Privacy

Last updated 3 November 2026

Who we are

LoreMonkey is operated by Scott Jacobs, a sole trader in Sweden, who is the controller of the personal data described here. Registration number 870923-9175. Bäverdammsgränd 174, 124 63 Bandhagen, Sweden. For anything in this policy, write to hello@loremonkey.com.

What stays on your computer

These parts of LoreMonkey run entirely on your machine and send nothing anywhere:

• Audio. Sound from your table or your Discord call is captured, turned into text, and then discarded. It is never uploaded: not to us, not to our model provider, not to Discord. If you switch session recording on yourself, LoreMonkey also saves the audio as an mp3 in your own LoreMonkey folder; that is off unless you turn it on, and the file is yours to keep or delete like any other. Recording the people at your table is a bigger step than transcribing them, so tell them before you do it.
• Transcripts. The text of your session is written to your own disk, in your LoreMonkey folder. You can read, back up or delete those files yourself.
• Your campaign notes. Character sheets, campaign files and any archive you import stay in that same folder.
• Archive search. When LoreMonkey looks something up from an old session, that search happens locally against your own files.
• Speaker attribution. Working out who is talking uses the Discord client already running on your computer. Nothing joins your voice channel and no audio is sent to Discord by us.
• Logs. The app keeps its own logs in the same folder. They include transcript lines and, on Discord, which Discord account was speaking when. They stay on your PC; the diagnostic report you can copy for support leaves the transcript lines out.

What we receive

The AI features need a model, and the model is not on your computer. When one of them runs, LoreMonkey sends the following to our server, which forwards it to our model provider and returns the answer:

• A recent extract of the session transcript, including the character names you have tagged people with and, for anyone in the call you have not tagged, the name Discord shows for them.
• The transcript of the whole session, with the same names, when you ask for a session recap, press Update campaign notes or Add to memory, or let a memory rebuild read a session that was never added.
• For a recap, the campaign's recap settings, including any example writeup or extra instructions you typed into them.
• When you clean up a transcript and choose to have LoreMonkey fix doubtful lines, the lines the speech model could not make out or that may hold a misheard name, the two lines either side of each, and the names of the people, places and things in your campaign.
• A compressed version of your campaign and character notes and, if the campaign is in a shared world, the world's notes.
• When you have campaign files written from your documents, the full text of the documents you import for it, such as a character sheet, a campaign primer or player questionnaires, and your campaign archive or an AI-written summary of it.
• When LoreMonkey looks for characters and places your notes missed, drafts a compendium entry, or rewrites a description to agree with a relationship you recorded, the names it heard with the lines they came from, the entries involved, and your notes.
• When you build a timeline, your session recaps (or, for a session without one, what LoreMonkey remembers from it) and your notes. Never the raw transcript.
• In a shared world, when you move entries into the world or change a world entry, those entries and what each campaign in the world has written about them.
• Passages your own archive search picked out as relevant.
• For Ask LoreMonkey, the question you typed and the thread it belongs to.
• For an illustration, the session's recap and its transcript, the names of the party and of the compendium entries said aloud that evening, and the illustration's story as you edited it.
• When an illustration's pictures are generated, how each character in it looks, from your character notes and compendium entries, and the portrait pictures you added to the compendium for them. When you have a compendium entry's picture generated, that entry's description.
• The name you gave the campaign, so your usage can be shown per campaign.

This happens when LoreMonkey checks whether the moment needs a suggestion, when you ask a question, when you generate context files from your documents, when it looks for missed names or drafts or fixes an entry, when you build a timeline or change a shared world, when you ask for a recap, update your campaign notes or add a session to memory, when you illustrate a session or have a picture generated, and when you ask a clean-up to fix doubtful lines. Finishing a session sends nothing by itself, and apart from the once-a-minute check during play described below, none of this happens continuously. The activity log in the app shows each live check-in during play, and the Account page shows how much each session used.

We use that content to produce the answer and to count usage against your plan. LoreMonkey does not use it to train models, sell it or share it for advertising. Anthropic states that API inputs and outputs are not used for model training by default.

