Privacy Policy

Kaiku keeps the logs of tabletop roleplaying campaigns. This page explains what it stores, where, for how long, and how to have it removed. The short version: there are no accounts, no tracking and no ads; campaign content is stored in the EU; transcripts are sent to Anthropic's API to write the logs, and deleted 30 days after their log is written.

Who is responsible

Contact details are still to be added to this page. Until then, ask the person who shared your campaign's link.

What Kaiku stores

• Campaign content that the group enters or that the app writes: the campaign's name, players' and characters' names, session logs, threads, NPCs, dates and attendance.
• Transcripts and notes. A transcript is the text of a session recording. The recording itself is never uploaded: it's turned into text on the group's own computer (for example with Buzz), and only the text is added to Kaiku. Notes are what a player writes from memory.
• Nothing about visitors as such. There are no accounts, no analytics, no advertising and no tracking cookies.

Transcripts can contain anything said at the table, including things said by people who aren't playing. Whoever records a session should tell everyone at the table first, and leave out anyone who doesn't want to be recorded.

What stays in your browser

Your browser keeps a list of the campaigns you've opened on that device, whether the campaign menu is open, and drafts of notes you haven't sent. They never leave the device. If you enter the site password to create campaigns, a cookie remembers that for a year; it holds a scrambled form of the password, nothing about you. These are needed for the site to work, so no consent banner is shown.

Who else handles the data

• Supabase stores the database, in Ireland (EU).
• Vercel runs the site; its servers for Kaiku are in Dublin (EU). Like any web host it keeps short-lived request logs, which include IP addresses.
• Anthropic writes the session logs: a transcript or notes, with the campaign's current threads, NPCs and characters, is sent to Anthropic's API, which returns the log. Anthropic is based in the United States. Under its commercial terms, data sent through the API isn't used to train its models; how long Anthropic keeps it is set out in Anthropic's own privacy policy.
• GitHub holds a weekly copy of the database as a private backup, kept for 90 days.

Transfers outside the EU rely on the providers' safeguards under the GDPR (the EU–US Data Privacy Framework or standard contractual clauses).

How long it's kept

• Transcripts: deleted automatically 30 days after their session's log is written. The log remains. Notes written from memory stay with the session.
• Deleted sessions and threads: kept for 30 days in Deleted entries so they can be restored, then removed. Deleted entries can be emptied sooner by hand.
• Everything else: for as long as the campaign exists.
• Backups: anything deleted can remain in the weekly backups for up to 90 days more.

Removing data

There are no accounts, so everything belongs to a campaign, and anyone with the campaign's link can change or delete it:

• Correct or remove any text (a name, a line in a log) by editing it.
• Delete a single session, with its transcript, from the session's page.
• Delete the whole campaign, with everything in it, under Campaign settings on the campaign page. This is immediate and can't be undone.

If you appear in a campaign you can't edit yourself, ask the group's game master.

Your rights

Under the GDPR you can ask to see the personal data held about you, have it corrected or erased, object to its use, or receive a copy (a campaign's backup file, from its menu, contains everything in it). You can also complain to a data protection authority; in Finland that's the Data Protection Ombudsman (tietosuoja.fi).

About Kaiku