Skryrún

Privacy Policy

Last updated: March 2026

Skryrún is operated by Skryrun, a business registered in the State of Utah. This policy describes what information we collect, how we use it, and your rights regarding your data.

Information We Collect

Account information: When you create an account we collect your email address. We use Supabase for authentication. We do not store passwords — authentication uses magic links sent to your email.

World content: The articles, entities, relationships, and other content you create in Skryrún is stored on our servers and is yours. We do not claim ownership of your content.

Usage data: We collect anonymized usage events (such as session starts, searches, and feature interactions) to understand how the product is used and improve it. These events are linked to a one-way hashed identifier and cannot be traced back to your account. You may opt out of usage data collection in your account settings.

Payment information: If you subscribe to a paid tier, payments are processed by Stripe. We do not store your payment card information. Stripe's privacy policy applies to payment data.

Uploaded files: Images and other media you upload are stored on Cloudflare R2. We store the file and a reference to it in your account.

How We Use Your Information

We use your information to:

  • Provide and maintain the Skryrún service
  • Send authentication emails (magic links)
  • Send transactional emails related to your account
  • Improve the product based on anonymized usage data
  • Process payments through Stripe

We do not sell your personal information. We do not use your information for advertising. Skryrún products are ad-free.

Third-Party Service Providers

We share data with the following service providers to operate Skryrún. Each provider processes data only as necessary for the stated purpose:

  • Supabase — database hosting and authentication (stores your account data, worlds, and content)
  • Cloudflare R2 — media storage (stores images and files you upload)
  • Vercel — application hosting and performance monitoring (serves the application and collects anonymized page-load metrics via Speed Insights)
  • Stripe — payment processing (handles subscription billing and creator payouts via Stripe Connect)
  • Resend — transactional email delivery (sends account notifications, purchase confirmations, and moderation updates)
  • Crisp — live chat support widget (processes your messages and basic device info when you use the chat feature)
  • OpenAI and Anthropic — AI-powered content moderation and generation (marketplace listings are scanned for policy compliance; AI features send world content to generate suggestions). See the AI Data Handling section below for details.

These providers are located in the United States. We do not sell your data to any third party.

AI Data Handling

Skryrún uses AI features (the Runekeeper tier) and AI-assisted moderation. This section explains exactly how your data is handled in both cases.

AI generation features (Runekeeper tier): When you trigger an AI action — generating an NPC, asking a question about your world, running the brainstorming wizard — the relevant content from your world is sent to OpenAI's API as context for that single request. This data is processed to generate a response and is not retained, stored, or used to train AI models. We use OpenAI's API under a data processing agreement that prohibits training on API inputs.

Your content is never used to train AI models. Not ours. Not OpenAI's. Not any third party's. The AI reads your world to help you work in it; it does not learn from it or pass it to anyone else.

AI moderation: Marketplace listings submitted for publication are scanned by AI for policy violations (prohibited content, hate speech, copyright indicators). This scan runs once at submission time. The data is not retained by the AI provider beyond the scan. Human moderators review all flagged content and make final decisions.

AI features are opt-in. No AI processing occurs on your content unless you are on the Runekeeper tier and explicitly trigger an AI action. Free and Weaver tier users' world content is never sent to any AI service.

For a full explanation of our AI approach, see our AI Transparency page.

Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

  • Access: Request a copy of the personal data we hold about you
  • Portability: Export your data in a machine-readable format at any time via the data export feature in your account settings — available to all users at no cost
  • Correction: Update inaccurate personal data in your account settings
  • Deletion: Request deletion of your account and associated data by contacting us at legal@skryrun.com — we will delete your account and personal data within 30 days
  • Opt out of analytics: Disable anonymized usage data collection in your account settings

World content you have published to the Community Library may persist in forked copies held by other users after account deletion, as those copies belong to those users.

For California Residents (CCPA)

If you are a California resident, you have the right to know what personal information we collect, request its deletion, and opt out of any sale of personal information. We do not sell personal information. To exercise your rights, contact legal@skryrun.com.

For European Users (GDPR)

If you are located in the European Economic Area or United Kingdom, our legal basis for processing your data is: (a) contract performance (providing the service you signed up for), (b) legitimate interest (improving the product via anonymized analytics), and (c) consent (where applicable, such as marketing emails). You may withdraw consent at any time. You have the right to lodge a complaint with your local data protection authority.

Data Retention

We retain your data for the following periods:

  • Account data: Until you delete your account, plus up to 30 days for processing
  • World content: Until deleted by you; soft-deleted content is permanently removed after 30 days
  • Anonymized usage events: Up to 12 months from collection
  • Payment records: Retained for 7 years as required by tax and accounting regulations
  • Support conversations: Retained for 2 years from last interaction

Cookies and Local Storage

Skryrún uses cookies for authentication session management only. We also store your theme preference in browser local storage. We do not use tracking cookies or third-party advertising cookies.

The Crisp support widget and Vercel Speed Insights may set their own cookies when active. You can manage cookies through your browser settings.

Children

Skryrún is not directed at children under 13. We do not knowingly collect personal information from children under 13.

Changes to This Policy

We will notify users of material changes to this policy via email or an in-app notice.

Contact

For privacy questions or data deletion requests:
legal@skryrun.com
Skryrun