Privacy Policy

Last Modified: April 25, 2026

1. Introduction

Yumina, Inc. ("Yumina," "we," "us," or "our") is an AI interactive fiction and roleplay platform that enables users to create game worlds with characters, variables, rules, and interactive components; chat with AI-driven characters; and join multiplayer rooms. We are committed to protecting your privacy and handling your Personal Information responsibly.

This Privacy Policy ("Policy") explains what Personal Information we collect, how we collect and use it, with whom we share it, and the rights and choices available to you. "Personal Information" means any information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, to an identifiable individual.

By accessing or using the Yumina platform, website, and related services (collectively, the "Service"), you acknowledge that you have read and understood this Policy. If you do not agree with our practices, please do not use the Service.

2. Scope

This Policy applies to the Yumina web platform and all related services operated by Yumina, Inc., including:

• The Yumina website at yumina.io;
• User account registration and management;
• World creation, publishing, and discovery;
• AI-powered chat and interactive fiction sessions;
• Multiplayer rooms;
• The Creator Rewards Program; and
• Any other features, tools, or services we offer.

This Policy does not apply to third-party websites, applications, or services that may be linked from or integrated with the Service. Please review the privacy policies of those third parties separately (see Section 20).

3. Age Policy

The Service is intended for users who are at least 13 years of age. We do not knowingly collect Personal Information from children under the age of 13. If we discover that we have collected Personal Information from a child under 13, we will promptly delete that information. Please see Section 19 (Children's Privacy) for additional detail.

Certain content on the Service is rated R-18 and is restricted to users who are at least 18 years of age. Access to age-restricted content requires self-declaration of your birth year and selection of the appropriate content level in your account settings. By enabling access to R-18, you represent and warrant that you are at least 18 years old.

Content on the Service uses a tiered rating system, controlled by a single content level preference in your account settings:

• All Ages -- Suitable for users aged 13 and older. (Default content level)
• R-18 -- Restricted to users aged 18 and older.

4. Contact Information

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us at:

Yumina, Inc

Email: [email protected]

5. Personal Information We Collect

We collect the following categories of Personal Information:

5.1 Identity Data

Information that identifies your account and person, including:

• Username
• Email address
• Password (stored as a cryptographic hash; we never store plaintext passwords)
• Display name
• Self-declared birth year

5.2 Device and Network Data

Technical information collected when you access the Service, including:

• IP address
• Browser type and version
• Device type and operating system
• Session identifiers and authentication tokens
• Referring URLs and pages visited within the Service
• Date, time, and duration of access

5.3 User Content

Content you create, upload, or generate through the Service, including:

• Worlds (including characters, settings, variables, rules, game components, and first messages)
• Chat messages exchanged during AI interactive fiction sessions
• Uploaded images, avatars, and other media files
• Multiplayer room configurations and in-room interactions
• Comments, ratings, and other social interactions
• AI-extracted narrative summaries ("World Memories") automatically generated from your chat sessions, categorized by type (event, relationship, fact, decision, item, location, agreement, world state) and scored by narrative importance
• Session checkpoints (snapshots of chat history and game state at specific points)
• AI-assisted world-building conversations and proposals ("Studio" sessions)
• Custom prompt templates and presets

5.4 Social and Engagement Data

Data generated through your interactions with the community, including:

• Follow relationships (who you follow and who follows you)
• Favorites (Worlds you have bookmarked)
• Library metadata (Worlds in your library, last played time, update tracking)
• Notifications and their read status
• Achievement and milestone records

"User Content" as used in this Policy refers collectively to all content you create or upload to the Service.

