What we keep, and for how long.

What we never collect

No passwords, and no sign-up to play or to buy. Putting a group's Almanac online needs an adult to sign in with an email address (see below). No advertising, no tracking pixels and no cookies of ours. The game itself loads nothing from anyone else. The checkout page, and only that page, loads Stripe's payment form (payments). Our public pages load one script from Cloudflare, the company that hosts Lorewheel, to measure visits (page analytics). We keep our own anonymous daily totals too (below). We don't ask anyone's age or real name, only that the adult who opens an online Almanac confirms they're 18 or over; the names in a game are whatever the table types. We don't read or keep IP addresses.

Playing on one device

The games and your Almanac live in your browser's storage on that device. Nothing a player writes leaves it unless you turn on one of the features below.

Phone rooms

Answers pass through a room on our server to the host's screen. The room keeps only the players' names and each phone's current screen, never the answers (or a TV sign-in a phone passes through it), and is deleted when the host closes it or after 3 idle hours.

An online Almanac

If your group puts its Almanac online, we keep the sealed lines, the names in them, their dates, the house questions your group writes for its own games, when each line came back in a game, and, for a candle lit in Light a Candle, the name of the person remembered and the day you chose for them, and for a night card, who was there and what you played, under a key only your devices hold — we store a one-way fingerprint of it, not the key. It opens only on a device where an adult has signed in and confirmed (below); there, anyone with the group link can read and add to it. We don't record which adult opened which group. It's deleted when you press delete on the Almanac page, or 18 months after its last use unless the group has Pro.

Pro and the organiser plan

Pro adds the subscription's state to the group — status, plan, renewal date and Stripe's customer and subscription ids — and nothing about you. An organisation keeps its name and the names and links of its groups, and, if the organiser sets them, which games its groups can play (an age limit, the games it turned on, and a game sent to its groups for tonight); its page shows each group's counts and dates, not what the group wrote. An organisation nobody opens for 18 months is deleted unless it's subscribed.

Legacy Letters

Recordings are made in your browser and stay there; we never listen to, transcribe or share them. With Pro, each recording is also stored with your group's online Almanac so every device with the group link can play it, and it's deleted with that Almanac.

Night cards

At the end of a game you can keep a card for the night: the moment you want to remember, who was there, what you played, and a photo if you add one. The card lives in your Almanac like any sealed line, and syncs if your group's Almanac is online. The photo never leaves the device you added it on. It is made smaller and kept in that browser's own storage; only a random id for it is stored with the card, so other devices show the card without the photo. Saving a card as an image makes the picture on your device; nothing is sent to us.

Keepsake Cards

Postcards are drawn in your browser from the lines and night cards you pick. When you order, those pictures — including any photo on a night card — are sent to us and to Printful, the printer that makes and posts them in the US. We keep them, with your name, delivery address and phone number from checkout, only until the order is done: everything is deleted 90 days after the cards are posted, or two days after a checkout you didn't finish. Printful receives the pictures and your delivery details to print and post the cards; Stripe handles the payment and calculates sales tax from your address.

Lore Duels

A duel keeps the two group names, the 16 cards and each side's calls — no player names unless you type them into a card — and deletes them 30 days after the last move.

Signing in, and the adult check for the online Almanac

You sign in for two reasons: to see your purchases, and so an adult can open a group's online Almanac on a device. What a group writes can include children's names and words, so the online Almanac opens only on a device where an adult has signed in and confirmed two things:

• that they're 18 or over;
• that any children in the group are theirs, or that they have a parent's or guardian's permission.

To sign in, you enter an email address and we email you a link that works once, for 20 minutes. Once you use it, we keep:

• your email address;
• when the account was made and when you last signed in;
• whether and when you confirmed, and which wording you confirmed;
• one-way fingerprints of your sign-in links and signed-in devices, never the links themselves.

We don't verify ages or identities, and we don't record which groups you open. Your purchases aren't copied into the account: they're read from Stripe each time, by the email you used at checkout. If you never click the link, the address is forgotten when the link expires. A device stays signed in for 90 days. A TV, which can't open an emailed link, is signed in from a phone that already is: the phone asks us for a TV sign-in and passes it to the TV through the TV's phone room, and the TV asks on its own screen before using it. A TV sign-in opens a group's Almanac, Pro and packs; it can't see your purchases, refund, change your confirmation, delete your account or sign in another TV. An account can have up to three TVs signed in, each for 90 days, and a TV can sign itself out. An account nobody signs in to for 18 months is deleted, just as if you'd pressed Delete my account. Delete my account, on the purchases page, removes all of it; your purchases and Stripe's records of them stay. Once your account is deleted, your devices can't open an online Almanac until an adult signs in again.

