This policy is kept up to date. IMMRAMA is in active development, and this policy is revised as the game changes. We will update the "last updated" date below and, where a change is material, tell you through the game's usual channels. Questions are welcome at the address at the bottom.
Last updated: 2026-10-10 Controller: Tech Duinnin LLC ("we", "us") Contact: developer@techduinnin.com
This policy covers the IMMRAMA apps for Android and for iPhone and iPad (iOS/iPadOS), the web client at game.techduinnin.com, and the desktop build, whether you got it from Steam or from itch.io.
We collect the account you create, what you type and say to the game, and the technical records a server needs to run. The game is powered by AI models we do not own, so the things you type and say are sent to third-party AI providers to generate the story. We do not sell your data and we do not use it for advertising.
diagnostics/feedback/.byok command), we store that server's address and any access token you entered on your account so your AI calls go there instead of to us. The token is stored server-side and shown back to you only as its last four characters. You can remove both at any time from the same screen or with byok clear. See "Security" below for how the token is stored.The desktop build can send us a diagnostic report, but only if you turn this on. It is off by default. The first time you reach the dashboard the game asks once; you can change your answer at any time under Settings > Privacy on the title screen.
When it is on, a report is sent automatically at the next launch after the game crashes, and you can send one yourself with the "Send a diagnostic report now" button. A report contains: the game's build number, your operating system and version, CPU count, system memory, GPU model and memory, whether you are on Steam Deck, your language setting, which AI mode and on-device runtimes were active, the game's own built-in health checks, and short excerpts from the end of the game's log files.
Before sending, the game removes your home folder and user name from file paths, API keys and tokens, e-mail addresses, non-local IP addresses, and any log line that could contain text you typed to the story or text the story generated. A report never contains your Steam or itch.io ID, your account name, or your saved game. The report is sent over an encrypted connection to our own server. If the game is signed in through Steam or itch.io, the report is stored under a one-way hash of that sign-in, so we can tell "the same machine again" apart from "a new machine" without being able to identify you.
Crash reports no longer need Steam. A copy of the game without a Steam sign-in (the itch.io download, a game set up to use your own AI server, or Steam running offline) can send a report too, still only when you turned reports on. Such a report is stored under a one-way hash of your network address instead, and that same hash is used only to limit how many reports one address can send per hour. Your network address itself is not part of the report. Every report is saved on your computer first, in the game's data folder under diagnostics/last_report.json, and the "View last report" button on the title screen shows you exactly what was sent.
We use these reports only to find and fix bugs and compatibility problems. They are kept with our server logs and age out on the same operational rotation.
Separately from diagnostic reports, the desktop build can tell us which steps of the demo players reach, but only if you turn this on. It is off by default, and saying yes to diagnostic reports does not turn it on. You can switch it on or off at any time under Settings > Privacy on the title screen (it takes effect straight away), and the first-visit question on the dashboard offers it as a box you can tick.
When it is on, the game sends a short list of milestones. The complete list is: starting a session, finishing character creation, reaching each tutorial step, finishing the tutorial, accepting your first quest, completing a quest, leaving the tutorial, finishing the demo, seeing the wishlist link, clicking the wishlist link, and ending a session. Each milestone carries only its name, the time, and at most one small number (for example the tutorial step, how many quests you have completed, or how many minutes the session lasted) and one short label from a fixed list (your character's class, the id of a quest that ships with the game, or which wishlist link it was). Nothing you type or say is ever sent, and neither is your character's name. The game's build number and where you got it (Steam or itch.io, full game or demo) are included.
To tell one install's milestones apart from another's, the game makes up a random number the first time it sends any, and keeps it in the game's data folder under diagnostics/usage_install_id. It is not based on anything about you or your computer, and our server stores only a one-way hash of it. Turning milestones off deletes that random number and drops anything not yet sent; if you turn them on again later, the game makes up a new one, which cannot be linked to the old one. Milestones are never sent with your Steam or itch.io sign-in, even when the game has one, and our server does not record them against any account or network address; it uses your network address only, briefly, to limit how many it accepts per hour. Milestones are sent in small batches, usually about once a minute, and anything that fails to send is simply dropped.
