.

We seek to collect only the data reasonably needed for the feature and purpose involved.

4. Age eligibility and data minimization

Standard participation is 18+. Participants age 14–17 may participate only with valid parent or guardian permission. People under 14 are not eligible.

Ordinary signup is designed not to request or store date of birth or exact numeric age. Instead, we store the minimum eligibility state needed to establish either adult 18+ eligibility or valid guardian-consented eligibility for a 14–17 participant, plus consent evidence reasonably required for participation. We may use a reasonable consent or verification process appropriate to supported jurisdictions. This policy does not represent that government ID, biometric verification, or a particular third-party identity vendor is used.

If guardian permission is withdrawn or cannot be validated as required, the minor participant may no longer use the participating game experience, subject to any record retention required for security, legal, or audit purposes.

5. AI interaction processing

Echoes of Eidolon uses AI-mediated fictional characters and systems. Player interaction content is transmitted to OpenAI where required to generate or evaluate AI-powered interaction.

Eidolon Gaming does not intentionally persist raw player conversation text or raw AI response text as ordinary gameplay history. The application policy is not to deliberately write that raw conversation content to the ordinary application database as gameplay history, ordinary application logs, analytics events, error traces, or support traces. The application may persist the minimum structured gameplay state derived from an interaction when required for game operation or progression.

This is an Eidolon application-retention rule, not a claim that no provider ever processes or retains content. OpenAI's provider-side processing is addressed separately below.

6. OpenAI provider-side processing

OpenAI's current official API data-control documentation states that data sent to the OpenAI API is not used to train or improve OpenAI models by default unless the API customer explicitly opts in to share data. OpenAI also states that default abuse-monitoring logs may contain customer content and may be retained for up to 30 days, subject to stated exceptions, and that some API features can persist application state.

Eidolon Gaming does not state that Zero Data Retention, Modified Abuse Monitoring, store: false, or any other project-specific retention control is enabled unless the live project configuration has been separately verified. Provider practices and product controls can change; current provider documentation governs the provider's own processing.

7. Payments, subscriptions, support contributions, and Store data

Stripe is the sole payment provider for merchandise purchases, subscriptions, donations/support contributions, receipts, saved payment methods where enabled, and refunds. Stripe processes payment information needed to authorize and settle transactions. Eidolon Gaming does not treat raw card credentials as ordinary application data. We may receive transaction identifiers, amount, currency, payment status, refund status, billing/contact metadata, and limited payment-method descriptors needed for customer service, accounting, fraud prevention, and entitlement reconciliation.

Printful is used for physical merchandise fulfillment. We may provide Printful with the order, product/variant, recipient name, delivery address, contact information needed for shipping, and related fulfillment instructions. Printful is not presented as the seller or payment processor for Eidolon Store transactions.

8. Support, contact, and uploaded material

When you request Player Support, Store/order support, or submit a company-level Contact form, we process the information you provide and related account or transaction context needed to investigate and respond. Attachments are processed where the feature allows them and where they are relevant to the request.

Do not send passwords, payment-card data, access tokens, recovery codes, government IDs, or other unnecessary sensitive information through ordinary support/contact forms. Player/account/gameplay support belongs at /account/support. Company-level privacy, legal, security, accessibility, press, partnership, and cultural/research submissions belong at /contact. Store/order support uses [STORE/ORDER SUPPORT ROUTE].

9. Cookies and local storage

We use cookies or similar browser storage where necessary for authentication, session continuity, security, and preferences. Optional analytics, if enabled in the live product, must be described and handled according to the Cookie Policy and applicable consent requirements. We do not invent or describe an advertising-cookie program that is not actually configured. Payment-provider pages may use Stripe-controlled cookies or storage for payment and security functions.

10. Why we process data

We process personal data for purposes such as creating and securing accounts; verifying participation eligibility; providing game state and progression; operating AI-powered interactions; providing optional membership; processing subscriptions and support contributions; accepting and fulfilling merchandise orders; issuing receipts, refunds, and replacements; preventing fraud and abuse; providing support; responding to privacy, legal, accessibility, security, and cultural/research submissions; maintaining audit and entitlement integrity; complying with legal, tax, accounting, and security obligations; and improving reliability and accessibility using data that is appropriate for those purposes.

The legal basis for a given activity depends on the applicable jurisdiction and can include performance of a contract, consent where required, legitimate operational or security interests where permitted, and compliance with legal obligations.