Gift Pro

When you buy Pro as a gift, Stripe (through Link, the seller of record) handles the payment and your details, as with Pro. We keep no record of the purchase: the gift link carries the Checkout session's id, and when someone adds the gift to a group we ask Stripe whether it was paid and not refunded. When the payment goes through, we email the gift link once, to the address you gave at checkout. We don't keep that address; we keep only a note that the email for that purchase was sent, so it isn't sent twice, and that note is deleted two years later. To make sure a link works only once, we keep a small record for each gift that has been added: which group's online Almanac it went to (by the same one-way code that names the Almanac) and the date. That record is deleted two years later. The buyer's name and email are never shown to the group that receives it.

Event Packs

When you buy an Event Pack (a "pack"), Stripe (through Link, the seller of record) handles the payment and your details, as with Pro. We keep no purchase record of our own: the group's Almanac keeps which pack it has, the Checkout session's id (for a pack chosen with a yearly Pro subscription, that subscription's id instead) and the date it was added, and a small record makes sure one purchase is added to one group (which group's Almanac took it, as a one-way hash of its link, and when; it deletes itself after two years). A pack's games are sent to the group's devices and kept there, so they play offline. If the couple, the bride, the birthday person or the parents-to-be set up their own answers for a pack (their names, and answers such as where they met), those are kept on that device only and are not sent to us. An answer revealed in a game can be sealed into the group's Almanac at the end, like any other line, and is then kept wherever that Almanac is. A pack bought as a gift works the same way: the gift link carries the Checkout session's id, and when someone adds it we ask Stripe whether it was paid and not refunded. The Almanac that receives it also keeps that the pack was a gift. When the payment for a gift goes through, we email the gift link once, to the address you gave at checkout. We don't keep that address; we keep only a note that the email for that purchase was sent, so it isn't sent twice, and that note is deleted two years later. The buyer's name and email are never shown to the group that receives it.

Tester codes

We sometimes give testers a code, or a link carrying one, for free Pro, for packs, or for both. Using it involves no payment and no Stripe. To make sure each code is used once per group and by no more groups than it allows, we keep a small record for each use: which group's online Almanac took it (as a one-way hash of its link, never the link itself) and when. The group's Almanac keeps the code, the date its Pro ends and any packs the code added, as it does for a gift. Nothing else about you is kept, and a code record deletes itself after two years.

Partner links and the partner programme

If you arrive by a partner's link. Some people who recommend Lorewheel earn a share when someone they sent buys (the partner programme). Their link ends in ?via= and their code. When you arrive by one, your browser sends us that code so we can count the arrival for that partner; nothing about you is sent with it. In most of the world the code is then kept in your browser's storage for 30 days (see browser storage), so that a purchase on a later visit still credits them, and a newer partner link replaces it. In the EU, the EEA, the UK and Switzerland it is never stored: it lasts only until you close or reload the page. If you start a checkout while your browser holds a code, the code goes onto that Stripe checkout, and if it's paid, the partner's list gains one line: the kind of product, their share and the date. The partner never learns who bought, and we keep nothing about you with it. Clearing this site's data in your browser drops a stored code.

If you join as a partner. We keep the name, email address and where-you-post that you give us, your code, how you've asked to be paid, daily counts of arrivals by your link (for 90 days), your list of sales and payouts, and a one-way fingerprint of your dashboard link. If you ask for a new dashboard link, we check the code and email you enter against yours, email the new link to the address you joined with, and count the tries for that day. If we offer you a paid post and you accept it, we keep the fee, the date you accepted, the link to your video and what we've paid you for it (paid post terms). We use all of this to run the programme, to pay you and to write to you about it. "Leave the programme" on your dashboard deletes all of it at once. A payout itself is also recorded by whoever carries it, such as PayPal, and in our accounts, as tax law requires.

Book orders

An order keeps that year's pages, the finished files and, for a hardcover, the delivery name, address and phone number, which also go to Lulu to print and post it. All of it is deleted 90 days after the book is ready or shipped, and an unpaid checkout after 2 days.