LoreMonkey's server forwards each request without writing its prompt to the account database. One kind of answer is kept, for 24 hours: the reply to a memory job (a recap, a session update, adding a session to memory, generating your context files), so that a retry after a lost connection can be given the same answer instead of running and billing the job twice. It is deleted at the server's next clean-up after that. The server also stores usage metadata: the feature used, model name, token counts, cost, whether a live prompt was delivered, and which campaign and session the call belonged to, by the name you gave the campaign. Under Anthropic's standard API policy, inputs and outputs are deleted from its systems within 30 days. Anthropic lists limited exceptions for legal obligations and usage-policy enforcement.

Deciding when to check in

While a session is running with Guidance switched on, LoreMonkey asks a small decision model about once a minute whether the moment is worth a suggestion. For that it sends our server the last ten minutes of the transcript, with the same names as above; your character and its goals, or as a GM your players and session plan; the last few suggestions it made and the ones you turned down; and the questions it watches for in this campaign, which are written from your notes. Our server adds nothing that identifies you and passes this to TypeSafe, whose model answers only yes or no. Only on a yes does LoreMonkey go on to write a suggestion, through Anthropic as described above. With Guidance set to Off, or in practice mode, none of this is sent.

Our server does not write this request or its answer down. It logs the time, your account number, the app version, the answer as a number and how much text was sent. Our account with TypeSafe has zero data retention switched on, so TypeSafe deletes the request as soon as it has answered and keeps only operational records such as billing and usage figures. It does not train or fine-tune models on what it receives.

Pictures for illustrations and the compendium

The pictures in an illustration, and a compendium entry's picture when you ask for one, are generated by OpenAI's image model, through its API. A Claude model first writes what each picture should show, as described above. Then, for each picture, our server sends OpenAI that written description of the scene and of how each character looks, the characters' names, and reference pictures: the portraits you added to the compendium for them and, for an illustration, the pictures of its cast generated first. The transcript, the recap and your notes themselves are not sent to OpenAI.

OpenAI sends the picture back and the app saves it on your computer, with the illustration or in the compendium. Our server writes down neither the request nor the picture, only the same usage metadata as for any other AI feature. Under OpenAI's API data policy, OpenAI does not use the request or the picture to train its models. It keeps them for up to 30 days in its abuse monitoring logs, to detect and prevent misuse of its service, which can mean review by authorised OpenAI staff, and longer only where the law requires it or it is needed to prevent harm.

Thumbs on suggestions

When you give a suggestion a thumbs-down, the app sends us the reason you picked, any note you typed, the suggestion and the reason it was made, the campaign name, and when in the session it happened. A thumbs-up sends only that it was a thumbs-up. When a session ends, the app sends a summary: how long it ran, how many suggestions, check-ins and thumbs up and down it had, and your Guidance setting. We keep these to see where suggestions miss and make them better. They stay until you delete your account and are part of the copy of your data you can download. A thumbs-down is also written to our server's running log as it arrives.

Illustrations you share

Nothing leaves your computer for the web unless you press Share on an illustration. When you do, the app sends our server the illustration as one image (with a lighter copy for the page and a crop of its top for link previews), each of its pictures at full size with its caption, its title, the date the session was played, and that session's recap as it is saved in the app, in full. If you leave the invite box ticked, it also asks for your invite link to go on the page, and if you tick the box to show the campaign, it sends the campaign's name and the game you play. We publish all of it as a web page at loremonkey.com/s/ followed by a random code.

Anyone with that link can open the page, and so can anyone they pass it on to. We do not list it anywhere and it asks search engines not to index it, but treat it like a public post rather than a private message. The page does not show your email address or your account. It does show whatever is in the illustration and the recap: character names, often the names your players were tagged with, and what was said at the table, and the campaign's name only if you chose to show it. If it carries your invite link, people who join through it count as your invites, as described under Your account.