11. Service providers and disclosures

We disclose data only as reasonably necessary for the purpose involved, including to service providers that operate functions on our behalf or under their own applicable terms. Confirmed provider roles for this version include Stripe for payments and billing, Printful for merchandise fulfillment, and OpenAI for AI-powered interaction processing.

Live deployment may also rely on hosting, database, object-storage, email, security, and operational vendors. Those vendors must be verified against the deployed configuration before publication of any provider-specific list. We may also disclose information when reasonably necessary to comply with law, respond to lawful process, protect users or the service, investigate fraud/security incidents, or complete a corporate transaction subject to applicable safeguards.

12. Retention

Retention is based on category and purpose rather than one blanket deletion period. Sanitized transient operational logs target approximately 30 days. The target is operational rather than a guarantee that every security or incident record is deleted on exactly day 30.

Durable records can be retained longer when needed for their purpose or legal obligations. These categories include accounts; authentication and session records; progression/game state; orders; payments and refunds; support contributions; subscriptions; membership ledgers; support tickets; privacy/legal requests; security and audit records; tax and accounting records; and records needed to establish consent, resolve disputes, or comply with law.

Raw player and AI conversation text is governed by the non-persistence policy described above. Provider-side retention is separate. When data is no longer reasonably necessary and no legal or security basis requires retention, it should be deleted or de-identified according to the applicable operational process.

13. Security

We use administrative, technical, and organizational measures designed to protect data against unauthorized access, alteration, loss, or disclosure. No networked service can guarantee absolute security. Security controls should be appropriate to the sensitivity and purpose of the data, and access should be limited to people and systems that need it.

If you believe an account or the service is compromised, use the Player Support route for account-specific help or select “Security report” at /contact for a company-level security report. Do not include exploit details in a public forum when doing so could increase risk.

14. Your choices and privacy rights

Depending on where you live, applicable law may provide rights to access, correct, delete, restrict, object to, or obtain a portable copy of certain personal data, or to withdraw consent where processing depends on consent. Some rights are subject to identity verification, exceptions, and record-retention duties.

To make a privacy or data-rights request, use /contact and select “Privacy and data-rights inquiry.” We will use a reasonable verification process proportionate to the request and data involved. We will not ask for unnecessary government identification when a less intrusive method is sufficient and appropriate. If a guardian acts for an eligible minor, we may need to verify the guardian relationship or consent authority in a manner appropriate to the supported jurisdiction.

15. Account closure and deletion

Account closure does not necessarily mean immediate deletion of every record. We will remove or de-identify data when required and appropriate, but may retain records needed for payment/refund reconciliation, fraud/security investigation, membership audit history, tax/accounting obligations, legal claims, consent evidence, or other lawful purposes. Structured game progression may be removed or made inaccessible according to the account-closure process, subject to legitimate retention requirements.

Because the Eidolon application does not intentionally keep raw conversation text as ordinary gameplay history, there is generally no ordinary conversation-history archive to preserve or export from that application policy. This does not describe provider-side retention.

16. International processing

The service may be available in [SUPPORTED JURISDICTIONS]. Service providers and infrastructure may process data in countries other than your own. Where applicable law requires transfer safeguards, contractual terms, notices, or other mechanisms, Eidolon Gaming will use the measures required for the relevant deployment and provider configuration.

17. Changes to this policy

We may update this policy when data practices, providers, legal requirements, or product features change. Material changes will be communicated where required by law. We will not use a policy update to retroactively remove privacy rights that applicable law gives you.

18. Contact

Privacy and data-rights inquiries: use /contact and select Privacy and data-rights inquiry. Legal notices and security reports also have dedicated classifications on /contact. Player support messages should be sent from the Support tab, not this webform.

Player/account/gameplay support: /account/support. Signed-out users seeking Player Support should sign in and return there.

Public business address: 5400 Kearny Mesa Rd, 1712, San Diego, CA 92111, United States.

19. Related documents

See the Terms of Service, Cookie Policy, Membership and Subscription Terms, Donations and Perks Terms, Store Terms of Sale, Returns/Refunds/Cancellation Policy, AI/Automated Interaction Disclosure, and Cultural Use/Attribution/Research Corrections Policy for feature-specific rules that interact with this Privacy Policy.

20. What changed / version notes

Version 0.2.0 establishes the owner-approved privacy baseline: minimal eligibility-state collection instead of ordinary DOB/exact-age storage, explicit separation of Eidolon conversation non-persistence from OpenAI provider processing, approximately 30-day sanitized transient-log target, category-specific durable retention, and confirmed Stripe/Printful/OpenAI provider roles. Owner approval of this text does not itself make the policy effective or deployed.