Draft: this text has not been legally reviewed and is not legal advice. It does not say that Lorenzo or its operator complies with the law.
Privacy policy
Last changed: 2026-11-07. The German text is binding; this is a translation.
Controller
Stefan Insam, Hiddenseer Str 1A, 10437 Berlin, Germany. Email: ramsesoriginal+lorenzo@gmail.com.
This policy covers the Lorenzo web apps and their API, and the Discord bot, the command line and the Android and iOS apps where they use this operator. Whoever runs Lorenzo themselves is responsible for their own deployment.
Account and sign-in
Sign-in runs through Authgear (see "Recipients"). Your credentials, such as password and sign-in methods, are kept there. Lorenzo stores the identifier Authgear gives you, a copy of your verified email address (taken from Authgear only, never changed in Lorenzo) and, if you give them, a nickname, display name, pronouns, short bio, languages, a colour and a profile picture.
Purpose: to provide your account and to recognise you in your libraries. Basis: contract, Art. 6(1)(b) GDPR.
Content in libraries
A library belongs to a game group or an author. Its members write entries, notes and secrets there and decide who may see them. This includes information about the people who play and their characters: which account belongs to which campaign, characters, and text a game master writes about them. Your role decides what you can read.
For each entry, Lorenzo stores which account created it and which changed it last. Whoever writes in a library decides that content. Basis: contract, Art. 6(1)(b) GDPR, and a legitimate interest in shared work that can be followed, (f).
Activity log and notifications
For the administrators of a library, Lorenzo keeps a log of who changed what: who became a member or left, who created or deleted a campaign, who changed access or ownership. It holds identifiers, counts and keywords, not the text of entries. Notifications tell you about events in your libraries, for example when a membership ends.
Purpose: accountability and protection of libraries. Basis: legitimate interest, Art. 6(1)(f) GDPR.
Access tokens
When you connect a device, the command line or an app, you can create a personal access token. Lorenzo stores only a hash, the name you give, when it was created and last used, and an expiry date if you set one. You see and revoke your tokens in your profile.
Profile pictures and the Gravatar picture
An uploaded profile picture is stored in the database. It is served without sign-in: whoever knows the random identifier of your account can fetch it.
When Lorenzo first takes your email address from Authgear and you have no picture yet, Lorenzo asks Gravatar (Automattic, USA) once for a picture for a hash (SHA-256) of your email address. If there is one, it is stored as your profile picture in Lorenzo. After that Lorenzo never asks Gravatar again, and your browser never talks to Gravatar. For accounts that already existed, Lorenzo does not ask. You can replace or delete the picture at any time; it is not fetched again.
Basis for the single request: legitimate interest, Art. 6(1)(f) GDPR. You can object by deleting the picture or by writing to us.
Public repositories
Whoever publishes a repository is named as its publisher by the display name of their account (otherwise the nickname, otherwise "A Lorenzo account"). Everyone sees this, signed in or not. Libraries that copied a public repository by themselves are only counted for the publisher, never named.
Invite links
An invite link carries a secret in its address. Lorenzo stores only a hash of it, removes it from its logs and does not pass it on to other sites. Whoever redeems a link gets a seat in the campaign; the activity log records this.
Discord bot, command line and mobile apps
- Discord bot: when you link your Discord account, it stores your Discord user identifier and your sign-in tokens, encrypted (AES-GCM). It reads your own data with your permission and can send notifications as a direct message. What Discord itself processes is governed by Discord.
- Command line: it stores your credentials in a file on your computer (readable by your user only). Nothing goes to third parties.
- Android and iOS apps: they keep encrypted local copies of your inventories, notes and drafts until you sign out or the sign-in ends.
Service logs
The API writes structured logs with time, requested path, status and a trace identifier. Invite secrets are removed. To limit abuse it evaluates the network address of a request in memory. The hosting providers (see "Recipients") can keep access logs of their own. Basis: legitimate interest in secure operation, Art. 6(1)(f) GDPR.