The page is stored with Cloudflare, in its European Union storage, until you stop sharing it from the app or delete your account; either one removes it at once. Link previews that chat apps such as Discord already made, and copies in someone's browser, can outlast that for a while, and we cannot reach those. We also take a page down when it is reported to us and breaks the law or our terms. When we do, we keep a private copy of it and a fingerprint of the illustration, which no one else can see, so that we can look at it again if you write back and recognise it if it is shared again unchanged. If you share an edited version, it waits for us to look at it before it goes up; until then its link says it is being reviewed. The copy is deleted when we lift the takedown, or with your account. Our server keeps a list of the pages your account shared (each one's code, title, size and dates) so you can take them down; it is part of the copy of your data you can download, and it is deleted with your account. Each new page also sends its link to the private Discord channel where we receive alerts about the service, so we can keep an eye on what is shared.

If you report a shared page

The form on a shared page sends us the reason you pick, anything you write, and your email address if you give one. You do not need an account. We keep the report so we can act on it, and use your email address only to reply about it. The address you connect from is used for one thing: stopping too many reports coming from one place in an hour. Our server holds it in memory for that hour and never writes it down. Each report also sends a note to the private Discord channel where we receive alerts about the service, with the reason and the page's link, but not what you wrote or your email address.

Your account

The app asks you to sign in before it starts, so you need an account, with an email address or a Google or Discord sign-in, to use LoreMonkey at all, the free plan included. Without one the app cannot be used.

We hold the small amount of information an account needs:

• Your email address, and a hashed password if you signed up that way.
• Your Discord or Google account identifier, if you signed in with one of those. We do not get your password from them.
• Which plan you are on and when it renews.
• Counters of how much of your plan you have used this month.
• The dates you confirmed you were 16 or older, and 18 or older.
• A short timeline of the account: plan changes, checkouts you opened, complimentary access, and an entry each time the address you connect from changes, with the old and the new address.
• Any note we write on the account when we grant complimentary access or suspend it.
• If you joined with someone's invite code, or someone joined with yours: which account invited which, the reward, and when. The other person only ever sees a shortened form of your email address, such as j•••@gmail.com, never the whole of it.
• The IP address you connect from, and the country it indicates. We keep the address you first signed up from and the most recent one, refreshed at most a few times an hour rather than on every request. Each change is also noted in the timeline above.

We hold the address because an account otherwise arrives as an email address and nothing else. It tells us roughly where our users are, so we can plan for the places people actually play from; it tells us when one person is quietly running several free accounts; and when something breaks for one person and not another, it is often the first useful clue. We do not use it to build a profile of you, we do not sell it, and it is not passed to our model provider with your session content.

Payments

Subscriptions are handled by Stripe. Your card details go to Stripe and never to us. We receive the fact that a payment succeeded, which plan it was for, and when it renews or ends. Stripe processes that data under its own privacy policy.

Who else is involved

• Anthropic receives the text described above in order to generate a response.
• TypeSafe (TypeSafe AI, Inc.) receives the once-a-minute check described above and answers whether the moment is worth a suggestion.
• OpenAI, through its API, generates the pictures for illustrations and compendium entries, from what is described above.
• Railway hosts the server that sits between the app and the model.
• Stripe processes payments.
• Google and Discord, only if you choose to sign in with them. If you connect the Discord desktop client for speaker labels, the app also uses Discord's own sign-in for the application you created, from your PC. We receive alerts about the service in a private Discord channel; some of them carry an IP address: one refused for creating too many accounts in a day, or one making too many sign-in attempts in a minute.
• GitHub serves the installer and the app's updates. The app asks GitHub for a new version when it starts and a few times a day, which shows GitHub your IP address and nothing else.
• Hugging Face and PyPI serve the speech model and, if you turn it on, the GPU runtime. The app downloads both directly from your PC.
• Google Docs, only if you import a document by pasting its link. The app fetches that document from Google directly from your PC.
• Cloudflare serves this website, counts its page views, and stores and serves the illustrations you share.

This website itself sets no cookies and runs no advertising or third party trackers. We use Cloudflare Web Analytics, which counts page views without cookies and without building a profile of you.

