Privacy Policy
Version: 2026-10-15
Effective date: 2026-10-15
This policy explains what personal information HARPR-14 collects, why, who else receives it, how long we keep it, and what choices you have. It goes with our Terms of Service at https://harpr14.com/terms, which are part of the agreement between you and us.
1. Who we are
HARPR-14 (also called "HARPR-14 RPG" or "the game") is a noir text role-playing game. It is played at https://play.harpr14.com. The information site is https://harpr14.com. This policy covers both the game and the information site.
The game is run by Neural Network Media ("we", "us"). Neural Network Media is a trade name (a "doing business as" name) of Veritech Dynamics LLC, a limited liability company organised in Wisconsin. Our mailing address is Veritech Dynamics LLC (DBA Neural Network Media), c/o Registered Agents Inc., 2800 E. Enterprise Ave, Suite 333, Appleton, WI 54913.
Contact for anything in this policy: the contact form.
2. The short version
- We collect a username, a password (stored only as a one-way hash) and an email address.
- We store what you type into the game and what the game writes back, so you can continue your games.
- To write the story, your text is sent to AI model providers (today, models hosted on Microsoft Azure).
- Payments are handled by Stripe. We never see your card number.
- We do not run advertising trackers. Our information site, harpr14.com, uses Cloudflare Web Analytics to count visits, and the game itself uses no analytics. The game page loads fonts from Google, which sends your IP address to Google; the information site serves its own fonts.
- The game content is ours, not yours. What you type and what the game writes back belong to the operator (see the Terms, section 8). Deleting a game hides it from you; we may keep the content.
- We keep copies of every request sent to the AI models and every reply, which includes what you typed. We do not currently delete them automatically (section 3.5).
- We do not train AI models on your games.
- You must be at least 13 years old to play.
3. Information we collect
3.1 Account information
| What | Why | Notes |
|---|---|---|
| Username (1 to 32 letters, digits, underscore or hyphen; stored in lower case) | Identify your account | |
| Password | Log in | We store only an argon2id hash, never the password |
| Email address | Password reset, email verification, payment receipts, support | Stored on your account after you click the confirmation link |
| Device label (optional) | Show you a list of your logged-in devices | Free text you choose |
| Login session records | Keep you logged in | A hash of your login token, device label, expiry time |
| One-time email tokens | Verify email, reset password | Stored only as hashes; a verify link lasts 24 hours and a reset link 1 hour |
| Sign-up record | Show that you accepted the Terms and confirmed the minimum age | The time, the Terms version, and the minimum age you confirmed |
| Marketing choice | Honour your choice | An optional box at sign-up, never pre-ticked. We do not currently send marketing email |
3.2 Game content
When you play, we store:
- every action you type and every reply the game writes;
- the state of your game world: characters, places, objects, memories, case notes and scene records;
- any notes you add to your case file;
- records of each AI call for your game: which model, how many tokens, what it cost and how long it took.
No other player can open your game. The content is nonetheless ours to keep and reuse (section 6).
3.3 Images
If scene illustrations are on for your game, the game makes picture prompts from the scene and sends them to an image model. The picture shown in your game carries the game's on-screen display (the "HUD"), which includes names and short overheard quotes from your scene burned into the picture. Those finished pictures are stored for your game and are never shown to other games.
The game also keeps a shared library of clean scene pictures ("plates": the same picture without the on-screen display) so that a place does not have to be drawn again. A plate is shared with other games only if it shows a place from the game's built-in set of places in its normal state, and only after an administrator has verified it. Another game that reuses a plate puts its own on-screen display on top, built from that game's own scene. A plate is drawn from the built-in place's own description, not from your text, and it is not tied to your username.
Generated images belong to us, may be reused in other games, and stay when you delete a game from your view.
3.4 Payment information
You pay through Stripe Checkout, a page hosted by Stripe. Your card details go to Stripe, not to us. We store:
- which credit pack you bought, the amount, the currency and the time;
- Stripe's identifiers for the checkout, the payment and the customer record;
- a ledger of your credits: purchases, spending, refunds and adjustments;
- if you dispute a payment with your bank, a record of the dispute and of any action we take on your account (Terms, section 7).
We send Stripe your account's internal ID and username as labels, and your email address.
3.5 Technical information
- IP address. Your address is used to limit repeated sign-up, login and password-reset attempts. Some log lines include your IP address (for example failed and successful logins). When an administrator acts on an account, their own IP address is recorded.
- Server logs. Our server writes logs that include usernames and, for failed email sends, the recipient's email address. We have not set a fixed period for how long logs are kept.
- Copies of AI requests and replies. For running and tuning the game we keep a full copy of every request sent to the AI models and every reply. These include what players type, the game's instructions to the model, and parts of the hidden game state that you are never shown (for example who is secretly guilty in a case). Players cannot switch this off. They are available to the owner and to people with access to our servers, and are not shown to players. We do not currently delete them automatically. We will review this and publish a retention period.