5.5 Transaction Data

Records related to your financial transactions on the Service, including:

• Subscription status and plan details
• Purchase history
• Creator Rewards Program earnings and payout records
• Tip and payment transaction records (amounts, dates, payer/payee associations)

5.6 Creator Tax and Payout Data

If you participate in the Creator Rewards Program, additional information is collected through Stripe Connect for payment and tax compliance purposes, including:

• Legal name (individual or business entity name)
• Address (residential or business)
• Tax identification information: Social Security Number (SSN) or Employer Identification Number (EIN) for U.S.-based Creators; equivalent tax identifiers for non-U.S. Creators
• IRS Form W-8 data (W-8BEN or W-8BEN-E) for non-U.S. Creators, including country of tax residence and tax treaty claims
• Bank account or debit card details for payout purposes
• Date of birth (for identity verification)
• Government-issued identification documents (if required by Stripe for identity verification)

This information is collected, stored, and managed by Stripe Connect, not by Yumina directly. Yumina may receive limited summary information from Stripe (e.g., payout status, tax form filing status, verification status) but does not store your full tax identification numbers or bank account details on Yumina's own systems. Please refer to Stripe's Privacy Policy for details on how Stripe handles this data.

5.7 Financial Data

Payment-related information required to process transactions. Yumina uses Stripe as its payment processor for both user purchases (subscriptions, credits) and Creator payouts (via Stripe Connect). Yumina does not directly store credit card numbers, debit card numbers, or full bank account details. Payment information is collected and processed by Stripe in accordance with Stripe's Privacy Policy. We may receive and store limited information from Stripe, such as the last four digits of your card, card brand, expiration date, and billing address.

5.8 Audio and Visual Data

Media you upload to the Service, including:

• Profile avatars
• Character images and artwork
• Other images or visual assets associated with your Worlds

5.9 Age Verification Data

Information used to verify your age and control access to age-restricted content, including:

• Self-declared birth year
• Content level preference (All Ages, R-18)

5.10 Third-Party Login Data

If you register or sign in using a third-party authentication provider (Google, Discord, or X), we receive certain information from that provider as authorized by you during the OAuth process. This may include:

• Your name or display name on the third-party service
• Email address associated with your third-party account
• Profile picture or avatar
• Unique account identifier from the third-party service

We do not receive or store your passwords from third-party login providers.

6. How We Collect Personal Information

6.1 Data You Provide Directly

We collect Personal Information that you voluntarily provide when you:

• Register for an account -- including your username, email address, password, display name, and birth year declaration.
• Create and publish content -- including Worlds, characters, variables, rules, components, images, and other creative assets.
• Use AI chat features -- including the chat messages you send during interactive fiction sessions.
• Participate in multiplayer rooms -- including room settings and in-room interactions.
• Manage your account settings -- including content rating preferences, profile information, and notification preferences.
• Contact us -- including any information you provide in support requests, feedback, or other communications.
• Participate in the Creator Rewards Program -- including identity verification, tax information (W-9 for U.S. Creators, W-8BEN/W-8BEN-E for non-U.S. Creators), and payout details, all collected through Stripe Connect.

6.2 Data Collected Automatically

When you access or use the Service, we automatically collect certain information through cookies, server logs, and similar technologies, including:

• IP address and approximate geographic location
• Browser type, version, and language settings
• Device type, operating system, and screen resolution
• Pages viewed, features used, and actions taken within the Service
• Date, time, and duration of your visits
• Referring and exit URLs
• Session identifiers and authentication tokens

Please see Section 10 (Cookies and Similar Technologies) for more information.

6.3 Data from Third-Party Login Providers

If you choose to register or sign in using Google, Discord, or X (formerly Twitter), we receive the information described in Section 5.10 through the OAuth authentication process. The information we receive depends on your privacy settings with the third-party provider and the permissions you grant during the authentication flow.

7. How We Use Personal Information

We use the Personal Information we collect for the following purposes:

7.1 Service Operation

• Creating and managing your account
• Displaying your published Worlds and content to other users in accordance with your settings
• Processing AI chat interactions (sending your messages to third-party AI service providers and returning generated responses)
• Facilitating multiplayer rooms and real-time interactions
• Processing transactions, subscriptions, and Creator rewards payouts

7.2 Age Verification and Content Gating

• Verifying that you meet the minimum age requirement (13+) to use the Service based on your declared birth year
• Restricting access to R-18 content to users who are at least 18 years old based on their declared birth year and content level preference
• Enforcing content rating classifications

7.3 Content Moderation and Safety

• Monitoring for violations of our terms of service and community guidelines
• Reviewing reported content and user behavior
• Protecting the safety of our users and the integrity of the Service

7.4 Security and Fraud Prevention

• Detecting, investigating, and preventing unauthorized access, fraud, and other malicious activity
• Protecting the security and integrity of the Service and its infrastructure
• Verifying user identity when necessary

7.5 Analytics

• Analyzing aggregate, non-individually-identifiable usage data to understand how the Service is used
• Identifying trends and areas for improvement
• Measuring the performance and reliability of the Service

We use aggregate analytics -- not individual-level tracking -- to improve the Service.

