Privacy Policy

Last updated: July 2026 · Version 1.0

This English text is a convenience translation. The legally binding version is the German original at /de/datenschutz. In the event of any discrepancy, the German version prevails.

1. Controller

The controller responsible for data processing on this website within the meaning of the General Data Protection Regulation (GDPR) is:

Cornelius Krämer
Kalkstraße 135
51377 Leverkusen
Germany
Email: [email protected]

2. Overview

We process personal data only to the extent necessary to provide a functional website and our content and services. Prompts & Paper is an online platform for AI-assisted pen-&-paper role-playing. To use it, you sign in via an external provider (Google, Discord or Twitch); we store your user account and your game content.

3. Hosting & server logs

The website and database are hosted with Railway (Railway Corp.). The servers are located in the EU West (Amsterdam, Netherlands) region, i.e. within the European Union. When you access the site, the hosting provider automatically processes technical access data (including IP address, date and time, page requested, browser/device information) to deliver and secure the service. The legal basis is our legitimate interest in secure, stable operation (Art. 6(1)(f) GDPR).

Railway Corp. is based in the USA. Insofar as access from the USA occurs in the course of operations (e.g. for administration or support), we base this on appropriate safeguards under Art. 44 et seq. GDPR, in particular the EU Standard Contractual Clauses pursuant to Art. 46(2)(c) GDPR.

4. Sign-in via third parties (OAuth)

Sign-in is handled by one of the following providers. From the provider you choose, we receive basic profile data – typically your name, email address, profile picture and a provider-side user ID. The legal basis is the performance of the user relationship (Art. 6(1)(b) GDPR).

5. User account & game content

After sign-in, to provide the platform we store in particular:

  • account data: display name, optional username, email address, profile picture, language;
  • the sign-in link of the chosen provider (identifier, access token);
  • timestamps (account creation, last sign-in);
  • game content you create (characters, campaigns, sessions, notes);
  • consent records (see section 7).

The legal basis is Art. 6(1)(b) GDPR (user relationship).

6. Cookies & sessions

For sign-in we use a strictly necessary session cookie (session token). It serves solely for authentication and operating the platform; we do not use tracking or marketing cookies. The legal basis is Art. 6(1)(f) GDPR and Section 25(2) TDDDG (strictly necessary cookies).

7. Consents

On registration we record your agreement to the terms of use and this privacy policy in an audit-proof manner (time and version). Any consent to promotional emails is voluntary and can be withdrawn at any time with effect for the future (Art. 6(1)(a), Art. 7(3) GDPR).

8. Retention & deletion

We store your data for as long as your account exists. You can have your account and the associated data deleted at any time; we then delete or anonymise the data, unless statutory retention obligations apply. Requests can be sent to the email address above.

9. Your rights

Under the GDPR you have the following rights:

  • access to the data stored about you (Art. 15);
  • rectification of inaccurate data (Art. 16);
  • erasure (Art. 17) and restriction of processing (Art. 18);
  • data portability (Art. 20);
  • objection to processing (Art. 21);
  • withdrawal of consent given (Art. 7(3));
  • lodging a complaint with a data protection supervisory authority (Art. 77).

10. Contact for data protection requests

For questions about data protection and to exercise your rights, contact us at [email protected].

11. Changes to this policy

We update this privacy policy when the legal situation or our data processing changes. The version published on this page applies in each case.