Privacy

Last updated October 7, 2026

This policy explains what Lorica collects, why, who sees it, how long we keep it and what you can do about it. We do not sell your data, and there are no ads or ad trackers.

The short version

• We keep your account, the stories you make, and what you play, so the site works.
• What you type in a story is sent to the AI model that writes the reply.
• Visitor counts use no cookies: a code made from your network and browser that changes every day. We never store your IP address for analytics.
• Xsolla handles payments; we never see your card.
• You can download or delete everything, at any time, on the Me page.

1. Who we are

Lorica is run by Insoola Information Technology Solutions, Pasay City, Philippines, company no. 7429750 ("we"), the same company that makes Countryballs. We decide how your data is used (we are the "controller"). Contact: ben@insoola.org.

2. What we collect and why

2.1 Your account

A random account id, your handle, display name and bio. If you sign in with Google, your Google account id (kept only as a one-way hash) and the email address Google confirms is yours (to sign you in and keep your account). Why: to run your account.

2.2 What you make

Your stories and characters, including private parts like personas and picture prompts (only you see those), and pictures, GIFs and videos you upload or make. Why: to save, show and play them. Published content is public.

2.3 What you play

Your story runs: what you typed, what the AI wrote, the story's memory (place, time, items, people, goals) and your edits to it, which model wrote each reply, likes, follows, endings found and reports you make. Daily counts of your turns, drafts and pictures, and the AI cost of your turns. Why: to continue your stories, keep the free allowance fair, and pay our AI bills.

2.4 Safety

If a message mentions suicide or self-harm, we record only that it happened and when; never the message. Why: to protect people, and to report these counts as California law (SB 243) asks.

2.5 Payments

When you buy, Xsolla collects your payment details and handles tax. We receive the order and transaction ids, what you bought, the price and currency, and whether it was a test. We keep a record of each payment and refund, and your credits and plan dates. Why: to deliver what you paid for, handle refunds, and meet tax and accounting law.

2.6 Visits and how the site is used

When someone arrives from outside the site, we count one visit: the page they landed on, where they came from (for example a search engine, an AI app like ChatGPT, a social site, or a tagged link), the country (from the network, not GPS), the kind of device (phone, tablet or desktop) and the browser language. To avoid counting the same visit twice, we make a short code by hashing a secret salt with part of your network address and your browser's name. The salt changes every day and the old one is deleted, so the code cannot follow you from one day to the next, and we never store your IP address for this. When you start playing, your new account remembers the source of the visit that brought you.

We also record which days your account opened a story or chat, and the first time you reached a few steps (your first turn, your fifth turn, signing in), to understand whether new players enjoy Lorica. For each AI turn we send its model, mode, tokens, cost and speed (no story text) to Cloudflare Analytics Engine. If the page hits an error, we keep the error message and code location (no personal content). Why: to improve Lorica and fix problems (our legitimate interest).

2.7 Security and abuse

Rate limits use your network address briefly in memory, and are not stored. Failed admin sign-ins are logged with a hash of the network address, never the address.

3. Cookies and browser storage

We use only these, all first-party and needed for the site to work. There are no advertising or analytics cookies, so there is no cookie banner.

• lk_s: keeps you signed in (up to 365 days).
• lk_lang: remembers the language you picked (365 days).
• lk_theme: remembers that you picked light or dark (365 days).
• g_state: set by Google's sign-in button, only on pages that show it, to remember the button's state.
• Browser storage tw_prefs_v1: your sound, music and narrator switches. tw_seen_…: whether you already saw the start of a story.

4. Who we share data with

Only the companies that run parts of Lorica for us, each for that job only:

• Cloudflare (USA): hosting, database, file storage, AI Gateway, Workers AI pictures and Analytics Engine.
• OpenRouter (USA): sends your story turns to the AI model you picked, and returns the reply. The model makers include DeepSeek, OpenAI, Google, xAI, Z.ai, Anthropic and Meta. What you type in a story, the story's setup and recent turns are sent with each turn. Each AI company handles it under its own terms, and some may keep it for a limited time to prevent abuse.
• fal (USA): when you animate a picture, the picture and a short motion prompt go to the video model you picked (xAI, Alibaba, MiniMax, Kuaishou, Google or ByteDance).
• Google (USA): only if you choose Sign in with Google. Google tells us your account id and confirmed email, and knows you signed in to Lorica. Google never sees your stories.
• Xsolla (USA): payments, as merchant of record, under its own privacy policy.

We may also share data when the law requires it, to protect someone from serious harm, or if Lorica is sold (the buyer must keep this policy). Published stories and your public profile are visible to everyone.

5. Data outside your country

These companies may process data in the USA and other countries, including where some AI model makers are based (for example China). Where the law requires it (for example from the EU or UK), we rely on standard contractual clauses or similar safeguards.

6. How long we keep it

• Your account, what you make and what you play: until you delete them or your account. Deleting your account erases your stories, uploads, runs and counters at once.
• Daily turn counters: 120 days.
• Visit records: 400 days. The daily salt: one day.
• Page errors: 60 days after they last happen.
• Payment records: as long as tax and accounting law requires (usually up to 10 years), even after your account is deleted; they hold no card details.
• Safety counts: kept as counts, with no message text.
• Backups made by our hosting provider expire on their own schedule.

7. Your rights

Wherever you live, you can: see and download your data (Me page, "Download my data"), correct your profile (Me page), and delete your account and data (Me page, "Delete my account"). Depending on where you live (for example the EU, UK, or US states like California), you may also have the right to object to or restrict some uses, to move your data, to withdraw consent, and to complain to your data protection authority. We do not sell or "share" personal data for cross-context advertising. To use any right, write to ben@insoola.org; we answer within 30 days. We are based in the Philippines, where the Data Privacy Act of 2012 (Republic Act 10173) gives you these rights, and you can complain to the National Privacy Commission (privacy.gov.ph).

Legal bases (EU and UK): running your account and what you paid for (contract); improving Lorica and keeping it safe (legitimate interests); records the law requires (legal obligation); and your consent where we ask for it.

8. Children

Lorica is not for children under 13, and we do not knowingly collect their data. If you believe a child under 13 is using Lorica, write to us and we will delete the account.

9. Security

Google account ids and sessions are stored only as one-way hashes. Connections are encrypted. Private parts of your stories never leave our server except to you. No system is perfectly safe; if a breach puts your data at risk, we will tell you and the authorities as the law requires.

10. AI and your stories

We do not use your stories or chats to train AI models. The AI companies in section 4 receive your turns to write the reply, under their own terms. We do not make automated decisions about you that have legal or similarly significant effects; removals and suspensions are decided by a person.

11. Changes to this policy

If we change this policy in a way that matters, we tell you on the site or by email before it applies.

12. Contact

Insoola Information Technology Solutions, Pasay City, Philippines, company no. 7429750. Email: ben@insoola.org.