Privacy notice

The short version

• You can play without an account. An anonymous playthrough is tied to a random id kept in your browser, not to you.
• The text of your playthrough is stored so you can come back to it, and it is sent to Google’s Gemini models to write the next part of the story.
• If you bring your own Gemini API key, it stays in your browser. It is sent with your own turn requests and is deliberately never written to our database.
• Anonymous runs are deleted after 45 days. Runs belonging to an account are deleted a year after the last time you open them. Deletion is done by the database itself.
• Nothing is sold, and there is no advertising on this site.

1. Who is behind this

KathaaVerse is a pre-launch project built and run by one person, operating as an individual rather than through a registered company. There is no legal entity to name as a data controller yet, and no business address to publish — the office is wherever a laptop happens to be. The contact point below is the real one, and it reaches an actual human, which is more than some registered companies can say.

Questions about anything on this page go to [email protected].

2. What counts as “you” here

There are two ways the app can recognise a playthrough as yours, and they are very different things.

A browser id, when you are not signed in

When you play without an account, the server sets a random identifier in a cookie your browser keeps and scripts on the page cannot read. It is not an account and it carries no information about you: it exists so that when you come back to this browser, the app can find the playthroughs that were started in it. It is not shared with any third party.

Browsers that played before this cookie existed may still have an older identifier in local storage. The server accepts that identifier once, to find those playthroughs, and then ignores it.

Clearing your browser’s site data, or using Clear this browser’s data in Settings, retires that cookie. A new one is minted next time, and the old playthroughs are no longer reachable.

An account, if you sign in

You can sign in with Google, or with a code sent to your email address, from your profile or settings. Once you do, the server uses your account id instead of the browser cookie; any playthroughs you already started anonymously in that browser are moved onto the account so you do not lose them.

3. What is collected, and why

Your playthroughs

Each playthrough is one record in our database. It holds the story text the model wrote and the actions you typed or chose, the title you picked from the library, your settings for that run (length, how far the story may depart from the source, beat length, whether illustrations are on), and any character details you filled in yourself — a character name, a personality, and a free-form goal. It also holds the run’s internal state: the current chapter, the milestones, and the ending, if you reach one. This is what a saved game is; without it there is nothing to resume.

Generated images

If you turn illustrations on, the pictures generated for your run are stored as image files in our database and served back to your browser. They belong to that run and are deleted with it.

Your account, if you have one

Signing in with Google, or with a code sent to your email address, creates an account record. That record stores your email address, and — because it uses our auth library’s standard shape rather than a trimmed-down one — has room for a display name and a profile-image URL too. Signing in with Google fills those in from your Google profile; signing in by email code leaves them empty, because there is nowhere in the app today to set them by hand. The sign-in itself is kept as a session that lasts 60 days.

Sign-in codes sent by email

If you sign in with an emailed code, your email address and a six-digit code are sent to our email provider so the message can be delivered. The code is stored only as a hash, is good for ten minutes, and is locked after a small number of wrong guesses.

Anonymous usage counts

The app records a small number of events so it can tell whether anyone is getting through the front door: a visit to the home page, a click on a title, the start of an adventure, and whether an illustration was produced or refused. Each event stores only the event name, the time, the id of the title involved, and a random identifier from a cookie called analytics_session, which lasts 30 days. No name, no email, no account link, no device fingerprint.

Model-call telemetry

Every call to an AI model records what the call cost: the kind of call, token counts, how long it took, how many retries it needed, which provider and model answered, and whether an image call succeeded or was refused. These rows carry no story text, no account id and no browser id — they exist so the owner can see what a playthrough costs to run.

Feedback you choose to send

When the built-in AI is offline the app offers a feedback box. If you use it, your message is stored along with the title you were looking at, the time, and the same anonymous analytics identifier. The box does not ask for your email addressand there is nowhere to type one, so feedback carries no way to contact you. Messages sent before September 2026 may still hold an address that was optional at the time; those expire on the schedule below.

What is deliberately not kept

• Your IP address is not stored. It is used in memory, for a few seconds, as the bucket label for a spam rate-limit on public endpoints, and is never written to the database.
• Your own API key is not stored on our servers. See the next section.
• There is no advertising, no ad network, no cross-site tracking pixel and no third-party analytics script beyond the hosting provider’s own (section 6).

4. If you bring your own Gemini API key

The app lets you supply your own Google Gemini API key instead of drawing on the shared one. Precisely what happens to it:

• It is saved in your browser’s local storage, under the key kathaaverse_api_key. It is stored there in the clear, as browser local storage always is, so treat it the way you would treat any secret on your own machine.
• It is sent to our server with each of your own turn requests, because the request to Google has to be made from the server. It is held only for the life of that request and used only to make that call.
• It is stripped before the playthrough is saved. The record schema for a saved game does not contain the key at all, so it cannot be written to the database even by accident.
• Clearing the field in Settings, or using Clear this browser’s data, removes it from your browser.

