Privacy policy

The data controller is the site's publisher, under the pseudonym “Zelerion”, reachable at [email protected].

Loreloom only collects the data strictly necessary for it to operate:

• Account data: name or pseudonym, e-mail address and password (stored only as an encrypted hash, never in clear text).
• Connection data: IP address, browser type (user-agent) and session timestamps, kept for security and to keep authentication working properly.
• Content you create: universes, articles, characters, maps, notes and any other items you voluntarily enter into the tool.
• Display preferences: language, theme and active universe, stored locally in your browser (see the “Cookies and local storage” section).

Your data is processed for the following purposes:

• Providing the service and granting access to your universes (legal basis: performance of a contract, Art. 6.1.b GDPR).
• Ensuring account authentication and security (legal basis: legitimate interest, Art. 6.1.f GDPR).
• Remembering your display preferences (legal basis: legitimate interest / proper operation of the service at your request).

None of your data is used for advertising, profiling or resale. Loreloom uses no audience-measurement tool and no third-party trackers.

Your data is never sold or transferred. It may be processed by the following technical providers, acting as processors:

• Cloudflare, Inc. — hosting of the application and database. Cloudflare may process data on servers located outside the European Union (United States); such transfers are governed by the European Commission's standard contractual clauses.

No other third-party service is contacted while you browse: fonts are self-hosted and no external content is loaded from a third-party domain. The only exception is at your initiative: the optional feedback survey is hosted by Tally (Tally BV, Belgium) and is only loaded if you choose to open it; your answers are then governed by Tally's privacy policy.

Your account data and content are kept for as long as your account is active. Sessions expire automatically after a limited period. If you request the deletion of your account, all your personal data and content is erased within a reasonable time, unless a legal retention obligation applies.

Loreloom uses no advertising cookies and no audience trackers. The only mechanisms used are strictly necessary for the service to operate and, as such, exempt from consent under Article 82 of the French Data Protection Act:

• A session cookie, essential to keep you logged in to your account.
• A local storage area (localStorage) that remembers your display preferences (language, theme, active universe) and saves your writing drafts to prevent any loss in case of an incident.

These items stay on your device, serve only to operate the tool and are not shared with any third party. No consent banner is therefore required. You can delete them at any time via your browser settings (at the cost of being logged out and losing your preferences).

In accordance with Articles 15 to 22 of the GDPR, you have the following rights over your data:

• Right of access to and rectification of your data.
• Right to erasure (the “right to be forgotten”).
• Right to restriction of and objection to processing.
• Right to data portability.

To exercise these rights, write to [email protected]. You will receive a reply as soon as possible.

If you believe the processing of your data does not comply with the regulations, you may lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, 75007 Paris — www.cnil.fr.