Who else handles data

Link (Stripe's reseller service) sells Pro, the organiser plan and the PDF edition, and keeps the name, email, billing address and payment details you give at checkout under its own privacy policy. Stripe processes the payment for a hardcover or Keepsake Cards, and calculates their sales tax, under its own policy. We never see card details; we keep only a subscription's state or an order's pages, as described above. Resend sends the sign-in emails, for purchases and for the adult check, and the gift emails, and a partner's welcome email, new dashboard link or paid post offer, so it sees the address and what the email says. If you're a partner, whoever carries your payout (PayPal, unless you ask for another way) receives the payout address you gave us and the amount. Lulu receives a hardcover's pages and delivery details to print and post it. Printful receives the pictures of Keepsake Cards and the delivery details, to print and post them. Cloudflare hosts Lorewheel and carries every request to it. That's the full list.

Children

Lorewheel is played by families, classes and camps, with an adult present. Children don't sign up, sign in or buy anything, and nothing a group writes is ever public. There's no advertising, no profiling, no location tracking and no chat with strangers.

We don't knowingly collect personal information from a child under 13, or under 16 in the EU and the UK, without a parent's or guardian's permission. What a group writes stays on its own device unless an adult signs in and confirms. That is how we meet the US Children's Online Privacy Protection Act (COPPA), the GDPR's rules for children, and the UK's Age Appropriate Design Code. For children, first names or nicknames are plenty.

If you think a child's information reached us without that permission, email hello@lorewheel.com with the group link and we'll delete it.

Deleting your data

Everything online can be deleted from inside Lorewheel: the Almanac page deletes a group's Almanac and its recordings, the organiser page deletes an organisation, and the purchases page deletes a sign-in account. Because we keep only a fingerprint of each link, we can't find a group for you if the link is lost — it will be deleted on its own after 18 months unused. Write to Media Yard LLC, PO Box 73, Pennsauken, NJ 08110, United States with any question.

Counting how Lorewheel is used

To know whether Lorewheel is used, and to show that to anyone who might invest in or buy it, we keep daily totals. These count how many times the site was opened and how many of those were new browsers, how many browsers opened it each month, where the visit came from, which of the four “What are you planning?” choices on the home page was tapped, games started and finished (by game), a game started in a browser that has played here on an earlier day (a returning night), how many times a share, copy or invite button was used (which button, never what was shared or with whom), the one-tap answer to “did it land?” after a game (loved it, it was fine, or not for us — counted per game, with no words attached) and the second tap that follows it (“anything get in the way?”: nothing, too long, too short, confusing rules, the questions fell flat, or something broke), a game left before the end (or, on a game's own page, the page closed part-way through) and the one-tap answer to “what happened?” if you give one (just looking, too long, confusing rules, not our kind of game, not enough people, or something broke — again per game, with no words attached), phone rooms opened, Almanacs put online and used, sign-ins, and purchases with their amounts.

Your Number (the zero-to-ten page) shows you where everyone else landed, so each number you pick there is added to a running total for that statement: eleven counters, one for each number from 0 to 10. The counters are all that is kept. Nothing is stored with a pick that says who made it, and the totals are not cleared. A challenge link holds your seven numbers in the part of the address after the #, which your browser does not send to us.

The Last Slice (the mystery at /last-slice) keeps, for each part, how many players suspect each person. That is all: when you choose, your browser sends the part and the name, and nothing about you.

Lorewheel Daily (the games for one player at /daily) adds to the day's totals in the same way: how many players agreed with the day's statement, how many put each thing in each place, how many called each statement correctly, how many chose each answer in the other games, how near full each rocket's tank was stopped, how many answered each question about the trains correctly, and how many crowned each small joy. Those totals are shown back to everyone who plays, which is the game. Nothing is typed, and nothing about who played is kept.

Where the visit came from is counted as one name from a short list: YouTube, Instagram, TikTok, X, Facebook, LinkedIn, Reddit, Pinterest, Threads, email, ManyChat, a partner, a search engine, direct, or other. Your browser picks the name itself, from the tag in the link you followed (utm_source) or, if there is none, from the site you came from, and sends only that name. The address of the page you came from is never sent. If the link carries a label of ours for the video or post it was under (utm_campaign, a short tag such as quiet-friend), that tag is counted too, and the first game started after such a visit adds one to its source, as does the first one finished. If a visit ends in a purchase, your browser adds one to that source's count of sales, and to the tag's, when it comes back from checkout. That is a daily total like the others: it is not attached to the order, and we can't tell which sale it was.