Anthropic, TypeSafe, OpenAI and Railway are United States companies, so using an AI feature sends the text described above outside the European Economic Area, to a country with different privacy laws. Stripe, Google, Discord, GitHub, Hugging Face and PyPI also process data outside the EEA. Cloudflare is a United States company too; the illustrations you share are stored in its European Union storage, and its network serves them from wherever the reader is. Where a transfer needs a safeguard we rely on each provider's own data-processing terms and, where a provider offers them, the EU standard contractual clauses. TypeSafe's data-processing terms include them. Write to us if you want more detail about a particular transfer.

Why we are allowed to hold it

Under the GDPR we need a reason for each thing we do with your data. Ours are straightforward. We process your account details and the content you send to an AI feature because we need to in order to give you the service you signed up for, and we publish an illustration you share on the same basis: you asked us to. We keep short operational logs, usage counters and the IP address you connect from because we have a legitimate interest in keeping the service working, stopping abuse and billing correctly, and we keep the thumbs you give suggestions on the same basis, to make the suggestions better. Reports of shared pages, and the private copy of a page we took down, rest on the same interest: keeping shared pages within the law and our terms. If you object to us holding your connection address on that basis, write to us and we will tell you what we hold and remove what we can. We keep payment records because the law requires it.

How long we keep it

Not forever, and not on a schedule invented to sound tidy. What actually happens:

• Your account: email address, hashed password or sign-in identifier, plan and renewal date, the dates you confirmed your age, any note we wrote on it, and the account timeline: until you delete the account. Then it goes.
• The address you connect from: until account deletion. The account itself holds two, the one you signed up from and the most recent one, which is overwritten as you connect. The timeline also notes each change of address, with the old and the new one, so it does add up to a list of the addresses you have connected from. All of it is deleted with the account.
• Usage metadata: which feature ran, which model, token counts and cost: as long as the account exists, because your allowance and your bill are worked out from it. Deleted with the account.
• The prompts: never written down at all. Our server passes them through.
• The answers: not written down either, except the reply to a memory job, kept for 24 hours so a retry is not billed twice, then deleted at the next clean-up.
• Thumbs on suggestions: until you delete your account, then deleted with it. A thumbs-down also sits in our server's running log for as long as our host, Railway, keeps those logs.
• Illustrations you share: the page, with its pictures and recap, until you stop sharing it or delete your account, or until we take it down after a report. After a takedown we keep a private copy until we lift it, or the account is deleted. The list of pages your account shared goes with the account.
• Reports of shared pages: the reason, what was written, and any email address, until the page is deleted or the account that shared it is.
• At Anthropic: deleted from its systems within 30 days under its standard API policy, which lists limited exceptions for legal obligations and usage-policy enforcement.
• At TypeSafe: deleted as soon as it has answered, because our account has zero data retention switched on. TypeSafe keeps only billing and usage figures, and does not train models on what it receives.
• At OpenAI: a picture request and the picture are kept for up to 30 days in its abuse monitoring logs under OpenAI's API data policy, longer only where the law requires it or it is needed to prevent harm, and not used to train its models. The pictures themselves are kept on your computer, for as long as you keep them.
• Invite records: which account invited which, and the reward, kept after either account is deleted, because a reward is money off a bill; the deleted account is removed from the record. If you joined with an invite code we also keep a one-way hash of your email address and of your sign-in identifier, so that the same person cannot be invited twice. A hash cannot be turned back into the address. Your own invite code is deleted with your account.
• Payment records: invoices and the bookkeeping entries behind them for seven years after the end of the financial year they fall in, because Swedish bookkeeping law requires it. These and the invite records above are what survive account deletion, and payment records are the one thing we cannot delete on request.
• Everything on your own computer: for exactly as long as you keep it. Deleting your account does not touch your transcripts, recordings or notes, because we never had them.

Keeping it safe

The app talks to our server over TLS, and this website is served over TLS. Passwords, where you set one rather than signing in with Google or Discord, are stored salted and hashed, never in a form we could read back. Session audio is never uploaded. Prompts are never written to the account database, and answers only as the 24-hour replay copy described above or when you give a suggestion a thumbs-down; beyond that it holds account rows, usage counters, the thumbs you gave, the list of illustrations you shared, and reports of shared pages, and nothing else worth stealing. The shared illustrations themselves are public pages by design.

