Privacy Policy

This Privacy Policy explains how larp.church (the Service) handles information when you visit the website, verify through Discord, use a role-protected generator, upload content, render an output, save a creation in your browser, download a file, or contact support. It applies to the website and features controlled by larp.church, but not to separate websites, applications, or communities operated by third parties.

The operator of larp.church is responsible for the processing described here. Privacy questions and requests can be submitted by opening a privacy or support ticket in the official larp.church Discord server. Please do not include passwords, Discord tokens, payment credentials, or other unnecessary secrets in a support message.

When you choose to verify, Discord asks you to authorize the scopes displayed on its consent screen. The Service is designed to request basic profile access through identify and, when server joining is enabled, permission through guilds.join. Basic profile information can include your Discord user ID, username, display name, avatar, discriminator where still available, locale, and public account flags. Server-related checks may include membership status, configured guild information, required role identifiers, and verification timestamps.

Discord does not provide your password to larp.church. The Service does not need access to your private messages, friends list, linked accounts, or email address for its stated verification purpose unless a future feature clearly requests an additional scope and explains it before authorization. You can refuse the authorization, but protected features may remain unavailable.

Generator inputs may include names, usernames, display text, captions, profile pictures, images, videos, audio, template selections, colors, font choices, watermark settings, layer positions, animation settings, and other instructions needed to create your requested output. The exact inputs depend on the generator you choose.

Do not upload confidential records, passwords, authentication tokens, financial account details, government identifiers, private communications, or material you are not authorized to process. You are responsible for obtaining permission from people whose name, image, voice, or other personal information you submit.

To operate and protect the Service, we may process the selected generator and template, request time, success or failure status, processing duration, output format, cooldown status, verified account identifier, and limited diagnostic context. Error logs may contain timestamps, route or feature names, error messages, software versions, and technical details needed to reproduce a failure.

Our server, hosting provider, and security services may automatically process connection information such as IP address, browser type, device or operating-system information, referring page, requested URL, request headers, approximate region, and security signals. This information is used for delivery, rate limiting, abuse prevention, troubleshooting, and service reliability—not to build advertising profiles.

We use information only for reasonably necessary operational purposes, including to:

• complete Discord authorization, identify the correct account, maintain a signed-in session, and display the appropriate username and avatar;
• join the configured Discord server when you authorize that action, check server membership and roles, and grant or remove access to protected generators;
• process text, images, audio, and video into the mockup, fansign, proof, or video output you request;
• separate locally saved creations by Discord account and apply the advertised expiration period;
• enforce cooldowns, prevent spam and automated abuse, investigate security incidents, and protect users and infrastructure;
• diagnose errors, measure reliability, improve performance, and understand which features require maintenance;
• respond to support and privacy requests, enforce the Terms, and comply with lawful obligations.

We do not use generator inputs to make decisions about employment, credit, housing, insurance, education, or other similarly significant matters.

Where the GDPR, UK GDPR, or a similar law applies, processing may rely on several legal bases. We process information necessary to provide a feature you requested as performance of our agreement; use limited technical and security information based on legitimate interests in operating, protecting, and improving the Service; rely on consent where a feature or law specifically requires it; and process information when necessary to comply with legal obligations or protect vital interests.

When processing is based on consent, you may withdraw that consent without affecting processing that was lawful before withdrawal. When processing is based on legitimate interests, you may object based on your circumstances, and we will consider the request against any compelling legitimate reason to continue.

The Service uses essential storage rather than advertising cookies by default. A signed, HTTP-only Discord session cookie can keep your account verified for up to 180 days. A shorter-lived OAuth state cookie is used during authorization to help prevent login forgery and connect the callback to the browser that started the request. Security attributes are used where supported by the deployment environment.

If Google Analytics is configured, it stays off until you select Accept analytics. Selecting Decline analytics keeps it off. Your choice is saved in local browser storage. When accepted, Google Analytics may receive the page visited, referral information, general device and browser information, approximate location derived from the network connection, and the limited feature events described below. It may also use analytics identifiers according to Google's own privacy terms. Clear the site's browser data to remove the saved choice and be asked again.

My Creations uses the browser's IndexedDB storage to keep eligible generated files on your own device, separated by Discord account ID. Current saved creations are configured to expire automatically after three days. You may remove them sooner through My Creations or by clearing the website's browser data. Private browsing, device cleanup, browser limits, or uninstalling the browser may remove files unexpectedly.

