Privacy Policy

1. Who is responsible

Nepenthe Play is developed and operated by NEPENTHE DAYDREAM LLC. This Policy covers Nepenthe Play and its shared company-account functions. NEPENTHE DAYDREAM LLC is responsible for the personal information described here where it acts as controller or business under applicable law. For privacy questions or requests, contact office@nepentheplay.com and identify the relevant brand.

Nepenthe Play is a browser-based AI entertainment platform offering AI-native games, character interactions and interactive stories. Our registered office is 30 N Gould St Ste N, Sheridan, WY 82801, United States. This is the registered office, not a staffed product-support or daily operating location.

2. Information we handle

Depending on the features you use, we process:

• Account and sign-in information, including your email, account and OAuth identifiers, nickname, avatar and basic profile received from your chosen login provider.
• Player actions, prompts, character conversations and settings, story choices, ongoing interaction state, game progress, saves, session history and results.
• Content you choose to create, publish or share, and comments, reports or community activity where those features are available.
• Device, IP/network, browser, language, usage, security and diagnostic information, and consent choices.
• Credits, purchase, usage, refund and dispute records.
• Messages and attachments you send for support, feedback, rights requests or business enquiries.

Information comes from you, your interactions, sign-in providers and necessary service or payment providers. Do not submit another person's information unless you have a lawful basis and authority. Chat or upload features can receive personal information; a rule against unauthorized submissions does not technically prevent such information from being entered. Content you deliberately publish or share is accessible to the audience you select and may be copied by others.

3. Purposes and legal bases

We use information to provide requested functions, authenticate and protect the shared account, charge and reconcile Credits and orders, preserve requested content or progress, respond to support and rights requests, prevent abuse, diagnose faults, measure product use and campaigns under the choices described below, and comply with legal obligations.

Where data-protection law requires a legal basis, we rely on contract for requested services; legitimate interests for proportionate security, fraud prevention, troubleshooting and support, subject to your rights; consent where required for optional tracking; and legal obligations for required records or disclosures. Merely using the service is not consent to every form of processing or international transfer.

4. Shared account and payments

HowWorks and Nepenthe Play share an account identity, authentication and Credits balance under the same company. Necessary profile, security, payment and support information is processed at that shared layer; each domain establishes its own browser session. Product content is used for the function requested, not automatically made public or reused across brands simply because the account is shared.

Nepenthe Play purchases may take you to HowWorks and then Creem's hosted checkout. Creem handles applicable purchases as Merchant of Record and independently processes payment and billing information. We receive the order, status and entitlement information needed to deliver Credits, support your purchase and reconcile payments. We do not receive full card credentials from the hosted checkout. Planned subscriptions do not mean we currently hold subscription records for you.

5. AI services and other recipients

Requests may involve Cloudflare infrastructure and AI Gateway, Google Gemini, DeepSeek, OpenRouter and the Shubiaobiao model-routing service, depending on the selected feature and active route. A routing service and its upstream model provider may both receive the content necessary for inference. A model's brand does not by itself identify every recipient of a request. Google or GitHub can authenticate your account. PostHog, Google Analytics/Ads and Reddit support analytics or advertising measurement as described below. Not every provider receives every request.

Providers receive the content and metadata needed for their role, which may include prompts, selected conversation context, uploads, generated output and diagnostic information. Their retention, safety review and permitted use depend on the service, contract and settings. We do not use customer content to train our own models. We do not promise universal zero retention or that all third parties are prohibited from model training. Avoid sending secrets or unnecessary sensitive personal information.

We may disclose information to professional advisers, authorities where lawfully required, or a successor in a lawful transaction. Providers may act as processors for us or as independent controllers for their own authentication, payment, security or other disclosed purposes.

6. Cookies and measurement choices

Necessary cookies support sign-in, security and preferences. Each domain stores its own first-party session and consent choices; your choice does not automatically carry across the two domains. The consent preference is stored for 180 days.

Where measurement tools are enabled, you can accept or reject optional analytics and advertising storage using the Cookie Banner or the Cookie preferences controls below. You can return to these controls to change or withdraw your choice. Withdrawal applies going forward and does not undo earlier lawful processing.

Google's consent state begins with analytics and advertising storage denied. Its Advanced Consent Mode may still send limited cookieless measurement signals before a choice or after rejection. PostHog capture is disabled before consent, although its software may be loaded; Reddit measurement loads after acceptance. Accepting enables the configured measurement storage. Rejecting does not disable necessary service functions. Browser controls can also remove or block cookies, though blocking necessary cookies may affect sign-in.

7. International processing

The company is formed in the United States and managed from China. Infrastructure and providers may process information in the United States, China and other countries, including outside your country. Applicable transfer requirements depend on the actual recipient and route. Contact office@nepentheplay.com for information about the recipients and safeguards applicable to your use. Acceptance of this Policy is not a blanket waiver of international-transfer protections.

8. Retention and account closure

We retain account and product records to operate your account, preserve requested work or progress and meet the purposes above. Retention depends on account status, content type, deletion requests, legal recordkeeping, disputes, security needs and provider-specific retention. There is no single deletion period covering every system.

The current account-closure function disables the shared identity, removes linked sign-in accounts and sessions, and replaces basic profile information. It does not itself immediately erase all chats, uploads, game saves, billing records, backups or provider copies. Closure affects access across both brands. To request erasure of product data, contact office@nepentheplay.com and identify the relevant brand and content.

We assess and carry out applicable rights requests, retaining only records for which a lawful retention ground continues. Billing, tax and dispute records may need to be retained despite closure; backup and provider deletion can follow different schedules. We can explain the retention criteria and any applicable exception when responding to a request.

9. Your choices and rights

Depending on applicable law, you may request access, correction, deletion, portability, restriction, objection or review of our response, withdraw consent for processing based on consent, and complain to the competent data-protection authority. We verify identity proportionately and explain a refusal or exception where required. Send requests to office@nepentheplay.com; do not send passwords, full payment credentials or unrelated identity documents.

We do not use these entertainment and creative tools to make decisions about your eligibility for employment, credit, housing or similar high-impact services.

10. Age, security and updates

The services are intended for people aged 18 or over. This is an eligibility rule, not a claim that identity or age verification is performed for every user. If we learn that an ineligible minor has supplied personal information, we take reasonable steps to restrict the account and address deletion, subject to legal and refund obligations.

We use access controls and security measures appropriate to our services, but no system is completely secure. The revision date appears above; material changes receive any legally required notice.