1. Who is responsible
Fablekeep is operated by David Bolívar Saldarriaga, Colombia. The operator is the data controller (responsable del tratamiento) for the personal data described here. Contact: support@fablekeepvtt.com.
2. The Fablekeep app
Your worlds, maps, notes, characters and files stay on your computer (or on the server you choose). The app does not send them to us, and we cannot see them.
The app contacts our licence server (license.fablekeepvtt.com) only to:
- activate and validate your licence: your licence key, a hashed machine identifier (a one-way fingerprint — we never receive the raw ID), a machine name you can see in Settings, the app version and the platform (Windows or macOS);
- check for and download updates: your signed licence file, the app version, the platform and the update channel.
Like any server, the licence server also sees your IP address while a request is handled; we use it only for security and rate-limiting and keep it in short-lived logs. There is no telemetry, no analytics, no crash reporting to us, and no access to your worlds or files.
3. Self-hosted and online play
When you host a game for others — on your local network or on a server online — that server is yours. The game master who runs it is responsible for the players’ data on it (names, characters, chat, diaries) and for telling players about it. Fablekeep (we) does not receive any of it.
4. Optional AI features
Fablekeep’s two AI features are off by default, and while they are off nothing from your worlds goes to any AI provider. If you switch on the assistant (your own account, for example Anthropic’s Claude through MCP), the parts of your worlds it works with — entries, notes, map layouts and map previews — travel between your app and that provider. If you switch on AI text, the prompt for those helpers (world and session context for NPC names and recaps) goes from your app straight to the provider you chose (an OpenAI-compatible service or Anthropic); with a local model, nothing leaves your computer. Either way, the provider’s terms and privacy policy apply, nothing passes through us, and we never see your account or key. Neither feature generates images or art.
5. This website
Visiting. The website is static. Our host serves pages and, like every web server, briefly processes your IP address and browser details to deliver them and protect against abuse. The site is hosted by Cloudflare (privacy policy).
Analytics (only with your consent). See section 6 and the cookie list. We use no advertising or social-media pixels.
Discord. Our community server runs on Discord. If you join it, Discord handles your account and messages under its own privacy policy; we see what you post there, like any member.
Buying. The checkout is run by Creem (merchant of record). It collects your name, email, billing address and payment details under its own privacy policy. We receive your name, email, country, order details and licence key so that we can deliver and support your licence. We never see your full card details.
Downloading. The download page on our licence server receives your licence key to give you the right installer, plus your IP address in short-lived logs.
Email. If you write to us, we keep the conversation to answer you and handle any follow-up.
6. Website analytics (Google Analytics)
If — and only if — you click “Accept analytics” in the cookie banner, this website loads Google Tag Manager and Google Analytics 4 to count visits and see which pages are useful. Until then no analytics script is loaded and no analytics cookie is set.
- Who. Google acts as our processor: Google Ireland Limited for visitors in the EEA and Switzerland, Google LLC elsewhere, under the Google Ads and Measurement data processing terms.
- What. Pages viewed, how you arrived (referrer), approximate location (country or city), device, browser and screen size, and a random identifier stored in the
_gacookies. We do not send Google your name, email or licence key. - IP addresses. Google Analytics 4 does not log or store IP addresses; it uses your IP only briefly to estimate your location and then discards it. For EU visitors this happens on servers in the EU.
- No advertising. Advertising signals stay off: Google Consent Mode keeps
ad_storage,ad_user_dataandad_personalizationdenied at all times, and Google signals and ads personalisation are disabled. - Retention. Analytics data is kept for 14 months, then deleted automatically.
- Legal basis. Your consent (GDPR art. 6(1)(a); the prior and express authorisation of Ley 1581 de 2012).
- Transfers. Data may be processed in the United States. Google LLC is certified under the EU–U.S. Data Privacy Framework, and Google’s terms include the European Commission’s standard contractual clauses.
- Changing your mind. Use “Cookie settings” at the bottom of any page to accept or reject at any time. Rejecting stops analytics and deletes the
_gacookies from this website. You can also block cookies in your browser, or install Google’s opt-out add-on.
8. Why we use data, and on what basis
| Purpose | Data | Basis (GDPR) |
|---|---|---|
| Deliver, activate and validate your licence; provide updates | Key, hashed machine ID, machine name, app version, platform, order details | Performance of our contract with you |
| Prevent piracy and abuse; keep systems secure | IP address (short-lived logs), activation records | Legitimate interest |
| Website analytics | Usage data and the _ga identifier (see section 6) | Your consent (withdraw any time) |
| Support and legal requests | What you send us | Contract or legitimate interest |
| Accounting and tax records | Order details | Legal obligation |
Under Colombian law, we process your data with your prior, express and informed authorisation where it is required, which you give when you buy or activate Fablekeep, or write to us. We do not sell or rent personal data, we do not use it for advertising, and we do not make automated decisions about you.
10. How long we keep it
- Licence and activation records: for as long as your licence exists, plus the period needed to handle disputes.
- Server logs with IP addresses: up to 30 days.
- Website analytics: 14 months (see section 6).
- Order and tax records: as long as tax law requires (in Colombia, generally up to 10 years).
- Support emails: up to 3 years after the last message.
11. Your rights and how to use them
Under Colombian law (Ley 1581 de 2012 and Decreto 1377 de 2013) you have the right to:
- know what data we hold about you and how we use it, free of charge;
- update and rectify it if it is incomplete or wrong;
- ask for proof of the authorisation you gave us;
- revoke your authorisation and ask us to delete your data, where no legal or contractual duty requires us to keep it;
- complain to the Superintendencia de Industria y Comercio (SIC) once you have contacted us first.
If you are in the European Union or the European Economic Area, the GDPR also gives you the rights of access, rectification, erasure, restriction, data portability and objection, the right to withdraw consent at any time, and the right to complain to your local data protection authority.
How to exercise them. Write to support@fablekeepvtt.com from the email address you used with us (or tell us your licence key hint), say which right you want to exercise, and we may ask for something to confirm it is you. We answer queries within 10 business days and complaints or requests to update, rectify or delete within 15 business days, as Colombian law requires; if we need more time we will tell you why within that period, and reply within at most 5 more business days for queries or 8 more for complaints. Under the GDPR we answer within one month.
12. Security
We collect as little as we can, which is the best protection. Licence files are cryptographically signed, machine identifiers are hashed before they leave your computer, all connections use HTTPS, and access to our systems is limited to the operator.
13. Children
The website and our services are not directed at children under 13 (16 in the EU). We do not knowingly collect their data; if you believe a child has given us data, write to us and we will delete it.
14. Changes
If we change how we handle data, we will update this page with a new date and, for important changes, tell you on the website or in the app before they take effect. If a change needs your consent, we will ask for it.