Paladinia Privacy Policy

1. Who we are

Paladinia: AI Dungeon & RPG (“Paladinia”, “the app”) is developed and operated by Abur Labs Yazılım Ticaret Limited Şirketi (“Abur Labs”, “we”, “us”, “our”), an independent software company registered in Beyoğlu, İstanbul, Türkiye.

We are the data controller for the personal data described here — under the EU and UK General Data Protection Regulation (GDPR), and as veri sorumlusu under Turkish Law No. 6698 on the Protection of Personal Data (KVKK).

You can reach us at any time at info@aburlabs.com. Our full registered address is held on file with the trade registry and is available on request.

2. Scope of this policy

This policy covers the Paladinia mobile app on iOS and Android, and the aburlabs.com website. It does not cover Apple's or Google's own handling of your platform account and payment details, or any third-party website we link to — those are governed by their own policies.

3. Information we collect

3.1 Account information

When you create an account we collect your email address, an authentication identifier and, if you choose one, a display name. Accounts are managed with Supabase Auth. If you sign in with Apple or Google, we receive only the identifier and email address that the provider releases to us — which may be a private relay address — and never your password.

3.2 Content you create

Paladinia stores the adventures you play so they persist across sessions and devices: your characters, campaigns and world state, quest and inventory progress, the narration and chat history of your runs, and any sandbox stories you write, along with your in-app settings.

3.3 Purchase and subscription data

When you buy something we receive a pseudonymous app user ID, receipt validation results, product identifiers, subscription status and renewal or expiry dates, by way of RevenueCat. We never receive or store your card number, bank details or billing address — those go directly to Apple or Google.

3.4 Usage and diagnostic data

Firebase Analytics records app opens, session length, screens viewed and feature usage, plus a coarse country- or region-level location inferred from your IP address. Crashlytics records crash logs and stack traces, your device model, operating system and app version, and a pseudonymous installation identifier. Neither is tied to your real-world identity.

3.5 Advertising identifiers

Google AdMob may process your device advertising identifier — the IDFA on iOS, but only if you grant permission through App Tracking Transparency, and the Advertising ID on Android — along with your IP address and your interactions with ads.

3.6 Support correspondence

If you email us, we keep your message, your address and anything you choose to include, so we can help you and follow up.

3.7 What we never collect

Paladinia does not request or collect your precise or GPS location, your contacts, your photo library or camera, your microphone, health or fitness data, biometric data, or payment card numbers. We do not knowingly collect any personal data from children below the ages set out in section 12.

4. How and why we use your information

We only use your information for the purposes below. The final column gives our legal basis under the GDPR; the equivalent grounds under Article 5 of the KVKK — necessity for the performance of a contract, our legitimate interests, and explicit consent where it is required — apply in Türkiye.

We do not use your personal data to make decisions about you by purely automated means that produce legal or similarly significant effects.

5. AI processing and your story content

Paladinia is powered by a large language model, so this section matters more than any other. Please read it.

What gets sent, and where

When you play, the text you type and the relevant story context — your character sheet, recent narration, world and quest state — is sent over an encrypted connection to the OpenAI API so that a response can be generated and returned to you. This is the core function of the app: without it, there is no dungeon master.

Your content is never used to train AI models

Neither Abur Labs nor OpenAI uses your prompts, your characters or Paladinia's outputs to train or fine-tune any AI model. This reflects OpenAI's standard API terms, under which data submitted through the API is not used for model training. OpenAI may retain API content for a limited period — up to 30 days — purely to detect abuse and to meet legal requirements, after which it is deleted, unless a longer period is legally mandated.

Nobody is reading your adventures

We do not routinely read the stories you play. Your content may only be examined where automated safety systems flag it, where you report a problem to us, or where we are legally compelled to do so.

Please keep real personal information out of your prompts

Anything you type becomes part of the story context that is sent for processing. Do not enter real-world sensitive information about yourself or anyone else — identity or payment numbers, health details, passwords or addresses. Paladinia is a fiction engine, and it does not need them.

AI output is fiction, and it can be wrong

Narration, characters and outcomes in Paladinia are generated by a probabilistic model. They are fictional, may be inaccurate, inconsistent or unexpected, and must never be treated as medical, legal, financial or any other kind of professional advice. We apply content filters, but no filter is perfect.

6. Who we share information with

We do not sell your personal data. We share it only with the service providers below, who process it on our instructions and for the purposes stated, and only with the data each one actually needs.

Beyond these providers, we disclose personal data only where the law requires it — a valid legal request, court order or regulatory obligation — where it is necessary to establish, exercise or defend legal claims, or to protect the rights and safety of our players and of Abur Labs. If we are ever involved in a merger, acquisition or sale of assets, your data may transfer to the successor entity; we will tell you before it becomes subject to a different policy.

7. Advertising and tracking

Paladinia is free to download, and advertising through Google AdMob helps fund it. You are in control of how personal that advertising is.

• On iOS, we ask for permission through App Tracking Transparency before your IDFA is used. If you decline, we ask AdMob to serve non-personalised ads instead. You can change your answer at any time in Settings → Privacy & Security → Tracking.
• On Android, you can opt out of ad personalisation or delete your Advertising ID entirely in Settings → Google → Ads.
• In the EEA, the UK and Switzerland, we ask for your consent through a Google-certified consent management platform before any personalised advertising or ad-related identifiers are used, and you can change that choice at any time from the app's settings.

We do not build advertising profiles ourselves, and we run no cross-app tracking of our own. To understand how Google uses data from apps that use its services, see Google's partner policy and your Google Ads settings.

