replot

Privacy Policy

Last updated: 21 September 2026

This Privacy Policy explains what personal data REPLOT — our AI-powered interactive-fiction app — collects, why, who we share it with, and the rights you have. It covers the REPLOT mobile app and its online services (together, the “Service”).

Data controller: Coolplay GmbH, Lindengasse 43/19, 1070 Vienna, Austria. Contact for privacy questions and data requests: office@coolplay.io.

1. What we collect

We collect only what we need to run the app, generate your stories, keep the Service safe, and support it financially:

Account: your email address (used for passwordless sign-in via a one-time code) and an account identifier.
Device & technical: a device identifier (to prevent abuse of free credits), device model, operating system and platform (iOS/Android), app version, language, and your IP address (used for security and rate-limiting).
Your stories & gameplay: the prompts you write, the stories, images, and narration you generate, the choices you make, your progress and saved adventures, and your credit balance.
Purchases: a record of your in-app purchases (credit packs). Payment-card details are handled by Apple or Google, not by us.
Support: messages you send us through in-app support.

2. How and why we use it (and our legal bases)

To provide the Service — create your account, generate stories and images, run and save your adventures, and sync your credits. Legal basis: performance of our contract with you.
To keep the Service safe and fair — prevent abuse of free credits, rate-limit requests, screen the text you type for prohibited content (see Section 5), moderate stories shared publicly, and enforce our Terms of Use. Legal basis: legitimate interests and legal obligations.
To prevent abuse with a device identifier — we store a device identifier and use it to detect and prevent mass-creating accounts, farming of free credits, and evading enforcement (for example, re-registering after an account has been removed). It is a technical identifier used only to operate and secure the Service, not to build an advertising profile of you. Legal basis: our legitimate interest in preventing fraud and abuse and keeping the Service safe.
To process purchases — verify and credit your in-app purchases. Legal basis: performance of our contract.
To show advertising — including optional rewarded ads that grant credits, and personalized ads where you allow it. Legal basis: consent. See Section 6.
To understand and improve the app — diagnose problems and improve quality. Legal basis: legitimate interests.

3. AI-generated stories, images, and narration

REPLOT creates your adventures with artificial intelligence. To do this, the prompts you write and the choices you make are sent to our AI providers, who process them to generate text, images, and spoken narration:

Google (Gemini) — generates the story text and the scene and cover images. (terms · privacy)
Black Forest Labs (FLUX) — an alternative image provider we may use for the scene and cover images. (privacy)
Inworld — generates the spoken narration (text-to-speech) from the story text. (privacy)

Stories, images, and narration are AI-generated fiction; they may be inaccurate, unexpected, or not reflect real people, places, or events. Please do not enter sensitive personal information (about yourself or others) into prompts. We store your prompts and generated content to provide the Service, show your library, and let you continue your adventures.

4. Who we share data with

We do not sell your personal data. We share it only with service providers who process it on our behalf, under contract, to make the Service work. Key partners include:

Google / Firebase — cloud database and file storage that hold your account, stories, and images. (policy)
Google (Gemini), Black Forest Labs (FLUX), and Inworld — AI text, image, and voice generation, as described in Section 3.
OpenRouter and TypeSafe (Jev) — automated content-safety screening of the text you type, as described in Section 5; xAI (Grok) is an alternative screening provider we may use. (OpenRouter · TypeSafe · xAI)
AppLovin MAX — ad mediation, together with Google AdMob and the advertising networks listed in Section 6. (AppLovin · Google)
Singular — measuring app installs and marketing performance (attribution). (policy)
Twilio SendGrid — sending your sign-in and verification emails. (policy)
Apple App Store / Google Play — processing payments and verifying purchase receipts.

We may also disclose data where required by law, to enforce our Terms, or to protect the rights, safety, and property of our users, the public, or Coolplay.

5. Stories you publish, and moderation

REPLOT lets you keep your stories private or publish them to the public library, where other players can see and play them. Anything you choose to publish — titles, descriptions, story text, and cover images — becomes visible to other users. Please don’t include personal information in stories you publish. You are responsible for what you generate, publish, and share, and you must not create or share content that depicts a real, identifiable person (their name, image, or likeness) or that uses someone else’s copyrighted work, brand, or trademark without the necessary rights — see our Terms of Use.

