Privacy Policy

1. Intent

Universal adoption through openness. Build tools, host infrastructure, and maintain a REST API so worldbuilding data becomes portable, interoperable, and free from lock-in. Privacy and ownership first.

OnlyWorlds evolves through use. We collect minimal operational data to run the platform and improve based on user feedback.

World data exports to JSON at any time. Data can be used in other tools, self-hosted, or backed up locally.

2. Free Services and Features

• Membership: Account creation and maintenance
• World API: REST API access for reading and writing world data
• Core Language: OnlyWorlds specification and schema (22 element categories)
• Data Storage: World hosting on onlyworlds.com
• Data Export: JSON export of all data, available at any time
• Element Creation: Unlimited characters, locations, events, and all other elements
• Developer Resources: SDK packages (Python, NPM), MCP server, documentation

3. What We Collect

Account Information

When you register:

• Email address (for authentication, password reset, critical service notifications)
• Username (public identifier)
• Passwords (stored hashed; never stored in plain text)
• If you sign in with Google, GitHub or Discord: that provider confirms your identity and shares your email address with us. We store nothing else from them.

API credentials:

• API-Key (per-world REST API access)
• API-Pin (authentication for API operations)

World Data

Users retain full ownership of all created content:

• Characters, locations, events, and all 22 element categories
• Element fields (names, descriptions, relationships, custom data)
• World metadata (titles, descriptions, visibility settings)
• Data export available at any time via website or API

Cookies & Tracking

• sessionid: Session authentication
• csrftoken: Cross-site request forgery protection

These are the only cookies. The cookie notice records your acknowledgment in your browser's local storage, not a cookie. There are no tracking or advertising cookies.

4. Data Hosting and User Responsibilities

OnlyWorlds provides free hosting for world data. Free hosting operates on a best-effort basis without guaranteed uptime.

What We Do

• Regular backups: Automated daily backups of database
• Security measures: HTTPS encryption, API authentication, regular updates
• Attack mitigation: Basic DDoS protection, rate limiting, monitoring

User Responsibility

Users should maintain local backups of their data:

• Use JSON export from website or tools
• Store copies offline (local drive, personal cloud storage, offline tools)
• OnlyWorlds provides infrastructure hosting; users retain data ownership and backup responsibility

OnlyWorlds is designed with local-first principles: worlds are lightweight text files that can be used offline.

5. User Rights and Data Controls

Data Export

Users can download all world data in JSON format from the website or via API at any time.

Data Deletion

You can delete individual worlds and elements at any time. You can also delete your entire account from account settings: the page lists every world that will be deleted, offers an export of each first, and asks you to confirm. Deletion is immediate and permanent.

Age

OnlyWorlds is for worldbuilders of any age. If you are under 16, ask a parent or guardian before creating an account.

Visibility Controls

• Private: Visible only to account owner (default)
• Shared: Accessible to specific users via API-Key sharing
• Public: Listed publicly and searchable

GDPR Rights (EU Residents)

EU residents have additional rights under GDPR:

• Access: Request a copy of all personal data held
• Rectification: Request correction of inaccurate data
• Erasure: Request deletion (right to be forgotten)
• Portability: Receive data in portable format (provided as standard)
• Objection: Object to data processing
• Restriction: Request limited processing

To exercise GDPR rights: Email info@onlyworlds.com with "GDPR Request" in the subject line.

6. Security & Backups

What We Implement

Data in transit:

• HTTPS encryption (TLS 1.2+)
• API authentication required (API-Key + API-Pin)

Data at rest:

• Encrypted database storage
• Account passwords hashed (Django's PBKDF2); world PINs hashed with Argon2
• API keys hashed on storage and shown only once at creation

Access control:

• Per-world API keys with limited scope
• Rate limiting to prevent abuse
• Regular security updates

Monitoring:

• Server logs (errors, suspicious activity)
• Automated alerts for anomalies
• Manual review when flagged

7. Data Retention

• Account data: Retained until account deletion or deletion request
• World data: Retained until worlds or account are deleted
• Backups: Retained for 30 days, then purged

8. International Data & Legal

Data Location

OnlyWorlds runs on Render (Frankfurt, European Union). World and account data is stored in a PostgreSQL database there. Encrypted nightly backups are written to Cloudflare R2 storage under EU jurisdiction, retained for 30 days, then purged. EU hosting means GDPR applies to all data.

Service Providers

These services process limited data to run OnlyWorlds:

• Render: application and database hosting
• Cloudflare: content delivery for tool subdomains, backup storage
• Resend: transactional email (verification, password reset)
• Google / GitHub / Discord: identity confirmation if you sign in with them

No advertising or analytics services are used.

Legal Requests

Data may be disclosed when legally required:

• Valid subpoena or court order
• Law enforcement request with proper documentation
• Emergency involving danger to person or property

OnlyWorlds resists overbroad requests. When legally permitted, users are notified before disclosure.

9. Changes to This Policy

This policy evolves as OnlyWorlds grows. Changes will be:

• Posted here with updated "Last Updated" date
• Emailed to registered users for significant changes
• Effective immediately unless stated otherwise

Significant changes include changes affecting data usage, new data collection, or new third-party services.

Minor changes include clarifications, corrections, and formatting updates.

Users who disagree with changes can export data and close their account. OnlyWorlds provides tools for clean account closure.

10. Contact & Questions

11. Philosophy Over Compliance

This privacy policy reflects OnlyWorlds' mission: open data, user control, no lock-in.