7.6 Communications

• Sending service-related notifications (e.g., account verification, security alerts, system updates)
• Sending marketing or promotional communications (with your consent where required, and always with the ability to opt out)
• Responding to your inquiries and support requests

7.7 Legal Compliance

• Complying with applicable laws, regulations, and legal processes
• Enforcing our terms of service and other agreements
• Establishing, exercising, or defending legal claims

7.8 Statement Regarding AI Model Training

Yumina does not use your User Content to train AI models. See Section 8.2 for additional detail.

8. AI Chat Data Processing

This section explains how your data is handled when you use the AI chat features of the Service.

8.1 How AI Chat Works

When you engage in an AI interactive fiction or chat session, your chat messages -- along with relevant context from your World (such as character descriptions, system prompts, variables, and rules) -- are sent to third-party AI service providers to generate responses. This transmission is necessary for the Service to function.

8.2 Yumina Does Not Train on Your Content

Yumina does not use your chat messages, World content, or any other User Content to train, fine-tune, or improve any AI model. Your content is used solely to provide the Service to you.

8.3 Third-Party AI Provider Policies

The third-party AI service providers currently used by the Service include OpenRouter, Anthropic, and OpenAI. Each provider has its own privacy policies and data handling practices. Yumina selects providers that offer API terms under which user inputs submitted via the API are not used for model training, where such terms are available. However, Yumina cannot guarantee the data practices of third-party providers, and their policies may change.

The Service also supports Ollama for local inference. When Ollama is configured, AI processing occurs entirely on your own device and your data is not transmitted to any third-party AI provider.

8.4 Sensitive Information in Chat

You should avoid entering real, sensitive personal information (such as real names, addresses, phone numbers, financial account numbers, Social Security numbers, or health information) in AI chat sessions. While Yumina takes steps to protect your data, chat messages are transmitted to third-party AI service providers for processing, and the interactive fiction environment is not designed for the handling of real-world sensitive personal data.

9. Data Sharing

We share Personal Information only as described below. We do not sell your Personal Information.

9.1 Service Providers

We share Personal Information with trusted third-party service providers who assist us in operating the Service, including:

• Hosting and infrastructure providers that store and serve the Service, including cloud storage providers (such as S3-compatible object storage) used to store user-uploaded assets (images, audio, and other media files)
• Payment processors — Stripe processes user purchases (subscriptions, credits) and, through Stripe Connect, processes Creator Rewards payouts, identity verification, and tax reporting (including 1099-NEC issuance for U.S. Creators and W-8 form collection for non-U.S. Creators)
• Third-party AI service providers that generate AI chat responses (currently OpenRouter, Anthropic, and OpenAI; see Section 8)

These service providers are contractually obligated to use your Personal Information only to provide services to us and in accordance with this Policy. For payment and tax processing, Stripe acts as a data processor and, in some cases, an independent data controller — please review Stripe's Privacy Policy for details on their data practices.

9.2 Other Users

When you publish a World, the content you designate as public (including the World's title, description, characters, tags, and associated images) becomes visible to other users of the Service in accordance with your publication settings. Your username and display name are associated with your published Worlds. Unpublished Worlds and private content are not shared with other users.

9.3 Legal Disclosures

We may disclose Personal Information if we believe in good faith that such disclosure is necessary to:

• Comply with applicable law, regulation, legal process, or governmental request
• Enforce our terms of service or other agreements
• Protect the rights, property, or safety of Yumina, our users, or the public
• Detect, prevent, or address fraud, security issues, or technical problems

9.4 Corporate Events

In the event of a merger, acquisition, reorganization, bankruptcy, asset sale, or similar corporate transaction, your Personal Information may be transferred to the acquiring or successor entity. We will provide notice before your Personal Information is transferred and becomes subject to a different privacy policy.