Automated screening of what you type. Before REPLOT generates anything from a story idea, a free-typed action, or a character name you enter, that text is checked automatically against our content rules (for example: no sexual content involving minors, no sexual violence, no instructions for violence). The check is made by a content-safety model, Jev by TypeSafe, which we access through OpenRouter. It receives only the text you typed, a short excerpt of the story it belongs to (such as the characters’ names and ages), and our content rules — not your name, email address, or account identifier — and it returns only a decision (a probability that the rules are broken, and a category), not text. Both companies process this data on our behalf under contract. We use OpenRouter’s zero-data-retention routing, so the text is processed to produce the decision and then discarded; it is not stored by them or used to train AI models. As an alternative, we may run the same check with xAI (Grok), which handles the text under its own privacy policy (linked in Section 4). The ready-made choices the app offers are written by us and are not screened.

If the check finds a violation, the request is refused and nothing is generated, and a record of the refused text, the category, and the time is kept on your account (a “strike”). Strikes have consequences under our Terms of Use: a strike costs credits (currently 3), and an account with five strikes within 90 days is suspended. These decisions are automated. If you believe a request was refused by mistake, contact office@coolplay.io: a person will review it, and a strike recorded in error is removed and the credits it cost are returned.

To keep the community safe, public stories may also be reviewed and are subject to our Terms of Use. We may remove content and restrict or ban accounts that break the rules. If you find objectionable content, contact office@coolplay.io and we will review it, typically within 24 hours.

6. Advertising and tracking

REPLOT is supported by ads, including optional rewarded ads you can watch to earn credits. We use AppLovin MAX to mediate ads from several advertising networks; depending on availability and your consent, ads and ad measurement may be provided by any of the following partners, each of which processes data under its own privacy policy:

Depending on your choices, ads may be personalized (based on an advertising identifier) or non-personalized.

On iOS, we ask for your permission through Apple’s App Tracking Transparency prompt before using your advertising identifier (IDFA) for personalized ads or cross-app measurement. If you decline, we don’t use it for that.
On Android, personalized ads use your Google Advertising ID (GAID), which you can reset or limit in your device settings.
You can change your consent choices at any time in the app’s Settings or in your device settings.

7. International transfers

Some of our providers are based outside the EU/EEA (for example, in the United States). When data is transferred internationally, we rely on appropriate safeguards such as the European Commission’s Standard Contractual Clauses or an adequacy decision, so that your data remains protected.

8. How long we keep data

We keep your account, stories, and credit records for as long as your account is active. Some records (for example, purchase and event logs needed for fraud prevention and accounting) may be retained longer or in anonymised form. When you delete your account, we delete or anonymise your personal data as described in Section 10, keeping only what we must for legal, security, or accounting reasons.

9. Your rights

If the GDPR applies to you, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, to data portability, and to withdraw consent at any time (without affecting processing already carried out). To exercise these rights, contact office@coolplay.io.

You also have the right to lodge a complaint with a supervisory authority. Our lead authority is the Austrian Data Protection Authority (Datenschutzbehörde), Barichgasse 40–42, 1030 Vienna, Austria — www.dsb.gv.at. You may also complain to the authority in your own country.

10. Deleting your account

You can delete your account at any time:

In the app: go to Settings and tap Delete Account. This is performed immediately and cannot be undone.
By web form: if you no longer have the app, use our account-deletion form.

On deletion we permanently remove your email and account, and delete or anonymise your stories, saved adventures, and related data. Some records may be retained in anonymised form or where we are legally required to keep them. One exception: if your account had strikes (Section 5), we keep those strike records together with your email address, so that a suspension cannot be evaded by deleting the account and signing up again with the same address.

11. Children

REPLOT is not intended for children under 13, and we do not knowingly collect data from them. Where required, users under the age of digital consent (16 in some EU/EEA countries) need a parent’s or guardian’s consent. If you believe a child has provided us data, contact office@coolplay.io and we will delete it.

12. Security

We use technical and organisational measures — including encryption in transit, one-time sign-in codes, and access controls — to protect your data. No method of transmission or storage is completely secure, but we work to protect your information and to respond promptly to any incident.

13. Changes to this policy

We may update this Privacy Policy from time to time. We will post the updated version here with a new “Last updated” date and, for material changes, provide additional notice in the app.

14. Contact

Coolplay GmbH
Lindengasse 43/19, 1070 Vienna, Austria
Email: office@coolplay.io