Plainly: this is a one-person operation rather than a company with a security team, and we would rather say so than imply otherwise. If something does go wrong and a breach is likely to put your rights or freedoms at risk, we will email the people affected and notify IMY within 72 hours, as the GDPR requires.

The other people at your table

LoreMonkey transcribes a conversation other people are part of, and they have not agreed to anything with us. Two separate things follow from that, and it matters which is whose.

Telling your table is yours to do. Before you start capturing, tell the people at the table that the session is being transcribed, that AI features send extracts of it to us, and, if you have turned recording on, that the audio is being saved. In some places that is the law. Everywhere it is the decent thing to do, and it is the account holder's job rather than ours: we have no way to reach your players.

What we become responsible for, and when. While you are only transcribing, nothing about those people reaches us at all: the audio and the transcript stay on your computer. The moment you run an AI feature, an extract of the transcript (for a recap, a notes update or campaign memory, the whole of it), including the character names you have tagged people with or the Discord name of anyone you have not, is sent to our server and on to our model provider. From that point we are a controller of that extract as well as you, and everything else on this page applies to it. Generating an illustration's pictures also sends OpenAI the characters' names and how they look, as described under Pictures for illustrations and the compendium, but never the transcript.

Why we are allowed to handle it. For you, the account holder, the basis is our contract with you: you asked for the answer. For everyone else at the table there is no contract, so the basis is our legitimate interest in answering the request you made. We have weighed that against their privacy on the strength of three things that are true by design rather than by promise: the audio never leaves your PC, the prompt is never written to our database and the answer only as the brief replay copy above, and what does reach Anthropic is deleted there within 30 days. The once-a-minute check that goes to TypeSafe carries ten minutes of the transcript at a time, and TypeSafe deletes it as soon as it has answered and does not train models on it.

Sharing an illustration is publishing. An illustration and its recap can name the people at your table, by character or by the name they were tagged with, and repeat what they said. Ask them before you share one, and leave out anything they would rather keep at the table. You can stop sharing it from the app at any time.

If you are one of those people. Write to hello@loremonkey.com. You do not need an account, and you do not need the account holder's permission. We will tell you what we can find that relates to you, delete the usage metadata we can match to you, and ask the account holder to edit or delete the local files. If you are named on a shared page, report it with the form on the page, or send us its link, and we will take the page down. The transcript and any recording are on their computer rather than ours, so that part only they can do. You can object to the processing described above, and you can complain to IMY or to the authority in the EU country you live in.

What you can ask us to do

You can ask for a copy of what we hold about you, ask us to correct it, or ask us to delete your account and everything attached to it. The copy and the deletion are both on the Account page in the app, under Your data, and happen at once: the copy is one plain JSON file saved beside your own campaign files, and deleting ends your subscription first, then removes the account. If you cannot sign in, or you are asking about someone else's account, email hello@loremonkey.com and we will deal with it within 30 days. Deleting your account does not touch the files on your own computer, because we never had them.

You can also object to processing we base on legitimate interests, ask us to restrict it, or ask for your data in a portable form. If you think we have handled your data badly, you can complain to the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY), or to the data protection authority in the EU country you live in.

Children

You must be at least 16 to hold a LoreMonkey account, and 18 to buy a plan or a credit pack. Sixteen is the highest age any EU country sets for a child to agree to this kind of processing on their own, so it is the one we use everywhere rather than a different rule per country. Creating an account asks you to confirm you are 16 or older, and the first purchase asks once whether you are 18; we keep the date you said so. We do not knowingly create accounts below it.

Plenty of tables include people younger than that, and transcribing your own game is not the problem, because that stays on your computer. What you should not do is run an AI feature in a way that sends a child's speech or name to us unless you have the right to do so, which for a child who is not yours generally means their parent agreeing. If a parent writes to us about a child at someone's table, we treat it exactly like any other request in the section above.

Changes

If this policy changes in a way that matters, we will say so in the app rather than quietly editing this page. The date at the top always reflects the current version.