Privacy Policy

What we collect

We store account data such as your email address, profile fields, and the content you create inside the app, including campaign notes, generated art prompts, public profile details, and feedback you submit. If you upload session audio or record a voice sample so transcripts can tell speakers apart, we store the recording and the transcript. If you buy a plan or credits, our payment processor holds your card details; we only see the plan, the amounts, and the payment status.

How we use it

We use this data to run FTTHelper, secure accounts, generate requested AI outputs, troubleshoot beta issues, and understand which parts of the product are worth improving before broader rollout.

Third-party services we use

To operate FTTHelper we share specific data with a small set of vetted processors. Each is bound by its own privacy and acceptable-use terms, and we only send them the data they need to perform the service on our behalf:

• Supabase, Inc. — account storage, database, file storage, and row-level access control. Holds account data and the content you create.
• Vercel Inc. — hosts the website and API. Handles every request, including your IP address and browser details.
• Amazon Web Services — sends account and notification email. Receives your email address and the message.
• Stripe, Inc. — payments. Receives your email address and card details when you buy something.
• Groq, NVIDIA NIM, Google AI Studio, and DeepSeek — AI text for recaps, DM hooks, NPC chat, and brainstorming, tried in that order. Receive the campaign text needed for the output you asked for. Groq also transcribes session audio you upload. We do not send your email address or account details.
• fal.ai, Google AI Studio, OpenAI, and xAI — premium art generation, depending on the model you pick. Receive the prompt and settings you choose; we do not send account data.
• Cloudflare Workers AI, NVIDIA NIM, and Pollinations — free-tier art generation, tried in that order, and RAG embedding inference (Cloudflare). Receive the prompt and seed you choose; we do not send account data.
• Google Analytics 4 — audience and traffic measurement. Receives page URLs, referrer, and coarse device and location signals; we do not send it your account data or the content you create.
• PostHog — product analytics: which features get used and where flows break. Receives in-app events and a pseudonymous user id. Session replay is disabled.
• Metricool — site traffic reporting alongside our social channels. Receives page views and referrer only; no account data.

If you add your own API key for a provider, requests you make with that key go to that provider under your account with them. The portrait pipeline is described in our Licenses page under “AI-generated art.”

AI tools you connect

On the Hero plan you can connect an AI tool such as ChatGPT or Claude to your campaigns. A connected tool reads what you can already see in the app: your campaigns, the codex, session notes you are allowed to see, recaps, and session events. It can add notes, events, recaps, and codex proposals in your name; a DM reviews proposals before they become canon. What the tool does with that data is governed by its provider’s privacy policy. You can disconnect any tool at any time on /account/mcp, which revokes its access.

How long we keep it

• Account data and the content you create stay for as long as your account exists.
• When you delete your account, in Settings on the website or in the iOS app, we delete at once your account, your profile, your generated images, your voice samples, every session recording you uploaded, and the campaigns you run. A transcript you uploaded to someone else’s campaign stays with that campaign without your name. If you ask through the support page instead, we do it within 30 days. Daily database backups keep a copy for up to 7 days after deletion.
• Request logs kept by our hosting provider are deleted automatically within 30 days.
• Analytics data is pseudonymous. Google Analytics deletes it after 14 months. PostHog keeps product events for at least one year under its own policy, and does not let us shorten that; ask us and we will delete the events tied to your account.
• Payment records are kept for as long as tax and accounting law requires.
• AI providers process your prompt to return a result. We do not ask them to keep it; some keep requests for a limited period under their own terms to detect abuse.

Public sharing

Public art pages, leaderboards, and creator profiles are intended to be visible outside the app. Anything you intentionally publish to those surfaces may be seen by other users and search engines.

Questions and deletion requests

During the beta, support and privacy questions should go through the support page. You may also exercise the train-on opt-out described in our Terms of Use.