9.5 No Sale of Personal Data

Yumina does not sell, rent, or lease your Personal Information to third parties. We do not share your Personal Information with third parties for their own direct marketing purposes.

10. Cookies and Similar Technologies

10.1 What Are Cookies

Cookies are small text files placed on your device by a website. They are widely used to make websites work efficiently and to provide information to the operators of the site. We may also use similar technologies such as local storage and session storage.

10.2 Cookies We Use

• Essential Cookies -- Required for the Service to function. These cookies enable core features such as user authentication, session management, and security. You cannot opt out of essential cookies without losing the ability to use the Service.
• Functional Cookies -- Used to remember your preferences and settings, including content level preference (All Ages or R-18), display preferences, and other personalization choices.
• Analytics Cookies -- Used to collect aggregate information about how users interact with the Service, helping us understand usage patterns and improve the Service. These cookies do not identify individual users. Yumina currently uses Google Analytics and PostHog as its analytics providers.

10.3 Managing Cookies

Most web browsers allow you to control cookies through their settings. You can typically set your browser to:

• Block all cookies
• Accept only first-party cookies
• Delete cookies when you close your browser
• Be notified when a cookie is set

Please note that blocking or deleting essential cookies may prevent you from using the Service or cause it to function improperly. For more information about managing cookies, visit your browser's help documentation.

11. Data Storage and Security

11.1 Data Location

Your Personal Information is stored and processed in the United States. By using the Service, you consent to the transfer and storage of your data in the United States. Please see Section 17 (International Users) for additional information.

11.2 Security Measures

We implement industry-standard technical and organizational measures to protect your Personal Information, including:

• Encryption in transit -- All data transmitted between your device and the Service is encrypted using HTTPS/TLS.
• Encryption at rest -- Sensitive data, such as API keys, is encrypted using AES-256-GCM.
• Password hashing -- User passwords are stored as cryptographic hashes; plaintext passwords are never stored.
• Access controls -- Access to Personal Information is restricted to authorized personnel on a need-to-know basis.
• Regular security reviews -- We periodically review and update our security practices.

11.3 No Absolute Guarantee

While we take reasonable steps to protect your Personal Information, no method of transmission over the Internet and no method of electronic storage is completely secure. We cannot guarantee the absolute security of your data. You use the Service at your own risk with respect to security.

12. Data Retention

12.1 Active Accounts

We retain your Personal Information for as long as your account remains active and as needed to provide the Service to you. The following retention periods apply to specific data categories for active accounts:

Data Category

Retention Period

Chat messages and session data

Duration of account

World Memories (AI-extracted summaries)

Duration of account (max 100 per World)

Server access logs (IP, user agent)

90 days

Security event logs

1 year

Payment and transaction records

7 years (tax and regulatory compliance)

Aggregate analytics data (de-identified)

Indefinite

12.2 Deleted Accounts

When you close or delete your account, we will delete your Personal Information within 7 days of account closure. This includes your Identity Data, User Content, and other Personal Information associated with your account.

12.3 Legal Exceptions

Notwithstanding the above, we may retain certain Personal Information for longer periods where required or permitted by applicable law, including for:

• Compliance with legal, regulatory, tax, or accounting obligations
• Resolution of disputes
• Enforcement of our agreements
• Fraud prevention and security purposes

12.4 Periodic Review

We periodically review our data retention practices to ensure that Personal Information is not retained longer than necessary for the purposes described in this Policy.

13. Data Breach Notification

In the event of a data breach that affects your Personal Information:

• We will notify affected users within 72 hours of confirming the breach, providing information about what happened, what data was affected, and what steps we are taking in response.
• We will notify relevant regulatory authorities as required by applicable law, including within 72 hours for GDPR supervisory authorities where applicable.
• We will take prompt action to contain the breach and mitigate any harm.

14. Your Rights and Choices

Depending on your jurisdiction, you may have the following rights regarding your Personal Information:

14.1 Right to Access

You have the right to request a copy of the Personal Information we hold about you. You can view much of your Personal Information directly through your account settings.

14.2 Right to Correction

You have the right to request correction of inaccurate or incomplete Personal Information. You can update most of your account information directly through your account settings.

