WyrdliWyrdli

Privacy Policy

Last updated: 19 August 2026

1. Data controller

The data controller for Wyrdli is Carlo Nicora, an individual based in Italy, determining the purposes and means of processing your personal data in accordance with the EU General Data Protection Regulation (GDPR). For anything related to your personal data, you can reach us at hello@wyrd.li.

2. What we collect

We collect and process the following categories of data:

  • Account data — your name, email address, a hash of your password (we never store the password itself), and your Discord identity when you choose to connect it.
  • Campaign content — the campaigns, scenes, characters, notes and other material you create in Wyrdli.
  • Session voice recordings and transcripts — when you use the Discord recording feature, we record your session's audio and produce transcripts from it. Recordings and transcripts are stored on our own servers in the European Union.
  • Payment and subscription status — which plan you are on and whether your subscription is active. Your card details are processed directly by Stripe and never stored on our servers.
  • Technical data — server logs, IP addresses and cookies. For cookies, see our Cookie Policy.
  • Analytics data — how the site and the application are used, described below.

Analytics

We run our own analytics to understand how the site and the application are used. We do not use third-party analytics services.

  • For every page view we record the page path, the referring site, any campaign parameters in the link you followed (utm_*), and whether your device is a desktop, tablet or phone.
  • Until you accept analytics cookies, visits are counted with an anonymous identifier derived from your IP address and browser through a one-way hash with a secret that changes every day. The IP address and browser details themselves are never stored, and the identifier cannot be linked across days.
  • If you accept analytics cookies, we set a first-party cookie (analytics_visitor) for 13 months so that return visits are recognised. Rejecting or withdrawing consent removes the cookie.
  • When you are signed in, page views are linked to your account on the basis of our legitimate interest in understanding how the service is used (Article 6(1)(f)). You may object at any time by contacting us.
  • Raw analytics events are kept for 13 months and then reduced to daily totals that contain no personal data. Links between analytics data and your account are removed when your account is deleted.

3. Why we process your data (legal bases)

Under GDPR Article 6, we process your data on the following legal bases:

  • Contract performance — running the service you signed up for: your account, your campaigns, your subscription.
  • Legitimate interest — keeping the service secure and preventing abuse. This includes linking the pages you visit to your account while you are signed in, so that we can understand how the service is used (see section 2).
  • Consent — session recording. Recording only happens when you start it, and you must obtain your players' consent before recording them.
  • Legal obligation — keeping billing records where tax and accounting law requires it.

4. Where your data lives

Wyrdli runs on Hetzner data centers in the European Union (Germany and Finland). Your account data, campaign content, session recordings and transcripts are stored and processed there. Data leaves the EU only in the specific cases described in sections 5 and 8.

5. Who processes your data

We work with a small number of processors, each bound by a data processing agreement. We do not sell personal data, and we do not use advertising networks. Our analytics are our own and run on our servers; no third-party analytics service receives your data.

Hetzner (hosting)

  • Purpose: running the service — application servers, database, and media storage
  • Location: European Union (Germany / Finland)

Stripe (payments)

  • Purpose: processing subscription payments; Stripe holds your card details, we never see them
  • Location: EU and US — US transfers are protected by Standard Contractual Clauses and Stripe's certification under the EU-US Data Privacy Framework

Discord (integration)

  • Purpose: the Discord integration — session audio capture, dice rolls and notifications in your channel. Discord processes your voice and messages under its own privacy policy whenever you use Discord, whether or not Wyrdli is present.

AI providers (via OpenRouter)

  • Purpose: transcription of session recordings, session recaps, suggestions and other AI features
  • Location: requests are routed through OpenRouter to the model provider serving the request, on US or EU infrastructure
  • Retention: model providers may temporarily retain request data for abuse monitoring under their own policies; OpenRouter itself does not retain prompts or completions. Your content is not used to train their models where our agreements and the providers' policies so provide.

6. AI processing

AI features only run when you use them. When they do, the relevant content — a session recording being transcribed, campaign content used for a recap or a suggestion — is sent to the AI providers described in section 5 to produce the result, and the result is stored with your campaign on our EU servers. The permanent record lives with us; the providers' temporary retention is limited to what section 5 describes.

7. Retention

We keep your account data for the life of your account. Your campaign content, recordings and transcripts are kept until you delete them or delete your account. Billing records are kept for as long as tax law requires us to keep them.

Analytics events are kept for 13 months and then reduced to daily totals that contain no personal data (see section 2).

8. International transfers

Your data is primarily stored and processed within the European Union. Where a processor operates outside the EU — Stripe's US infrastructure, or an AI request routed to US infrastructure — the transfer is protected by an adequacy decision (including the EU-US Data Privacy Framework where the provider is certified) or by Standard Contractual Clauses approved by the European Commission.

9. Your rights

Under the GDPR you have the right to access your personal data, to have it rectified or erased, to restrict or object to its processing, and to receive it in a portable format. Where processing is based on consent, you can withdraw that consent at any time. To exercise any of these rights, email us at hello@wyrd.li — we respond within 30 days.

You also have the right to lodge a complaint with a supervisory authority — in Italy, the Garante per la Protezione dei Dati Personali, or the data-protection authority of your own EU country of residence.

10. Changes to this policy

When we update this policy, we post the new version on this page and update the date shown at the top.