Privacy Policy

Last updated: August 2026

Note: This text describes the actual technical state of the app. It is not a substitute for legal advice.

1. Controller

The controller for data processing within the meaning of the GDPR is:

Kadelo GmbH Bebraer Weg 11 40627 Düsseldorf, Germany Represented by its managing directors Heike Kasper and Erik Kasper Email: support@kadelo.de

2. What data we process

Anonymous account: Larpsmith does not require registration. On first launch the app automatically creates an anonymous account. This produces a random identifier (UUID) and a session token stored on your device. We collect neither your email address nor a name or password. The account is tied to your device and cannot be linked to you personally.

Content data: The content you create in the app – adventures, campaigns, NPCs, locations and handouts – is stored on our server under your identifier. If you enter personal data there (for example the names of fellow players), we process that too. We recommend not recording third-party data in your content.

AI input: If you use the generation feature, the relevant section and the associated details of your adventure (title, genre, mood, notes, and where applicable the names of NPCs you have created) are transmitted to our AI provider. The code of your selected language (de, en or es) is also sent, so that the generated text is written in that language.

Usage quota: To protect against abuse we count how many AI generations your identifier triggers per day. Only the identifier, the date and a counter are stored.

Technical data: Accessing our server produces technically necessary data, in particular your IP address and the time of access.

Local settings: Your theme choice (light/dark/system) and your language choice (system/Deutsch/English/Español) are stored exclusively on your device. The theme choice never leaves your device; the language code is transmitted only with AI requests (see above).

Local cache: So that the app remains readable without an internet connection, the content you loaded most recently is additionally cached unencrypted on your device. This cache does not leave your device, expires after 14 days without a connection, and is removed when you sign out and when the account is deleted.

The app contains no tracking, no analytics tools and no advertising.

3. Purposes and legal bases

Providing the account and the app's functions (Art. 6(1)(b) GDPR – performance of a contract).
AI-assisted content creation at your explicit request (Art. 6(1)(b) GDPR).
Operation, security, protection against abuse and cost overruns, and error analysis (Art. 6(1)(f) GDPR – legitimate interest).

4. Processors and third-party services

Supabase – hosting of the database and authentication. The data is held on servers in the European Union (Frankfurt am Main region, Germany). Supabase processes account, content and access data on our behalf.

OpenAI – processes the input passed to the generation feature in order to produce the requested text. This involves a transfer to the USA; it is safeguarded by standard contractual clauses and participation in the EU-US Data Privacy Framework. Our API access is configured so that the input is not used to train the models.

Data processing agreements (Art. 28 GDPR) are in place with these providers.

5. Retention

We store your content for as long as your anonymous account exists. Counters for the daily AI generation quota are kept on a per-day basis.

Important for anonymous accounts: Access to your account depends on the session token on your device. If you delete the app or its data, you lose access to your content and we cannot restore it for you – we hold no attributes that would let us identify you as the owner. If needed, back up your content beforehand via "Settings → Export data".

6. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability and objection. You also have the right to lodge a complaint with a data protection supervisory authority.

Data portability: Via "Settings → Export data" you can download your content as a JSON file at any time.

Erasure: You can delete individual items in the app at any time. To remove all content at once, use "Settings → Data & export → Delete all data"; this also irrevocably deletes the associated anonymous account and all server-side data. Alternatively, contact support@kadelo.de.

To exercise your rights, reach us at support@kadelo.de. Please note that for anonymous accounts we need additional details to match your request (such as your identifier), as we cannot otherwise identify you (Art. 11 GDPR).

7. Contact

For questions about data protection: support@kadelo.de