The Lost Realms
Three different things happen under this name, and they collect very different amounts about you. This page separates them, because the honest answer for one of them is nothing at all and it would be misleading to let that stand for the other two.
Brave You Worlds, LLC, a limited liability company organised under the laws of the Commonwealth of Virginia, United States. Write to licensing@braveyouworlds.com about anything on this page.
| What | What we receive |
|---|---|
| This website | Nothing. It is a set of files with no server of ours behind it. No analytics, no tracking pixels, no advertising networks, no cookies of ours, and no database. |
| Signing in | Your email address, held in our identity provider. This is the one thing about you that exists anywhere in our care. |
| Playing the game | Nothing. Saves, characters and settings stay on your own machine, and nothing about your play reaches us. |
The Lost Realms uses Auth0 as its identity provider. When you sign in — on this site, in a hosted game, or in the copy of the game running on your own computer — you are signing in to an account in a tenant we operate.
What that account holds is small: your email address, whether the address has been verified, a name if the sign-in method supplied one, and an identifier Auth0 generates for you.
We run no user database of our own, and this page is still necessary. The site is static files; the game is software on your machine; neither has a server of ours storing anything about you. The account lives in Auth0. But it lives there on our behalf, in a tenant we operate and can read, so in the language of data protection Auth0 is the processor and we are the controller — the responsibility is ours even though the storage is not. “Our vendor holds it, not us” is how the arrangement works, not an exemption from it, and saying otherwise here would be the kind of claim this page exists to avoid making.
We use it for exactly two things:
One account across all three. The website, a hosted game and a copy running on your own machine share one identity provider, so it is the same account and the same address rather than three copies of you. That is deliberate: one place holds your details instead of several.
We do not sell it, rent it, trade it, or use it to advertise to you anywhere. No password we ever see: credentials are entered on our identity provider's own pages, never on ours, and the software we distribute holds no credential capable of reading anyone else's account.
The desktop app starts a small server on your machine — the Server Vault — and you sign in through it. Two consequences worth stating plainly:
Everything else stays with you: saves, characters, worlds, generated images and the server's own settings are files on your machine. The session that keeps you signed in is a cookie your own install signs with a key generated on your computer and shared with nobody.
If you sign in to a server run by someone else, that person decides whether you may play, from a list they control on their own machine. We say who you are; they say who may use their server. Signing in is not by itself permission to play, and we do not maintain any central list of who may play where.
The game itself reports nothing about your play to us. Your story, your character, your saved games and your settings are held in your own browser or on your own computer.
The Game Master is a large language model, which means the text of your turns is sent to a model provider to be answered — the provider you configured, or the one configured by whoever runs the server you are playing on. That provider receives what you type and what the game sends with it, and handles it under its own terms. It is not sent to us, and we keep no copy.
No analytics, no tracking pixels, no advertising networks, and no cookies of our own. Nothing here follows you between sites. Like any website, ours is served by a host that keeps ordinary server logs — the address a request came from, the page asked for, and when. We do not use those logs to build a picture of you.
The newsletter, where it is offered, is described in the Brave You Worlds privacy notice, which covers the company site.
Wherever you live, you can ask us what we hold about you, ask us to correct it, or ask us to delete it, and you can ask us to close your account. One email to licensing@braveyouworlds.com is enough for any of it.
If you are in the UK or the European Economic Area, those are rights under the GDPR rather than courtesies. The basis on which we hold your address is the contract between us — you asked for an account so that you could play — and you may withdraw from it by asking us to close the account.
This page is written for a reader. There is a second, more exact description of what the software does with data — what is stored, what is logged, and what leaves your machine — written to be checked against the source code rather than taken on trust: PRIVACY.md in the project repository. Where the two differ, that one is the technical truth and this one is the error.