Your key’s usage, quota and any charges are between you and Google. Read the terms of use for what that means.

5. How long things are kept

Deletion is enforced by the database, not by someone remembering to run a script: every record that expires carries an expiry timestamp, and MongoDB’s own TTL indexes remove it when that time passes.

• Anonymous playthroughs and their images — 45 days. The clock is pushed forward every time you take a turn, so a run you are actively playing does not expire underneath you.
• Playthroughs belonging to an account, and their images — 365 days, counted from the last time you opened the run. Opening it resets the year. This is a sliding window, not a permanent archive: a run you have not touched in a year is deleted.
• Demo playthroughs — 2 days. The scripted demo is not a saved game.
• Usage events and model-call telemetry — 90 days.
• Sign-in sessions — 60 days, after which you sign in again.
• Feedback you send — 365 days. Stored against the anonymous analytics identifier rather than your account, so deleting your account does not reach it — the expiry is what removes it, including any address left in the older messages described above.

6. Who else is involved

These are the outside services the app actually uses, and what each one receives.

• Google (Gemini). Receives the text sent to generate each beat of the story: the story context, the character details you supplied, and the action you took. If illustrations are on, it also receives the prompt used to draw the scene and returns the picture. This happens on every turn — it is how the game works.
• Google (sign-in). If you choose to sign in with Google, the sign-in happens at Google and Google tells us who you are.
• Resend. Receives your email address and the sign-in code when you ask for one, in order to deliver that one message.
• MongoDB Atlas. The database everything described above is stored in.
• Vercel. Hosts the site, and therefore handles every request to it. The site also loads Vercel’s own Web Analytics and Speed Insights, which report page views and page-speed measurements. Vercel’s own documentation describes these as cookieless and free of personal data; we have not independently audited that claim, so read it as Vercel’s representation about its own product rather than ours.

Nothing is sold. No data collected here is sold, rented, or handed to a data broker or an advertiser, and there is no arrangement under which that could happen.

The database (MongoDB Atlas) runs in AWS’s Mumbai region (ap-south-1). The app itself (Vercel) runs its serverless functions from Washington, D.C. (iad1). Static assets are served from Vercel’s global CDN, and Cloudflare handles DNS and inbound email routing only — it does not hold app data.

7. Deleting your data

Three routes exist today, and all three are real — they delete records, not flags.

• Delete one playthrough. From your profile. It removes the run’s record and every image generated for it.
• Clear this browser. From Settings. It deletes every playthrough tied to this browser, clears any API key you stored, and retires the cookie that identifies the browser. There is no account behind an anonymous run, so this cannot be undone.
• Delete your account. When you delete an account, the app first deletes every playthrough owned by that account and every image belonging to those playthroughs; only then does it remove your sign-in sessions, the record of your sign-in provider, and the account itself, and sign you out. The order matters: if the purge fails, the account is kept rather than leaving your transcripts behind with nobody able to ask for their deletion. For security, deleting an account requires a sign-in less than a day old — otherwise you will be asked to sign in again first.

What account deletion does not reach. The anonymous usage events and the model-call telemetry are not linked to your account, so there is no way to find “yours” among them; they expire on their own after 90 days. Feedback you sent through the feedback box is stored against the anonymous analytics identifier rather than your account, so it is not removed by account deletion either — ask at [email protected] if you want a feedback message removed.

This notice is governed by the laws of India, where the service is operated from, and that is the framework a finished version of this page will name rights under. In the meantime, the practical version does not wait for that: write to [email protected] and ask to see, correct, or delete what is held about you, and it will be acted on — most of it you can already do yourself, from your profile and settings, without asking anyone.

8. Age

The app does not ask your age today and has no site-wide age gate — most of the library does not need one. The plan is a title-level check, prompted only for titles flagged as not suitable for a younger reader, the way a video site asks at the video rather than at the front door; that flag does not exist in the data yet, so nothing is checked. Until it does, no birthdate or age is collected, and no age-specific data is stored.

9. Security, honestly stated

Access to a playthrough is checked on every read and write against the owner recorded on it, and for a signed-in player that owner is taken from the sign-in cookie on the server rather than from anything the browser claims. Sign-in codes are stored hashed.

What this notice will not claim: there is no encryption-at-rest guarantee for the story text in the database beyond whatever the database provider applies by default, and this is a one-person pre-launch project with no formal security programme behind it. Please do not put anything into a story, a character description or the feedback box that you would be hurt to see leak.

10. Changes to this draft

This is a draft. It has not been reviewed by a lawyer, it is not in effect, and it can change at any time without notice while the product is pre-launch. When a reviewed version replaces it, this page will say so and carry its own date.