DRAFT, not legal advice. Written in plain English from what the app's code does on 2026-10-09 (commit 35bc93f), for the owner and a lawyer to review. Every [TODO: ...] is either a gap between this text and the code, or a fact only the owner can supply. Remove this banner and the appendix before publishing. The App Store privacy "nutrition label" and the in-app consent screen must match the final text (plan section 6).
Effective date: [TODO: date]
Who we are: [TODO: legal name / business entity and address]
Contact: [TODO: privacy contact email]
1. What this app does
TavernQuill is for game masters (GMs) of tabletop role-playing games. You record your game session, and the app turns the recording into a transcript, a recap, a campaign wiki and answers to your questions about your campaign. You can optionally share a recap through a link or post it to Discord.
2. What we collect
•
Your email address (to sign in) and an optional display name: To run your account
•
Session audio you record: To make the transcript
•
Transcripts (the words, who said them, when) and your corrections: To make recaps, notes, the wiki and Ask
•
Names of your players and their characters, and the roll call at the start of a session: To label speakers. These are people who do not use the app
•
Notes, bookmarks, recaps, wiki entries (generated, and anything you edit): The core features
•
Ask questions and answers, with the sessions they cite: To answer questions about your campaign
•
Share links and how often each was opened and when last opened: To run revocable recap links
•
A Discord webhook you paste in, and a record of what we posted: Only if you connect Discord
•
Push notification token for your phone: Only if you turn on "recap ready" notifications
•
Usage records (which services ran, how much, estimated cost, and minutes of audio processed this month): To keep costs and plan limits in check
•
Subscription status (your plan, the product, when it renews or expires, whether a billing problem was reported) and your anonymous account ID as used by our purchase provider. We never see your card or Apple payment details: To give you the plan you bought
•
Your settings (such as notifications and whether you finished the first-run tour): To apply your choices
•
Your consent records (when you agreed to AI processing, when you confirmed table consent for each session, when you acknowledged sharing): To show consent was given
•
Your email address, if you join the waitlist on tavernquill.com, with the date you joined and which form you used. We don't store your IP address with your email. Our hosting providers keep short-lived request logs for security.: To send you an invite to TavernQuill, and nothing else
We do not use advertising or analytics SDKs in the app. [TODO: confirm nothing is added before release; if crash/analytics tooling is added (for example EAS Observe), list it here.]
3. Who processes your data (our service providers)
We use these providers. They process data for us; we do not sell your data.
•
Supabase: our database, file storage, sign-in and server functions. Holds everything above.
•
Deepgram: receives your session audio (and the campaign terms and names you provide as spelling hints) to produce the transcript.
•
Anthropic (Claude): receives the transcript text, player and character names, bookmarks, and your Ask questions with the transcript excerpts relevant to them, to write notes, recaps, the wiki and answers.
•
RevenueCat (and Apple): Apple takes payment for subscriptions and handles refunds. RevenueCat helps us check which plan an Apple purchase unlocks; it receives your account ID and your purchase and subscription records from Apple, not your name, email or any recording or transcript. We keep the resulting plan status in our database. [TODO: confirm RevenueCat's retention and deletion terms and whether the account ID is sent with an email or attributes.]
•
Expo: delivers push notifications (it receives your push token and a short message with the session number and campaign name, never the recap text).
•
Cloudflare: hosts our website (tavernquill.com and app.tavernquill.com), including the public page for shared recap links. Like any web host, it handles visitors' IP addresses and browser details to deliver the pages.
•
Discord: only when you connect a webhook. The recap text you choose to post is sent to the Discord channel you chose.
Before any audio is uploaded, the app asks you to agree to this processing, names Deepgram and Anthropic, and lets you decline (recordings then stay on your phone). You can withdraw consent in Account. [TODO: confirm each provider's data-retention and training terms for the owner's accounts, and state them here. For example, whether Deepgram and Anthropic keep API data and for how long.]
4. How long we keep it
•
Audio: deleted automatically after the recap is ready. How long it stays depends on your plan: 2 days on the Scribe plan, 30 days with a Scribe Pro subscription. The longer window lets subscribers re-run a session from the original audio. Audio from a session that failed to process, or that is paused because you ran out of hours, is deleted after 7 days on the Scribe plan and 30 days with a Scribe Pro subscription, so you have time to upgrade and resume. Transcripts, recaps, the wiki and Ask history are not affected: they are kept until you delete them or your account. If your subscription ends, audio already stored follows the shorter window from then on. [TODO: confirm how the server treats audio stored under a lapsed subscription.]