- Browser storage. See section 8.
3.6 Information you send us
If you send us a message through the contact form, we keep your name, email address, the message and our reply for as long as needed to deal with it. The form uses Cloudflare Turnstile to check that a message comes from a person, and the message is delivered to us by Azure Communication Services.
Bug reports and feedback you send from the game. If you use the in-game feedback form, we receive what you write, up to four screenshots you attach, your username, your browser details, the page you were on, the last error the game showed, and context from your current game. Reports are stored as issues in a GitHub repository that we control, and a screenshot may be checked by an AI model. The issue text is kept without a set end date; screenshots are deleted about 30 days after the issue is closed. The people who read reports include the owner and anyone the owner gives access.
4. How we use information
- To run the game, keep your saves, and show you your history.
- To log you in, keep your account secure, and limit abuse.
- To take payment, add credits, work out the cost of each action, and handle refunds and disputes.
- To fix bugs and check quality, including reading saved AI requests and replies and, with a recorded reason, an administrator reading a player's transcript.
- To keep an archive of games to operate, analyse and improve the game (section 6). We do not use games to train AI models.
- To add characters, places and rewritten memories from finished games to a shared library used in other games (section 6).
- To send service emails: verification, password reset and receipts. We do not send marketing email.
- To meet legal duties and defend legal claims.
5. AI providers and your text
The story is written by AI models. Each time you act, text derived from your input and your game state is sent to model providers over the internet. This includes what you typed.
Today the story, scene pictures and character portraits are produced by models hosted on Microsoft Azure. The Azure providers handle your text under their own terms, which we do not control. We cannot promise how long a provider keeps what it receives (for example for abuse monitoring), or that no person at a provider ever sees it. Do not type secrets or other people's personal information into the game.
No human reads your game as it is played (except where you send us a report from the game). No person reviews the story before you see it. We may read stored games and saved AI requests and replies when we investigate a bug, a payment problem, or a report of rule-breaking content.
Training. We do not train AI models on players' games. Archived games are kept to operate, analyse and improve the game. If that ever changes, we will update this policy first.
Comparing models. When we compare AI models, we may replay saved requests, which can include what real players typed, against other models. That is evaluation, not training.
6. Who can see your information
Ownership of game content. The game data belongs to the operator, not to the player. That covers what you type, what the game writes, the world state and the generated images. The Terms (section 8) give the details, and the rights we have over game content. We do not sell your personal information and do not share it for advertising.
Other players, through the shared library. The game keeps a library of characters and places that later games can draw on, so they need not be invented again. What happens:
- When you end a game, the game reviews it and may add characters and places that appeared in it to the library.
- A library character keeps its name and its description (who the character is). The hidden guilt layer from your game is removed.
- The memories that carry over are rewritten. An AI call rewrites a character's memories to keep the feeling and drop specifics, and the server then replaces other proper nouns and removes identifiers and dates. A memory that still looks risky is held back and not used in other games.
- Places are saved with their name and properties as the game wrote them, and checked for dates.
- What other players can receive: the character's name and description, rewritten memories, places, and clean scene plates of built-in places (section 3.3). Other players do not receive your transcript, your account details, or the finished pictures from your own game. Library records do not carry your username.
- This is automatic and imperfect. A name or detail you invented in your game can end up in the library, because a library character or place keeps its own name and description. Library entries stay after you delete a game. They do not carry your username, but they record which game they came from.
Novellas and exports. The game can compile a finished game into a long-form "novella" manuscript. Compiling and exporting are done by our administrators; players cannot do them, and we do not offer players an export of their games. The Terms say we may publish novellas or audiobooks made from games.
Archive. We keep game content, including after you delete a game: an abandoned game is studied to learn why players stop, and a finished game may be used to improve the game.
Our staff. That means the owner and administrator accounts. An administrator can list accounts, see email addresses, view a player's transcript (a reason is required and each view is logged), grant credits, and close accounts.
Service providers. Section 7 lists them.
Legal and safety. We may disclose information when the law requires it, to protect people from harm, or to enforce our Terms.
Business transfer. If we sell or merge the service, your information may move to the new owner under this policy.
7. Service providers
| Provider | What it receives | Why |
|---|---|---|
| Microsoft Azure (AI models) | Your game text in prompts; scene and portrait prompts and images | Writes the story and makes images |
| Microsoft Azure (email delivery) | Your email address and the message content | Sends verification, password-reset and receipt emails |
| Stripe | Email, internal user ID, username, and the payment details you give Stripe | Takes payments, sends receipts, handles tax, refunds and fraud checks |
| GitHub | Bug reports you send from the game, with any screenshots | Tracks and fixes the problems you report |
| Cloudflare (web analytics, information site only) | Page visited, referring site, browser and operating system, approximate country, and page-load timings, when you visit harpr14.com | Counts visits and shows us which pages work |
| Google Fonts | Your IP address and browser details when the game page loads | Page fonts |
Apart from Cloudflare Web Analytics on the information site, we use no analytics, advertising or session-replay service, and no automatic error-tracking service (only the reports you choose to send). We may change providers, and will update this list when we do. Each provider handles your information under its own terms.
