Privacy Policy

How we handle your data

1. Introduction

Nervejack ("we", "our", "the service") is an AI-powered text RPG operated by Colin Urban. This policy explains what data we collect, why we collect it, and how we protect it.

By using Nervejack, you agree to the collection and use of information as described in this policy.

2. Data We Collect

Account Information

When you sign in via Google OAuth, we receive and store:

• Name — Your display name from your Google account
• Email address — Used as your unique account identifier
• Profile image URL — Your Google profile picture link

We do not receive or store your Google password. Authentication is handled entirely through Google's OAuth 2.0 protocol.

Session Data

When you sign in, we create a session that stores:

• Session token — A random identifier for your active session
• IP address — Recorded at sign-in time
• User agent — Your browser identification string
• Expiration time — Sessions expire automatically

Game Data

During gameplay, we store:

• Game state — Your character's HP, credits, inventory, quests, known NPCs, location, and key events
• Story history — Your recent actions and the AI's narrative responses (the last 50 messages)
• Turn count and usage — How many turns you have taken, tracked daily for free-tier limits
• Story summary — A condensed summary of your game session, generated periodically

All game data is tied to your account and is not shared with other users.

Billing Data

If you subscribe to a paid plan (Plus or Pro), payment processing is handled entirely by Stripe. We store:

• Stripe Customer ID — Links your account to your Stripe customer record
• Subscription status — Whether your subscription is active, canceled, etc.
• Billing period — Your current subscription period start and end dates

We do not store your credit card number, CVV, or full billing address. All payment details are handled securely by Stripe. See Stripe's Privacy Policy.

3. How We Use Your Data

• Authentication — To identify you and maintain your session
• Gameplay — To save and restore your game progress, and to provide context to the AI for narrative generation
• Usage limits — To enforce daily turn limits on the free tier
• Billing — To manage your subscription and process payments through Stripe

We do not use your data for advertising, sell it to third parties, or use it for purposes unrelated to the service.

4. Third-Party Services

Nervejack uses the following third-party services that may process your data:

• Google OAuth — For authentication. Google receives a sign-in request when you log in. See Google's Privacy Policy.
• Cloudflare — Our hosting provider. All data is stored on Cloudflare's infrastructure (D1 database, Workers). Cloudflare may collect standard web traffic metadata. See Cloudflare's Privacy Policy.
• OpenRouter / Google Gemini — AI model providers. Your game actions and story context are sent to AI models to generate narrative responses. These requests do not include your email, name, or other personal identifying information — only game content.
• Stripe — Payment processing for Plus and Pro subscriptions. See Stripe's Privacy Policy.
• Google Analytics — We use Google Analytics (GA4) to understand how visitors use the site — which pages are visited, how long sessions last, and where traffic comes from. Google Analytics uses cookies to collect this data in aggregate. It does not identify you personally. See Google's Privacy Policy and opt out of Google Analytics.

5. Cookies

Nervejack uses the following cookies:

Essential Cookies

• Session cookie — Contains a random session token to keep you signed in. Required for the service to function. Expires when your session ends.

Analytics Cookies

• Google Analytics (_ga, _ga_*) — Used to distinguish visitors and track page views in aggregate. These cookies do not contain personal information. They expire after 2 years (_ga) or 24 hours (_ga_*). You can opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.

We do not use advertising cookies or third-party tracking cookies.

6. Data Retention

• Account data — Retained as long as your account exists
• Game saves — Retained as long as your account exists. You can delete your save at any time by starting a new game
• Session data — Automatically deleted when sessions expire
• Usage data — Daily turn counts are retained indefinitely for rate-limiting purposes

7. Data Deletion

You can request deletion of your account and all associated data by contacting us at the email below. Upon request, we will delete:

• Your user account and profile information
• All game saves and story history
• Session records
• Usage records

Stripe records are managed through Stripe's systems. You may also contact Stripe directly regarding payment data.

8. Data Security

Your data is protected by:

• HTTPS encryption for all data in transit
• Cloudflare's edge network security
• OAuth 2.0 for authentication (no passwords stored)
• Session tokens for authorization (no credentials in cookies)

9. Children's Privacy

Nervejack is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal data, please contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with an updated date. Continued use of the service after changes constitutes acceptance of the updated policy.

11. Contact

For privacy questions, data deletion requests, or concerns:

• Email: info@threadlimit.co

Last updated: March 21, 2026