A total is only a number for a day. No IP address, cookie, device ID, account, email or group is stored with it, so no count can be traced to you. To tell a new browser from a returning one without an ID, your browser keeps two small notes of its own (see browser storage): the month it first opened Lorewheel, and the last month it was counted. Once a month it sends only "active this month, first seen in that month", which is the same for everyone who arrived that month. We keep the totals for up to about two years. The legal basis is our legitimate interest in knowing whether the service is used; because nothing identifies you, there is nothing personal to access or delete.

Don't want to be counted? Switch it off for this browser. It's remembered in this browser only, nothing is sent to say so, and it works whether or not you play.

Read the Room (voting along with a stream)

At /live a streamer can open a room and their viewers can vote from their phones. A viewer needs no account and gives no name. Your browser makes up a random ID for that tab, so that changing your mind replaces your vote instead of adding one, and sends only that ID and Agree or Disagree. The room keeps the votes for the statement that is open, shows the streamer and the viewers only the totals, and clears them when the next statement starts. Everything in the room is forgotten when the room ends, or after three hours without use. We don't keep your IP address with a vote, and we can't tell who voted what.

Towards the daily totals we count rooms started, rounds played and votes cast, and how many viewers voted at least once.

Page analytics on our public pages

To see which pages people arrive on and where they came from, some pages load one script from Cloudflare Web Analytics. Cloudflare is the company that hosts Lorewheel, so it already carries every page to you.

Which pages. Only the ones anyone can open without a link of their own: Blind Rank's, Straight Face's, the Head-to-Head Quiz's, Your Number's and The Last Slice's own pages, Lorewheel Daily, the public page for each game and each pack, the partner kit and paid post terms, and About, Support, Terms, Privacy, Accessibility and the data processing terms. Never the game itself (the home page and everything you play there), a group's or an organiser's link, the page a phone joins a room on, the partner sign-up and dashboard, the checkout page, or the owner's pages. On those the script is blocked by the site's own security policy, because their addresses can carry a private key.

What it sends to Cloudflare. The address of the page (including anything after a ?, such as a partner's code), the page you came from, how long the page took to load, and your browser's own description of itself, from which Cloudflare reads the browser, the operating system and whether it's a phone. Cloudflare works out a country from the connection. It sets no cookie, keeps nothing in your browser, and does not give you an id that could link one visit to another or to another site. We see totals only: pages, referrers, countries, browsers and load times.

Why, and how to stop it. The legal basis is our legitimate interest in knowing how people find Lorewheel. The switch above doesn't control this script, because it isn't ours to switch; any content blocker stops it, and so does turning JavaScript off on those pages. Nothing on the site needs it.

The checkout page

When you buy Pro, a pack, a gift, the organiser plan, a Yearbook or Keepsake Cards, you pay on Lorewheel's own checkout page (lorewheel.com/checkout), in a form that Stripe provides. It is the only page on Lorewheel that loads anything from Stripe: Stripe's script and its payment form, which runs in a frame of Stripe's own. What you type there — card, name, email, billing or delivery address — goes straight to Stripe (or Link, the seller of record for digital products, as described above) and never to us; we learn what we always have, from Stripe afterwards.

Cookies on that page. Stripe's script may set two cookies of its own, commonly named __stripe_mid and __stripe_sid, which Stripe uses to prevent fraud on the payment, under Stripe's privacy policy and cookie notice. They are strictly necessary for a payment you asked to make. Lorewheel doesn't read them, and the rest of the site never loads Stripe, so they aren't used while you play. Our site's own security policy enforces this: every other page is blocked from loading Stripe.

The address of the checkout page carries the form's reference after a #, which browsers never send to any server. The page keeps it in this tab's storage so a reload still works, and takes it off the address.

Who's responsible for your data

Media Yard LLC, PO Box 73, Pennsauken, NJ 08110, United States, decides how your data is used and is responsible for it (the "controller"). Contact: hello@lorewheel.com.

Groups run by an organisation on the organiser plan, such as a school, camp or club, work differently. The organisation decides how Lorewheel is used for its groups and is the controller of their data. We handle that data on its behalf, as its "processor", under the Data Processing Addendum.

Why we're allowed to use it

For people in the EU, the EEA and the UK, these are the legal bases under the GDPR and the UK GDPR:

• To provide what you asked for (contract): keeping a group's online Almanac, running phone rooms and duels, making and posting orders, sign-in, refunds, and, for partners, running the partner programme and paying them.
• Legitimate interests: keeping Lorewheel secure and working, preventing abuse, limiting how many sign-in emails can be sent, and asking an adult to confirm before an online Almanac opens, which protects children, and crediting a partner whose link brought a buyer.
• Legal obligation: tax and payment records kept by Link and Stripe, and answering lawful requests.