8. Cookies and similar storage
Cookie. The game sets one cookie, harpr_session. It keeps you logged in. It is HttpOnly, SameSite=Lax, valid for
90 days, and renewed when you are active. It is strictly necessary for the service. We set no advertising cookies.
Cloudflare Web Analytics on harpr14.com does not use cookies or local storage to recognise you.
Browser storage on your device. The game stores in your browser's local storage:
- a cached copy of your current transcript, so the page reloads quickly;
- the ID of your current game;
- a debug-display preference;
- the version of the "What's new" list you last saw;
- text you were about to send when you left to buy credits, so it can be restored afterwards.
It also uses session storage to remember that you dismissed a low-credit reminder.
This means the text of your recent play stays in your browser on that device until you clear site data. On a shared device, log out and clear site data.
Third-party requests. Loading the game page asks Google Fonts for fonts. Stripe Checkout, which you leave the game to use, sets its own cookies under Stripe's policy.
9. How long we keep information
| Data | Kept for |
|---|---|
| Account details (username, password hash, email) | As long as the account exists; kept after closure as described in section 10 |
| Sign-up record (Terms version, time, confirmed age) | As long as the account |
| Login sessions | 90 days, renewed when you are active; up to 20 devices |
| Email tokens | 24 hours (verify), 1 hour (reset) |
| Game content (turns, world state, call records, images) | Until you delete the game; after that we may keep a copy in the archive, with no set end date |
| Copies of AI requests and replies | No automatic deletion yet. We will review this and publish a period |
| Shared library entries and shared scene plates | Kept; not removed when you delete a game |
| Payment and credit records | Kept; needed for accounting, tax and disputes |
| Server logs | No fixed period |
| Rate-limit counters | In memory until restart or the window ends |
| Data held by Stripe, Microsoft and Google | Under their own policies |
Copies of our data are also held in backups, which we do not edit when you delete something, so deleted data can persist in a backup copy.
10. Your choices and rights
What you can do yourself
- Delete a game from your view, using the game menu. This hides the game from you; we may keep the content (section 6).
- See and revoke your logged-in devices.
- Change your password (or reset it by email).
What you can ask us to do (use the contact form or write to legal@harpr14.com)
- Tell you what personal information we hold about you.
- Correct your email address.
- Close your account. This is done by hand by an administrator. Closing stops you logging in and ends your login sessions. Your games stay in our records, and we may keep your account record (including your username and email address) and your payment and credit records, because we need them for accounting, tax and disputes and to stop a closed or banned account from being registered again. Where an administrator removes an account record entirely, a note of the username and email address is kept in our administrator log.
What we do not delete. Game content (the games, generated images, library entries and archive copies) is ours and stays, unlinked from your identity when your account is closed. What you type can itself contain personal information, so please do not type real people's personal information into the game. We cannot promise to erase game content on request.
Your legal rights. Depending on where you live (for example the EU, the UK or California), you may have rights to access, correct, delete, restrict, object to, or take a copy of your information, and to complain to a regulator. Email us to use them. We will answer within the time the law that applies to you requires, and in any case within a reasonable time. Some rights are limited by our retention of game content, described above.
11. Children
You must be at least 13 years old to play. We do not knowingly collect information from anyone younger. The game contains violence, death and adult themes, including romantic and sexual subtext (nothing explicit); the Terms (section 4) explain this. If you believe a child under 13 has an account, use the contact form and we will close it.
12. International transfers
We, and the providers in section 7, process information in the United States and possibly other countries. If you are outside the United States, your information is transferred to and handled in those countries.
13. Security
- Passwords are hashed with argon2id.
- Login and email tokens are stored only as hashes, so a copy of the database cannot be used to log in.
- Sign-up, login and password-reset attempts are rate-limited.
- If you dispute a card payment with your bank, our system closes the account automatically (Terms, section 7).
- Card data never touches our servers.
No system is perfectly secure, and we cannot guarantee the security of your information.
14. If something goes wrong
If we learn of a security incident that puts your personal information at risk, we will notify affected people and authorities as the law requires. We would also post a notice in the game and on the site.
15. Changes to this policy
We will post changes here and update the version and date at the top. For a change that matters (a new use of your data, a new kind of provider, any decision to train models on games), we will tell you in the game and by email before it applies to you, and the game will ask you to accept the updated Terms and Privacy Policy before you carry on playing.
16. Contact
Contact form: https://harpr14.com/contact
Legal and copyright notices: legal@harpr14.com
Operator: Neural Network Media (a trade name of Veritech Dynamics LLC), at the mailing address given in section 1.