We use milestones only to see where players stop or get stuck so we can improve the game. They are kept with our server logs and age out on the same operational rotation, and may also be kept in our private object storage under a daily folder.
If you play the itch.io version and choose Sign in with itch.io, the game receives a sign-in token from itch.io. It sends that token to itch.io to confirm who you are, and to our own server with each AI request so the story AI can run for you, under the same daily limits as other players. Our server asks itch.io for your numeric itch.io user id and keeps that id (as a pseudonym, "itch:" followed by the number) together with how much AI you used each day, so it can enforce those limits and block abuse. To avoid asking itch.io on every request it also briefly remembers a one-way hash of the token, never the token itself. Your itch.io username is shown only inside the game, on your own screen; our server does not store it. You can sign out in the game at any time, and you can revoke the game's access from your itch.io account settings.
We do not sell personal data and we do not share it for advertising.
| Recipient | What they receive | Why |
|---|---|---|
| Anthropic (Claude) | Game text you type, and character/world context | Generates narration and dialogue (our main AI provider for text) |
| Google (Gemini) | Game text you type, and character/world context | Generates narration and dialogue when Anthropic is unavailable, and generates images and speech |
| Google (Speech Recognition) | Your voice audio, when you use voice input on Android or in Chrome | Converts speech to text, on-device platform behaviour |
| Apple (Speech framework) | Your voice audio, when you use voice input on iPhone or iPad | Converts speech to text, on-device platform behaviour |
| OpenAI | Only if you configure a custom endpoint or key | Your own configured AI calls |
| Cloudflare (R2, CDN) | Uploaded assets, static media | Storage and delivery |
| itch.io | Your itch.io sign-in token, only if you choose Sign in with itch.io | Confirms your itch.io account |
| Railway, Neon | All server-side data | Application hosting and database |
If you attach your own AI key, calls are billed to your account with that provider and are subject to their privacy policy.
Account data and game state are kept while your account exists, and are deleted when you delete your account (see "Deleting your account" below). Server logs are kept for a limited operational period and then age out on their normal rotation. Uploaded assets are kept until you or we remove them. Backups may retain a copy for a limited period after deletion before rotating out.
We have deliberately not published fixed retention periods in days or months yet, because we would rather state a period we actually enforce than one we do not. Setting and enforcing specific periods is planned work. If you want your data gone sooner, you can delete your account at any time and it happens immediately.
If you can sign in: go to Delete my account, or use the "Delete my account" link at the bottom of your dashboard. Confirm with your password and it happens immediately. There is no waiting period and no undo.
If you cannot sign in: email developer@techduinnin.com from the address associated with your account, or include your IMMRAMA username so we can verify ownership. We aim to action such requests within 30 days.
Deleting your account removes your account record, your characters and their progress, any images or world assets you uploaded (including the copies in our object storage and CDN), and any AI server address or access token you attached.
Server logs containing your IP address are not deleted on request; they age out on the normal operational retention cycle, and backups may retain a copy for a limited period before rotating out. Content you contributed to a **shared world** that other players still use may remain in that world.
Full details: Deleting your account.
IMMRAMA is rated for players 17 and older and is not directed to anyone under 17. We do not knowingly collect personal information from children under 13. The game generates AI content and supports user-created worlds, and is intended for players aged 17 and older.
Traffic is encrypted in transit (HTTPS/WSS). Passwords are stored hashed. Access to production systems is limited to the operator.
About your own AI server's access token, stated plainly. If you enter an access token for your own AI server on the hosted service, that token is currently stored as an ordinary account attribute. It is not encrypted by the application itself, and relies on the protections of the underlying database and hosting provider. We are telling you this rather than implying protection we have not built. Application-layer encryption of stored tokens is planned work. In the meantime:
byok clear.where the game runs on your own device, or use the local model tier, which needs none.
No security measure is perfect, and we cannot guarantee that any system is immune from unauthorized access.
We will update this policy as the game changes, and will revise the "Last updated" date above.
Tech Duinnin LLC — developer@techduinnin.com — 5900 Balcones Drive, STE 100, Austin, TX 78731