We don't use your data for advertising or profiling, and no decision about you is made automatically.

Your rights

Wherever you live, you can ask us to:

• show you the data we hold about you, or correct it;
• delete it, or give you a copy to take elsewhere (the Almanac page exports a group's Almanac);
• stop or limit using it.

Email hello@lorewheel.com and we'll answer within one month. We store an online Almanac by a fingerprint of its link, so we'll need the group link to find it.

In the EU or the EEA you can also complain to your country's data protection authority. In the UK you can complain to the Information Commissioner's Office (ico.org.uk). Residents of US states with privacy laws, such as California, have the same rights; we don't sell or share personal information, as those laws define it.

Data that leaves your country

Media Yard LLC is in the United States, and Lorewheel runs on Cloudflare's worldwide network. So if you're outside the US, your data is transferred to the US and handled there, and by the providers listed above. Transfers from the EU, the EEA and the UK are protected by the European Commission's Standard Contractual Clauses, with the UK Addendum, in the data processing terms of Cloudflare, Stripe and Resend. Cloudflare and Stripe are also certified under the EU–US Data Privacy Framework and its UK extension. Lulu and Printful print and post only to US addresses.

Cookies and browser storage

Lorewheel sets no cookies of its own; the one exception on the site is Stripe's, on the checkout page. To work, it keeps some things in your browser's own storage on your device, and none of it follows what you do or is shared with anyone:

• The games and your Almanac: your sealed lines, game progress, your Daily results and streak, where you've got to in The Last Slice and who you suspect, rewards and settings, such as whether the narrator is on, and tonight's prize for the winner if the organiser sets one. The prize stays on this device, even when your Almanac is online.
• Games saved for offline: the pictures, voices, videos and title fonts of the games you've played or downloaded, and a list of which games are saved. They're copies of files anyone can load from the site, kept so a game plays without signal. Clearing this site's data in your browser removes them.
• Your group link: if this device keeps an online Almanac, the link and when it last synced, and, for a group run by a camp, school or club, which games its organiser turned on.
• Your sign-in: the device's sign-in token, if an adult or buyer signed in on it.
• Your orders: the numbers of Yearbook and Keepsake Card orders placed from this device, so you can follow them.
• Anonymous usage notes: the month this browser first opened Lorewheel, the last month it was counted as active, and, for this tab only, a flag so a visit counts once, the name of where the visit came from and its tag, a flag once its first game has been counted and another once one has been finished, and, after a purchase, the checkout's reference so that reloading the page doesn't count the sale twice (see counting). None of them identifies you or is sent anywhere except as part of a daily total. If you switch counting off, one more note says not to count this browser.
• A partner's code: if you arrived by a partner's link from outside the EU, the EEA, the UK and Switzerland, that partner's code and the date, for 30 days. If you joined the partner programme on this device, your dashboard link.
• A checkout in progress: on the checkout page only, for this tab only, the reference of the payment form you opened, so reloading the page keeps it.
• Photos and recordings: night-card photos and Legacy Letter recordings, kept in the browser's database on that device.

Lorewheel also keeps its own files — its code, and the pictures, fonts and voices of games you've played — in your browser's cache, so it opens and plays without signal; that holds nothing about you. Everything except the usage notes and a partner's code is strictly necessary for features you choose to use. A partner's code isn't, so it is not stored at all in the EU, the EEA, the UK and Switzerland, where storing it would need your consent first. The usage notes are anonymous, first-party audience measurement, used only for the daily totals and never shared, with a switch to turn them off (see counting) — the kind of statistics that the EU ePrivacy rules, as regulators apply them, and the UK's PECR allow without a consent banner. So there is no cookie banner: Lorewheel sets no cookies to ask about, and Stripe's on the checkout page are strictly necessary for the payment you chose to make. You can clear it at any time in your browser's settings. That erases this device's copy, so export your Almanac first.

Keeping it safe

How we protect your data:

• Everything travels encrypted over HTTPS.
• Group links, sign-in links and sessions are stored only as one-way fingerprints, so a copy of our storage can't open your Almanac.
• Nothing is kept longer than this page says.

If data about you is ever exposed, we'll tell you and the authorities where the law requires, without undue delay.

Changes to this page

If we change how we handle data, this page changes in the same update, and the date at the top changes too. If a change needs your agreement, we'll ask for it before it applies.