14.3 Right to Deletion

You have the right to request deletion of your Personal Information. You can delete your account through your account settings, and your data will be deleted within 7 days. Certain data may be retained as described in Section 12.3.

14.4 Right to Export

You have the right to export your data in a portable format. Yumina provides the ability to export your Worlds and chat history through the Service.

14.5 Right to Withdraw Consent

Where we rely on your consent to process Personal Information, you have the right to withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing that occurred before the withdrawal. Please note that if your consent is necessary for the provision of the Service, withdrawing consent may require you to close your account.

14.6 Marketing Opt-Out

You can opt out of receiving marketing and promotional communications from us by:

• Clicking the "unsubscribe" link in any marketing email we send
• Adjusting your notification preferences in your account settings
• Contacting us at [email protected]

Opting out of marketing communications does not affect service-related communications (such as security alerts and account notifications).

14.7 Cookie Controls

You can manage cookies through your browser settings as described in Section 10.3.

14.8 How to Exercise Your Rights

To exercise any of the rights described above, please contact us at [email protected]. We may need to verify your identity before processing your request. We will respond to your request within a reasonable timeframe and in accordance with applicable law.

15. California Privacy Rights (CCPA/CPRA)

If you are a California resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), provides you with additional rights regarding your Personal Information.

15.1 Right to Know

You have the right to request that we disclose:

• The categories of Personal Information we have collected about you
• The categories of sources from which we collected your Personal Information
• The business or commercial purpose for collecting your Personal Information
• The categories of third parties with whom we share your Personal Information
• The specific pieces of Personal Information we have collected about you

15.2 Right to Delete

You have the right to request that we delete Personal Information we have collected from you, subject to certain exceptions permitted by law.

15.3 Right to Opt-Out of Sale

We do not sell your Personal Information. However, you have the right to direct a business that sells your Personal Information to stop doing so. Because we do not engage in the sale of Personal Information, no opt-out mechanism is necessary, but we honor this right as a matter of principle.

15.4 Right to Non-Discrimination

We will not discriminate against you for exercising any of your privacy rights under the CCPA/CPRA. We will not:

• Deny you the Service
• Charge you different prices or rates
• Provide you a different level or quality of service
• Suggest any of the above will occur as a result of exercising your rights

15.5 Other U.S. State Privacy Rights

Residents of Virginia (VCDPA), Colorado (CPA), Connecticut (CTDPA), Utah (UCPA), Nevada (NRS Chapter 603A), and other states with consumer data privacy laws may have rights similar to those described above, including the right to access, correct, delete, and opt out of the sale of certain personal information. We do not sell your Personal Information under any state law definition.

15.6 Submitting Requests

To submit a request under the CCPA/CPRA or other applicable U.S. state privacy laws, please contact us at [email protected]. We will verify your identity before processing your request and will respond within the timeframe required by applicable law (45 days for CCPA/CPRA). You may also designate an authorized agent to make a request on your behalf, subject to verification.

16. European Economic Area, United Kingdom, and Swiss Users

If you are located in the European Economic Area ("EEA"), the United Kingdom ("UK"), or Switzerland, the following additional provisions apply to you under the General Data Protection Regulation ("GDPR"), the UK GDPR, and the Swiss Federal Act on Data Protection ("FADP"), respectively.

16.1 Legal Basis for Processing

We process your Personal Information on the following legal bases:

• Contract Performance (Article 6(1)(b) GDPR): Processing necessary to provide the Service to you, including account creation, chat processing, session management, and payment processing.
• Legitimate Interests (Article 6(1)(f) GDPR): Processing necessary for our legitimate interests, including platform security, fraud prevention, aggregate analytics, and service improvement, where those interests are not overridden by your data protection rights.
• Consent (Article 6(1)(a) GDPR): Processing based on your consent, including access to R-18 content, marketing communications, and optional cookies. You may withdraw consent at any time (see Section 14.5).
• Legal Obligation (Article 6(1)(c) GDPR): Processing necessary to comply with legal obligations, including tax reporting, law enforcement requests, and regulatory requirements.