Some features can render directly in the browser. Others may temporarily send the selected source asset, input settings, or uploaded media to the server to produce an image or video. Temporary working files are intended to be deleted after processing and delivery rather than kept as a permanent server-side creation library.

Operational cleanup can fail during an outage, so a temporary file may remain until the next cleanup cycle or manual maintenance. Do not rely on the Service as secure long-term storage. Download the output you want to keep and avoid submitting sensitive material. A downloaded file is controlled by you and remains on your device until you delete it.

Retention depends on the category and purpose of the information. OAuth state data is short-lived; the signed session can remain valid for up to 180 days; browser-saved creations are configured for three-day expiration; and temporary render files are intended for prompt cleanup after completion. Support messages remain in the relevant Discord support system according to that server's moderation and recordkeeping practices.

Verification, role-access, rate-limit, reliability, error, and security records may be kept only as long as reasonably needed to operate accounts, prevent repeated abuse, investigate incidents, resolve support issues, and maintain the Service. Records relevant to a legal claim, security incident, or lawful request may be retained longer. When information is no longer needed, we aim to delete it, aggregate it, or remove direct identifiers where practical.

We do not sell personal information, rent user profiles, or share information for cross-context behavioral advertising. Information may be processed by Discord for authentication and server joining; by infrastructure, hosting, storage, logging, and security providers needed to deliver the Service; and by browser-requested font or static-asset providers where those external resources are used.

Service providers should receive only the information reasonably necessary for their role and are subject to their own contractual and legal responsibilities. We may also disclose information when required by valid legal process, when reasonably necessary to protect a person from serious harm, to investigate abuse or a security incident, to enforce the Terms, or in connection with a merger, restructuring, or transfer of the Service subject to appropriate notice and safeguards.

Discord, hosting providers, infrastructure vendors, and users may be located in different countries. As a result, information may be processed outside the country where you live, including in countries whose privacy laws differ from yours.

Where required, transfers may rely on an adequacy decision, contractual safeguards, consent, or another lawful transfer mechanism. Mandatory privacy rights available in your location remain unaffected by the fact that technical processing occurs elsewhere.

Security measures include signed HTTP-only session cookies, OAuth state validation, role and membership checks, restricted configuration files, request cooldowns, limited logging, and reasonable access controls. We review technical failures and may change these controls as threats and infrastructure evolve.

No website, network, browser database, or storage system can be guaranteed completely secure. You should protect your Discord account with a strong unique password and multi-factor authentication, keep your device updated, avoid sharing verification links or tokens, and log out on shared computers. Contact support promptly if you believe your account or creations were accessed without permission.

Depending on where you live, you may have the right to request access to personal information, correction of inaccurate information, deletion, restriction, objection, portability, information about recipients, withdrawal of consent, and review of certain automated decisions. You may also have the right to complain to a local data-protection or consumer-protection authority.

To submit a request, open a privacy support ticket in the official larp.church Discord server and state the right you want to exercise. We may need to verify that the Discord account making the request belongs to you and may ask for limited additional information when necessary to prevent unauthorized disclosure. We will respond within the period required by applicable law, subject to permitted extensions and exceptions.

You can also take immediate actions yourself: log out to end the active browser session, remove items from My Creations, clear the site's browser storage, leave the Discord server, or revoke the application through Discord's Authorized Apps settings.

The Service is intended only for people aged 18 or older and is not directed to children. We do not knowingly seek to collect personal information from a child through the Service. A person who does not meet the age requirement must not verify or use the generators.

If you believe a child has submitted information, contact support with enough detail for us to identify the relevant account or material without sending additional sensitive information. We will review the report and take appropriate deletion or access action where required.

The Service may link to Discord, social networks, file providers, community pages, or other websites. Their privacy practices, cookies, tracking, security, and content are controlled by them, not by larp.church. Opening an external link or publishing an output to another platform may disclose information to that platform under its own policy.

Review the privacy settings and policies of any third-party account you use. Revoking larp.church in Discord does not automatically delete content you previously posted elsewhere, and deleting a local creation does not remove copies you already shared or downloaded.

We may update this Policy when features, vendors, retention practices, security measures, or laws change. The effective date at the top will be revised when an update is material. If consent or another form of notice is legally required, we will provide it before the relevant new processing begins.

For privacy questions, account-data requests, deletion requests, or security concerns, open a privacy support ticket through the official larp.church Discord server. Include your Discord username and a clear description of the request, but never send your password, bot token, OAuth client secret, access token, or unrelated identity documents.