01What this policy covers
This Privacy Policy applies when you visit Zirel, join the waitlist, create an account, build a project, submit feedback, or contact the project operator.
During the early beta, the Zirel project operator is responsible for the processing described here. Formal operator identity and direct privacy contact details must be added before a broad public or commercial launch.
When we say “project content,” we mean fictional worlds, characters, factions, events, relations, descriptions, dates, locations, and other creative material entered into Zirel. Your creative content remains yours.
02Data we collect
We collect the information needed to operate Zirel, secure accounts, provide the worldbuilding workflow, and understand the early beta.
| Category | What we collect | Why | Current basis |
|---|---|---|---|
| Account | Username, email, role, password hash, admin status | Create and secure an account | Service requested |
| Project | Worlds, entities, relations, dates, locations, notes | Provide Zirel features | Service requested |
| Messages | Feedback, contact and beta application submissions | Operate and improve the beta | Request / legitimate interest |
| Technical | Session and operational records | Authentication, diagnostics and security | Legitimate interest |
| Analytics | Page, session, approximate device and location data | Understand website use | Consent where required |
Passwords are stored as hashes, not readable passwords. Zirel does not currently collect payment information.
03How we use it
Zirel uses data to provide private projects, entity and relation tools, rule-based warnings, graph views, import and export; authenticate users and enforce ownership; respond to messages and requests; diagnose failures; secure the service; and understand aggregate beta use.
- Service delivery. Project content is processed to render workspaces, resolve relations, generate warnings, and build visual views.
- Account and security. Account and session data support authentication, ownership checks, and administrator permissions.
- Beta operation. Feedback, contact, and beta application data help evaluate bugs, requests, and interest.
- Measurement. Google Analytics 4 loads for website measurement only after the visitor grants analytics consent.
Zirel does not currently sell personal data or creative project content, process payments, or run AI analysis as a core feature.
04Where it is stored
Production Zirel currently uses Render for application hosting and a managed PostgreSQL database. Local development may use SQLite on the developer's machine.
Hosting providers may process data in locations different from your own. Their infrastructure, recovery, and backup behavior is governed by their services and the configuration selected by the Zirel operator.
Do not assume that an early beta provides permanent archival storage. Export important projects as JSON and keep independent copies.
05Who we share it with
Zirel uses a small number of providers that may process limited information for their operational role. Data may also be disclosed when required by law, needed to investigate abuse or security issues, protect users, or complete a legitimate organizational transfer.
These providers support the current beta. Zirel does not share creative project content for advertising.
06Cookies and tracking
The application uses session technology required for login and authenticated navigation. Google Analytics 4 is optional and loads only after the visitor grants analytics consent through Zirel cookie settings.
| Cookie | Purpose | Typical duration | Type |
|---|---|---|---|
| session | Keeps authenticated navigation working | Session-dependent | Essential |
| _ga | Distinguishes analytics clients | Up to 2 years by default | Analytics |
| _ga_<id> | Maintains analytics session state | Up to 2 years by default | Analytics |
Analytics is disabled by default until a visitor chooses to allow it. Visitors can reject analytics, accept it, or change the choice later through Cookie settings in the footer. Necessary session and security storage remains active.
07Your rights and choices
Depending on where you live, you may have rights to access, correct, delete, restrict, object to, or obtain a portable copy of personal data, and to withdraw consent where processing depends on consent.
Control the information connected to your account.
We may verify your identity before completing a request.
08Data retention
Information is retained only while reasonably necessary for beta operation, security, legal obligations, or the service requested.
| Data | Current approach | Deletion path |
|---|---|---|
| Account | While active | Contact request during beta |
| Projects | Until project or account deletion | Self-service project deletion |
| Feedback and contact | While relevant to beta operation | Contact request |
| Waitlist | While relevant to launch communication | Contact request |
| Provider backups and logs | Limited provider or legal retention | Provider process |
A fixed retention schedule is not yet published. Defining one is part of beta hardening.
09Security
Zirel uses password hashing, authenticated sessions, project ownership checks, route protection, administrator authorization, and managed production infrastructure.
Passwords are stored as hashes rather than readable passwords. Ordinary users can access only their own projects, while administrator routes require admin access. Production-data access should be limited to legitimate operational needs.
No online service can guarantee absolute security or permanent data preservation. Avoid highly sensitive or irreplaceable material during beta and keep independent exports.
10International processing and children
Hosting and analytics providers may process data in countries other than your own, where privacy protections may differ. Applicable transfer mechanisms and provider commitments must be documented for target markets before broad launch.
Zirel is not intentionally directed to children who cannot legally consent to data processing in their location. If you believe a child submitted personal data without appropriate authorization, contact us.
AI analysis is not currently active as a core feature. If introduced later, Zirel will explain what content is sent, which provider processes it, retention choices, and how users review suggestions before saving them.
11Changes and contact
This policy may change as Zirel's hosting, analytics, security, collaboration, AI, or commercial features change. The updated date and version at the top will be revised, and material changes should be communicated where required.
For privacy questions, account concerns, or deletion requests, use the Contact page. This is an early beta draft and not legal advice.