Privacy Notice

1. Who we are

Weapon and Flame is operated by Karla Andrew (the "Seller", "we", "us"), acting as the data controller for personal data collected through the Service. This notice explains what we collect, why, how long we keep it, and the rights you have.

2. Personal data we collect

• Account data: name (if provided), email address, hashed login credentials.
• Quest data: heroine class, goals, sealed daily quests, streaks, chapter progress, and any notes you write.
• Support messages: the content of any messages you send us.
• Usage & device data: log data such as IP address, browser and device identifiers, pages visited, and timestamps.
• Subscription metadata: tier, status, renewal date, and Paddle customer/ subscription identifiers (payment card details are collected and stored by Paddle, not by us).

3. Why we use it (purposes & legal basis)

• Providing the Service — creating and managing your account, generating and storing your quests, running your dashboard. Legal basis: performance of a contract.
• Security & fraud prevention — detecting abuse, protecting accounts, keeping the Service safe. Legal basis: legitimate interests.
• Product improvement — understanding how the Service is used, fixing bugs, shaping new features. Legal basis: legitimate interests.
• Customer support — responding to your requests. Legal basis: performance of a contract / legitimate interests.
• Legal & tax obligations — keeping records we are required to keep. Legal basis: legal obligation.
• Marketing (only if you opt in) — product news, tips, story-arc launches. Legal basis: consent, which you can withdraw at any time.

4. Who we share it with

• Service providers / sub-processors — hosting, database, authentication, analytics, and support tooling that operate on our behalf under written data-protection terms.
• Paddle.com — our Merchant of Record for all orders. Paddle handles payments, subscription management, tax compliance, invoicing, and refunds, and is an independent controller for the data it collects at checkout. See Paddle's own privacy notice at paddle.com/legal/privacy.
• Professional advisers — legal, accounting, and tax advisers where necessary.
• Authorities — where we are legally required to disclose data.

We do not sell your personal data.

5. International transfers

Some of our providers may process data outside the UK or EEA. Where they do, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses, the UK International Data Transfer Addendum, or adequacy decisions.

6. How long we keep it

We keep personal data only as long as we need it for the purposes above. Account and quest data are kept while your account is active; if you delete your account, we delete or anonymise the associated data within a reasonable period, except records we are legally required to keep (for example, tax and payment records held by Paddle).

7. Your rights

Depending on where you live, you have rights over your personal data. Under UK/EU GDPR these include the right to access, rectify, erase, restrict processing, port, or object to processing, and to withdraw consent at any time. You also have the right to lodge a complaint with your local supervisory authority. We aim to respond to requests within one month.

To exercise any of these rights, contact us from your account page.

8. Security

We use appropriate technical and organisational measures to protect your data, including encryption in transit, access controls, and least-privilege database policies. No system is perfectly secure, but we take security seriously and continue to invest in it.

9. Cookies

We use a small number of essential cookies (or equivalent local storage) needed to keep you signed in and to remember your preferences. If we introduce optional analytics or marketing cookies, we will ask for your consent first and you will be able to change your preferences at any time.

10. Children

The Service is not directed at children under 16. Please do not use it or provide personal data if you are under the minimum age in your country.

11. Changes to this notice

We may update this notice from time to time. The "Last updated" date at the top will change and, where the changes are material, we will notify you in-app or by email.

12. Contact

For any privacy question or request, contact Karla Andrew via the support channel linked from your account page.