•
Raw transcription data from Deepgram (a technical copy of the transcript, kept for debugging): deleted after 14 days.
•
Everything else (transcripts, notes, recaps, wiki, Ask history, links, usage records): kept until you delete it or delete your account. You can delete any session (which also removes the Ask answers that cite it) or any campaign at any time.
•
Share links: work until you revoke them. Revoking takes effect immediately. A link always shows the current recap.
•
Push tokens: switched off when you turn notifications off or sign out. [TODO: disabled tokens are not deleted until the account is; decide whether to prune them.]
•
Waitlist email: kept until we send your invite and you create an account, or until you ask us to remove it. To be removed, email support@tavernquill.com from that address and we delete it.
•
Backups: deleted data can remain in provider backups for a limited time. [TODO: state Supabase's backup window.]
5. Recording consent is your responsibility
Laws about recording conversations differ by place, and many require everyone's permission. Before every session, the app asks you to confirm that everyone at the table, including anyone joining by voice or video, agreed to be recorded, shows you a sentence to read aloud, and stores the time you confirmed. You, the GM, are responsible for getting that permission. If anyone says no, do not record. We do not verify consent ourselves. [TODO: lawyer to review wording and the Terms of Service allocation of this responsibility.]
6. Sharing
Sharing is off until you turn it on, and you must first confirm once per campaign that your table agreed to recap sharing.
•
A share link is a long, random, unguessable web address for one recap. Anyone who has it can read that recap. Do not post it anywhere you would not want the recap read.
•
You can revoke a link at any time; it then stops working.
•
The shared page asks search engines not to index it and sends no referrer information.
•
Player names are redacted from shared pages and Discord posts (the roll-call player names are replaced). This is a best-effort backstop: it can miss nicknames, a last name on its own, or a common-word name at the start of a sentence. Read the preview before you share. Character names are not redacted.
•
We count how many times a link was opened and when it was last opened. [TODO: the code does not log viewer IP addresses, but the hosting and Supabase platforms may keep access logs; confirm.]
7. Discord
If you connect a Discord webhook, we store the webhook address (it works like a password for that channel), keep it private on our servers, and use it only to post the recaps you ask us to post. Disconnect it in the campaign settings to delete it. Posts already in Discord stay in Discord until a Discord admin removes them. Discord's own privacy policy applies to what happens there.
8. Your choices and rights
•
Delete a session, a campaign, an Ask answer, a share link or a Discord connection in the app.
•
Turn notifications off, or withdraw AI-processing consent, in Account.
•
Delete your account in the app (Account > Delete account, then type DELETE to confirm). Deleting your account permanently deletes your profile, campaigns, sessions, transcripts, recaps, wiki, Ask history, share links, Discord connection, push tokens and usage records and subscription status, and removes any stored audio and raw transcription files. The app also clears any recordings still waiting on your phone. It cannot be undone. It does not cancel an Apple subscription: cancel that in your Apple account settings (Settings > your name > Subscriptions) first. Copies already posted to Discord or read through a share link cannot be recalled.
•
Export your data: Account > Export my data gives you a copy of your campaigns, sessions, transcripts, recaps, wiki and Ask history as a file (limited to a few exports per hour). [TODO: remove this bullet if the export button is cut from the first release.] Audio is not included in the export.
•
Leave the waitlist: email support@tavernquill.com and we delete your address.
•
Ask a question or make another request: contact us at [TODO: contact]. [TODO: add region-specific rights (for example GDPR/UK, CCPA) if you target those users.]
Your players do not have accounts. If one of them asks us to remove their name or voice, contact [TODO: contact] or ask the GM, who controls the data.
9. Children
TavernQuill is not for children under 13 and we do not knowingly collect their data. If you believe a child under 13 has an account, contact us and we will delete it. [TODO: the app has no age question or gate today; the plan calls for an age rating of 13+ or 17+ and not listing in the Kids category. A game's players may be younger than the GM: lawyer to advise on recording minors and parental consent.]
10. Security
Data is sent over encrypted connections and stored in private storage. Access is limited by database rules so only the campaign owner can read their data. AI and transcription calls are made from our servers; keys are never in the app. No system is perfectly secure.
11. International transfers
Our providers may process data in other countries. [TODO: state the Supabase project region and the providers' locations; add transfer wording if EU/UK users are targeted.]
12. Changes
We will update this page and the effective date if this policy changes, and tell you in the app for material changes. [TODO: decide.]