Privacy Policy

1. Who is responsible

The data controller is Artem Bobylev, an individual based in Kazakhstan. We are based in Kazakhstan and access your data from there. Contact us about privacy at support@lorvok.app; we acknowledge privacy complaints within 30 days.

2. Data we collect

• Account data: your email address and, if you set one, a hashed password (managed by our authentication provider), the date you joined, and a record of when you confirmed you are 18 or older and accepted the Terms (with the version you accepted). If you sign in with Google or Discord, that service shares with Supabase, our authentication provider, your email address, your account id there and the name and profile picture set there; Supabase stores them with your account. We don’t show that name or picture on Lorvok, and we never post anything to Google or Discord.
• Profile data: your public display name, bio and avatar, if you add them (an avatar is either a picture you upload or one generated from your description).
• Your content: story ideas and prompts, generated novels and images, your edits, your AI-editor requests (kept to diagnose the editor), comments, likes, users you block, your notifications, and reports you file (including any name and contact details you give).
• Reading activity: which novels you opened and finished, used for view and completion counts.
• Credits and purchases: your credit balance and history, and for each purchase the Dodo Payments payment id, the pack, its price, the amount paid and currency, its refund or chargeback status, your account email, and your confirmations at checkout (18+, acceptance of the Terms and Refund Policy, and your request to start the Service immediately). We never receive your card details.
• Technical data: your IP address, used briefly for rate limiting and to check your region, and not stored by us (our hosting providers keep standard server logs); crash reports, which are not linked to your account; and feedback you send, with your browser details and any screenshots you attach.
• Usage analytics: if you accept analytics cookies — pages viewed, clicks and features used, and your approximate location (country and city, which PostHog works out from your IP address; the IP address itself is not stored), linked to your account id, with your username, interface language and sign-up date (see section 8). If you don’t, only an anonymous count: the same page and click events without any cookie or browser storage, never linked to you or your account — PostHog tells visits apart with a privacy-preserving value it calculates on its servers. In both cases the events also note the ad campaign or link that brought you, if any (campaign tags such as utm_source, and ad click ids). Our servers also count paid actions anonymously (which action, whether it completed, failed or was cancelled, how many credits it took and what it cost us), with no account id and no other identifier or reference that links them to you, your account or your novels.

3. Why we use it and on what legal basis

• to provide the Service — create your account, generate, store and show your novels, and send essential account emails (performance of our contract with you);
• to process purchases and keep an accurate credit ledger (performance of our contract);
• to keep the Service safe — check content, handle reports, prevent fraud and abuse, and fix errors (our legitimate interest in a safe, working service);
• to answer your messages (our contract with you, or our legitimate interest in answering people who write to us);
• to understand how the Service is used and improve it (your consent, for analytics with cookies; our legitimate interest, for the anonymous counts described in section 2);
• to comply with the law, for example tax rules or requests from authorities (legal obligation).

To create an account you must give an email address and a password, or sign in with Google or Discord; without one of these we cannot provide an account. Everything else is optional.

4. Automated checks

We check content automatically (a keyword filter and an AI classifier) before it is generated or published. A request that fails is refused and nothing is charged; contact us to have a person review it. We do not make decisions with legal or similarly significant effects on you — such as closing your account — solely by automated means, except that an account is suspended automatically when a payment for credits already used is reversed; contact us and a person will review it.

5. Service providers we share data with

We do not sell your personal data. We share it only with providers that process it for us:

• AI models — Anthropic and OpenAI (United States): your prompts, story text, comments and profile text, to generate and edit novels and to check content against our rules. Under their API terms they do not use this data to train their models.
• Image generation — fal.ai and the image models it hosts (United States), and OpenAI when used: image descriptions from your story or your avatar description.
• Hosting, database and storage — Supabase (accounts, data and images) and Render (servers), both United States companies.
• Domain, network and email routing — Cloudflare (United States): our domain and DNS; email sent to our support address passes through Cloudflare to our mailbox provider.
• Email delivery — Resend (United States): account and sign-in emails, purchase confirmations and notices about moderation decisions.
• Payments — Dodo Payments, our Merchant of Record: everything needed to take your payment, handle taxes, invoices and refunds. Dodo Payments processes this data under its own privacy policy. On the Pricing page its checkout loads and may use its own cookies for payment security and fraud prevention.
• Analytics — PostHog (United States; data stored in its EU cloud): usage events with your consent, and the anonymous counts described in section 2.
• Team notifications — Discord (United States), a private team channel: feedback and reports you send, together with your account email or id, any contact you give, your browser details and screenshots you attach; and alerts about chargebacks or payment reversals, including the buyer’s account email.

Your data is therefore processed outside your country, including in the United States. Where the law requires it, transfers rely on the EU–US Data Privacy Framework (for certified providers) or the EU Standard Contractual Clauses; email us for a copy. We may also disclose data when required by law.

6. How long we keep it

• Account data and content: while your account is open.
• Novels you delete are hidden at once and kept in storage until you delete your account; email us to have them erased sooner. Images are served from public links, so anyone with the exact link can open an image, even one from a private draft. Earlier versions of images you replaced may remain in storage; email us to have them removed.
• Finished generation-job records: deleted automatically about 24 hours after they finish.
• When you delete your account we immediately erase your profile, avatar, novels and their current images, comments, likes, blocks, notifications, reading activity, AI-editor requests and credit balance, and remove your email from feedback and reports you sent.
• Kept after deletion, without your profile or content: anonymised cost and error logs; the content of feedback and reports you sent; and, if your account was suspended, your email address so the suspension stays in effect.
• Messages already posted to our team channel and analytics data are deleted on request; email us. Database backups are kept by our provider for a limited period.
• Invoices and payment records are kept by Dodo Payments, our Merchant of Record, for as long as tax law requires. AI providers keep API data only for the limited period their terms allow for abuse monitoring.

7. Your rights

Depending on where you live you may have the right to access, correct, export (data portability) or delete your data, to restrict its processing, and to withdraw consent at any time (for analytics, with the “Cookie settings” link in the footer). You can edit your profile and delete your account yourself; for anything else email support@lorvok.app — we reply within 30 days.

Right to object. Where we rely on our legitimate interests (safety, abuse prevention, error logs), you can object at any time on grounds relating to your situation by emailing support@lorvok.app.

You also have the right to complain to your local data-protection authority.

8. Cookies and local storage

We use strictly necessary browser storage to keep you signed in and to remember your settings and progress (language, reading progress, liked and finished novels, sound, editor preferences, a cache of catalog data). These do not require consent.

Analytics cookies (PostHog) are set only after you accept them in the cookie banner. Without your consent PostHog stores nothing in your browser and only counts visits anonymously (section 2). You can change your choice at any time with the “Cookie settings” link in the footer. The Dodo Payments checkout on the Pricing page may set its own cookies for payment security (see section 5).

9. Age and availability

Lorvok is for adults: you must be 18 or older to use it, and we do not knowingly collect data from anyone younger. If you believe someone under 18 has an account, contact us and we will delete it. The Service is not offered in the Russian Federation or the United Kingdom and is not directed at users there.

10. Changes

We will post any update to this policy on this page and, for significant changes, notify you by email or on the site before they take effect.