16.2 Data Protection Officer

[DPO DESIGNATION OR STATEMENT — e.g., "Yumina has not designated a Data Protection Officer as it does not meet the threshold requirements under Article 37 GDPR. For data protection inquiries, please contact us at [email protected]."]

16.3 Cross-Border Data Transfers

Your Personal Information is transferred to and processed in the United States. We rely on the following transfer mechanisms to ensure adequate protection of your data:

• Standard Contractual Clauses (SCCs) as adopted by the European Commission (Commission Implementing Decision (EU) 2021/914), executed with our service providers.
• Where applicable, supplementary measures including encryption in transit and at rest.

16.4 Additional Rights

In addition to the rights described in Section 14, EEA, UK, and Swiss users have the following rights:

• Right to Data Portability: You have the right to receive your Personal Information in a structured, commonly used, and machine-readable format, and to transmit that data to another controller.
• Right to Restriction of Processing: You have the right to request restriction of processing of your Personal Information in certain circumstances (e.g., while we verify accuracy after a correction request).
• Right to Object: You have the right to object to processing of your Personal Information based on legitimate interests. We will cease processing unless we demonstrate compelling legitimate grounds.
• Right to Lodge a Complaint: You have the right to lodge a complaint with your local supervisory authority if you believe our processing of your Personal Information violates applicable data protection law. A list of EEA supervisory authorities is available at https://edpb.europa.eu/about-edpb/about-edpb/members_en.

16.5 Data Breach Notification

In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, as required by Article 33 GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay, as required by Article 34 GDPR.

16.6 Automated Decision-Making

Yumina does not engage in automated decision-making or profiling that produces legal effects or similarly significantly affects you, as described in Article 22 GDPR. Content recommendations on the Service are based on aggregate engagement data and do not constitute profiling with legal or similarly significant effects.

17. International Users (All Other Jurisdictions)

The Service is operated from and data is stored in the United States. If you are accessing the Service from outside the United States, please be aware that your Personal Information will be transferred to, stored in, and processed in the United States.

By using the Service, you consent to the transfer of your Personal Information to the United States. The data protection and privacy laws of the United States may differ from, and may not provide the same level of protection as, the laws in your country of residence. You acknowledge and accept these risks by using the Service. For users in the EEA, UK, and Switzerland, please refer to Section 16 for applicable transfer mechanisms and additional rights.

18. "Do Not Track" Signals

The Service does not currently respond to "Do Not Track" (DNT) browser signals or similar mechanisms.

19. Children's Privacy (COPPA)

The Service is not directed to children under the age of 13. We do not knowingly collect, use, or disclose Personal Information from children under 13 years of age, in compliance with the Children's Online Privacy Protection Act (COPPA).

If you are under 13 years of age, do not use the Service and do not provide any Personal Information to us. Do not create an account, submit any content, or enter any information on the Service.

If we learn that we have collected Personal Information from a child under 13, we will take prompt steps to delete that information and terminate the associated account. If you are a parent or guardian and believe that your child under 13 has provided Personal Information to us, please contact us immediately at [email protected] so that we can take appropriate action.

20. Third-Party Links

The Service may contain links to third-party websites, applications, or services that are not operated or controlled by Yumina. This includes, but is not limited to, third-party authentication providers (Google, Discord, X) and external websites linked from User Content.

This Policy does not apply to any third-party websites, applications, or services. We are not responsible for the privacy practices, content, or security of any third party. We encourage you to review the privacy policies of any third-party services you access through or in connection with the Service.

21. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, the Service, or applicable law. When we make changes:

• We will update the "Last Modified" date at the top of this Policy.
• For material changes, we will notify you by email (sent to the email address associated with your account) and/or by prominent notice within the Service (such as an in-app notification or banner).
• We encourage you to review this Policy periodically.

Your continued use of the Service after the effective date of any updated Policy constitutes your acceptance of the changes. If you do not agree with the updated Policy, you should stop using the Service and delete your account.

22. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our privacy practices, please contact us:

Yumina, Inc

Email: [email protected]

Security vulnerabilities: [email protected]

Website: yumina.io

This Privacy Policy should be read in conjunction with our Terms of Use and Community Guidelines.

We will make every effort to respond to your inquiry in a timely manner.