Privacy Policy

This Privacy Policy describes how D100 WORLD handles personal information through its websites and applications, including SILENT | IMAGE (the “Service”). It covers account holders, campaign members, visitors, and people who contact us.

D100 WORLD determines why application data is processed. Google and other infrastructure providers process some data on our behalf under their own applicable terms.

Account and identity. Email address, authentication provider, display name, username, profile image, email-verification state, account role, account tier, and sign-in metadata.

Campaign content. Campaign names and settings, membership and roles, invitations and access requests, character and NPC records, prompts, reference images, generated images, galleries, and related metadata.

Gold and usage. Plan grants, reward and purchased balances, debits, refunds, request identifiers, model and feature costs, text-use counts, concurrency state, referral records, and administrative awards.

Security and technical data. IP address and browser metadata processed by providers, App Check or reCAPTCHA signals, authentication events, error codes, storage events, device and network information, and security audit records.

Notifications. If you enable push in the installed app, we store a Firebase Installation ID, a broad device-platform label, registration timestamps, and unread scene counts. Transactional email delivery records may include provider message identifiers and delivery outcomes.

• Authenticate accounts and maintain profiles.
• Create, store, secure, and share campaign content according to membership and roles.
• Process AI requests, return results, reserve or refund Gold, and prevent duplicate work.
• Operate invitations, referrals, account tiers, plan limits, and future checkout.
• Send requested installed-app push notifications and operational account email.
• Detect abuse, investigate failures, enforce limits, protect campaigns, and maintain audit records.
• Improve reliability, accessibility, support, and product design using operational information.

We do not sell personal information. We do not use your private campaign content to build advertising profiles.

When you request AI generation, the Service sends the prompt, selected references, and generation settings needed to fulfill that request to Google Vertex AI and Gemini services. Provider safety systems may inspect or refuse content.

We retain operational request metadata such as account, campaign, model, status, cost, and timestamps. We do not intentionally place prompt text or reference-image payloads in application logs. A completed result may be kept in a private replay cache for up to 24 hours so a safe retry does not perform or charge for the same AI work twice.

Google states that it does not use Vertex AI customer data to train or fine-tune models without permission or instruction. Google may temporarily cache customer data in project-isolated memory and may retain prompts for abuse monitoring under applicable Google Cloud terms.

Campaign members. Content is shared according to campaign membership and role. Some material, including private GM-managed NPC content, has more restrictive access.

Service providers. We use Google services including Firebase Authentication, Hosting, Firestore, Cloud Storage, Cloud Functions, App Check, reCAPTCHA Enterprise, web fonts, and Vertex AI/Gemini. These providers receive data needed to perform their services and may process standard network data.

Safety and legal needs. We may disclose information when reasonably necessary to comply with law, protect users or the Service, investigate fraud or abuse, enforce agreements, or respond to an emergency.

If D100 WORLD is involved in a merger, financing, acquisition, reorganization, or sale of assets, information may be transferred as part of that transaction subject to appropriate confidentiality and notice.

Application data is hosted on Google Cloud and Firebase infrastructure. Depending on the service, information may be processed in the United States, Canada, or other locations where Google and its subprocessors operate. Firebase Authentication is operated from United States data centres.

We use encrypted transport, Firebase security rules, campaign and role checks, server-controlled sensitive operations, App Check, abuse limits, private media authorization, and operational logging. No system can guarantee absolute security, and you should not upload information that would create unreasonable harm if exposed.

Active account and campaign content is retained while the account or campaign remains active. Deleted campaign and entity records are generally queued for application cleanup after approximately 24 hours. Cloud Storage recovery features, backups, provider systems, or legal holds may retain copies for a limited additional period.

Application security audit records are configured for a 180-day retention period. Completed notification delivery receipts are configured for approximately 30-day retention. Active push registrations remain until disabled, signed out, invalidated, or the account is deleted. Operational records may be retained longer when needed to investigate abuse, maintain Gold accounting, prevent fraud, resolve disputes, or meet legal obligations.

You can request account deletion in Identity Settings after resolving campaigns you own. The deletion process removes or de-identifies the profile, memberships, invitations, personal uploads, and linked usage data subject to the limited exceptions described above.

Account and campaign controls let you update profile details, enable or disable installed-app push on a device, manage campaign access, delete content, and request account deletion. Device or browser settings can also revoke notification permission. Depending on where you live, you may also have rights to request access to or correction of personal information, receive a copy, withdraw consent where processing relies on consent, or challenge our handling of information.

Send a privacy request to privacy@d100.world. We may need to verify your identity and account before responding. Some requests may be limited by another person’s privacy, legal requirements, security, or information we must retain.

The Service is not directed to children under 13, and we do not knowingly collect personal information from a child under 13. If you believe a child has provided personal information, contact us so we can investigate and remove it where appropriate.

We may update this Policy as the Service, providers, or legal requirements change. We will post the effective date and provide additional notice when a change materially affects how we handle personal information.

Questions, privacy requests, or complaints can be sent to privacy@d100.world.