8. In-app purchases and subscriptions

All in-app purchases and subscriptions are sold and processed by the Apple App Store or Google Play. Your payment details go directly to them under their terms and privacy policies; we never see or store them. We use RevenueCat to validate receipts and keep your entitlements consistent across your devices.

Subscriptions renew automatically until cancelled. You can manage or cancel yours in your App Store or Google Play account settings — note that deleting the app does not cancel a subscription. Refunds are handled by Apple and Google under their own policies.

9. How long we keep your data

We keep personal data only as long as we need it for the purpose it was collected for, or as long as the law requires.

• Account data and saved adventures — for as long as your account is active. After deletion, removed from live systems within 30 days and purged from backups within 90 days.
• Prompts and responses at OpenAI — up to 30 days for abuse monitoring, then deleted by OpenAI.
• Purchase and billing records — retained for as long as applicable Turkish tax and commercial law requires, which can be up to ten years, even after you delete your account.
• Analytics and crash data — held under our providers' retention settings, typically up to 14 months for analytics events and around 90 days for crash reports.
• Support correspondence — up to 24 months after your request is resolved.

10. International data transfers

We operate from Türkiye, and the providers listed in section 6 are located in the United States and the European Union. Using Paladinia therefore involves transferring personal data across borders, including to countries whose data protection laws differ from those where you live.

Where personal data protected by the EU or UK GDPR is transferred outside the EEA or the UK, we rely on the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or an adequacy decision, together with the additional safeguards our providers commit to. Transfers abroad of data subject to the KVKK are made on the grounds permitted by Article 9, including your explicit consent where it is required.

11. How we protect your data

We encrypt data in transit with TLS and at rest, restrict internal access on a least-privilege basis, authenticate through established identity providers, and host with reputable infrastructure providers who maintain their own security programmes.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security. Please use a strong, unique password or sign in through Apple or Google. If you believe your account has been compromised, or you have found a security issue, write to us at info@aburlabs.com and we will respond quickly.

12. Children's privacy

You must be at least 13 years old to use Paladinia. If you are in the European Economic Area or the United Kingdom, you must be at least 16. Paladinia is not directed to children below these ages, and we do not knowingly collect their personal data.

The app carries a 12+ store content rating, which describes the maturity of its content — it is not the minimum age for holding an account, which is set out above. If you are a parent or guardian and believe your child has given us personal data, contact us at info@aburlabs.com and we will delete the account and its data promptly.

13. Your privacy rights

If you are in the EEA or the UK

You have the right to access your personal data, to have it corrected or erased, to restrict or object to how we process it — including any processing based on our legitimate interests — to receive it in a portable format, and to withdraw consent at any time without affecting processing already carried out. You may also lodge a complaint with your local supervisory authority.

If you are in Türkiye

Article 11 of the KVKK gives you the right to learn whether your personal data is processed and to request information about it, to learn the purpose of processing and whether it is used accordingly, to know the third parties to whom it is transferred at home or abroad, to request correction, deletion or destruction and to have those changes notified to third parties, to object to a conclusion reached solely by automated analysis, and to claim compensation for damage caused by unlawful processing. You may complain to the Turkish Personal Data Protection Authority (Kişisel Verileri Koruma Kurumu).

If you are in California

You have the right to know what we collect and how we use it, to request deletion or correction, to opt out of the sale or sharing of personal information, to limit the use of sensitive personal information, and not to be discriminated against for exercising any of these rights.

We do not sell your personal information for money. However, using Google AdMob to serve personalised advertising may count as a “sale” or “sharing” of personal information under the CCPA as amended by the CPRA, because those terms are defined very broadly. You can opt out at any time by declining the App Tracking Transparency prompt on iOS, by disabling ad personalisation on Android, or by emailing us.

How to exercise any of these rights

Use the in-app controls where they exist — see section 14 for deletion — or email info@aburlabs.com from the address registered to your account. We may need to verify your identity before we act, and we will respond within 30 days under the GDPR and the KVKK, or 45 days under the CCPA, extending only where the law allows and telling you if we do. Exercising your rights is free, unless a request is manifestly unfounded or excessive. Californian residents may use an authorised agent, who must provide proof of authorisation.

14. Deleting your account and your data

You can delete your account and its data at any time, without writing to anyone:

• In the app — open Settings → Account → Delete Account and confirm.
• By email — write to info@aburlabs.com from your registered address and we will process the deletion for you.

Deletion is permanent. It removes your account, your characters, your campaigns and world state, and your narration and chat history from our live systems within 30 days, and from our backups within 90 days.

Two things survive: purchase and billing records we are legally required to keep for tax and accounting purposes, and aggregated or anonymised statistics that can no longer identify you. Deleting your account also does not cancel an active subscription — cancel that separately in your App Store or Google Play settings, or you will continue to be charged.

15. Push notifications

Paladinia sends push notifications only if you allow them when your device asks. To do that we process a device push token. You can withdraw permission at any time in your device's notification settings, and doing so does not affect anything else in the app.

16. Changes to this policy

We may update this policy as the app evolves or the law changes. When we do, we will revise the “last updated” date at the top of this page. If a change is material, we will give you notice in the app or by email before it takes effect, and where the law requires it we will ask for your consent again. Continuing to use Paladinia after a change takes effect means you accept the revised policy.

17. How to contact us

For any privacy question, request or complaint, write to us — a real person reads every message.

Our registered address is on file with the Istanbul trade registry and will be provided on request, including to regulators and app store reviewers.