Browser storage, cookies, tracking
The Lorenzo apps set no cookies, include no analytics, advertising or tracking services and load no fonts or scripts from third parties. They store only the following on your device:
| Key | Store | What for | How long |
|---|---|---|---|
| authgear_default_idToken, authgear_default_refreshToken, authgear_default_oidcCodeVerifier | localStorage | Keeps you signed in (Authgear sign-in library). The identity token contains your email address. | Until you sign out |
| lorenzo:<app>:return, lorenzo.returnTo, lorenzo.invite | sessionStorage | Remembers the page you return to after signing in, and an invite link while you redeem it. | Until the tab is closed |
| lorenzo.cache.*, lorenzo.<app>.reads.* | sessionStorage | Holds recently read answers of the API (your account, your libraries) so pages appear faster. | Until the tab is closed; at most 30 minutes |
| lorenzo:lastTenant, lorenzo:lastHolder | localStorage | Remembers the library you opened last and the character you chose last. | Until you sign out or clear browser data |
| lorenzo:inventory-web:catalog:* | localStorage | Holds the catalogue last loaded for a library (items with names and descriptions) so it appears at once. | Until browser data is cleared |
| lorenzo:<app>:theme, bench:theme, bench:sans, lorenzo:single-keys, lorenzo:maps:look, lorenzo:maps:projection:* | localStorage | Your display choices (light/dark, typeface, keyboard shortcuts, map look and the projection of a map). | Until browser data is cleared |
| bench:workspace, bench:explorer-order, bench:welcomed, bench:repo:*, lorenzo:palette-recent | localStorage | The window layout in Bench, the order of the entry tree, the repository opened last and the commands used last in the command palette. Bench writes the layout even when you are not signed in. | Until browser data is cleared |
| lorenzo-writing-drafts | IndexedDB | Unsaved drafts of your texts in Lorenzo Writing, so nothing is lost after a crash. They contain the text you are writing. | Until the draft is saved or discarded |
Recipients and service providers
Lorenzo uses the following providers. The operator confirmed location and the safeguard for transfers with the providers and entered them here.
| Provider | What for | Where it processes | Transfer outside the EU |
|---|---|---|---|
| Authgear (https://www.authgear.com/dpa/) | Sign-in and credentials (password, sign-in methods, email address) | Authgear Cloud runs in the United States and Hong Kong, by its own account [unverified] | The European Commission's standard contractual clauses under Authgear's data processing agreement [unverified] |
| Neon (https://neon.com/privacy-policy) | Database that holds accounts, libraries and content | AWS Europe Central 1 (Frankfurt am Main, Germany) | Neon Inc. is based in the United States; transfers rest on standard contractual clauses and, where certified, the EU-US Data Privacy Framework |
| Google Cloud (Cloud Run, Artifact Registry, Cloud Logging) (https://cloud.google.com/terms/data-processing-addendum) | Running the API and the Discord bot, logs | Belgium (region europe-west1); logs in Cloud Logging's default bucket, whose location need not be limited to the EU | Standard contractual clauses under Google's Cloud data processing addendum, where data is processed outside the EU |
| Cloudflare (Pages) (https://www.cloudflare.com/cloudflare-customer-dpa/) | Serving the web apps and the legal pages | Cloudflare's worldwide network; there is no fixed region | Cloudflare, Inc. is based in the United States; standard contractual clauses under Cloudflare's data processing addendum and, where certified, the EU-US Data Privacy Framework |
| Namecheap (domain registrar) (https://www.namecheap.com/legal/general/privacy-policy/) | Registering and managing the domain; the registrar collects the contact details of the operator that a domain requires | Namecheap, Inc. (United States) [unverified] | Transfer to the United States; safeguarded under Namecheap's terms (standard contractual clauses or Data Privacy Framework) [unverified] |
Gravatar (a single request, see above) and Discord (only if you use the bot) are also named; they are not part of the normal operation of the web apps.
Retention
- Account and content: until you delete your account. Deleting removes your Lorenzo account, memberships, player seats and roles. What you created stays in the libraries without naming you as its creator. The activity log keeps a note with the internal identifier of the deleted account. Your sign-in at Authgear is not deleted by this; write to us if it should be removed too.
- Service logs: 30 days in Cloud Logging (the default); 1 day at the sign-in provider Authgear [unverified]
- Backups: The restore window of the Neon plan, which I estimate at a few hours to a few days
- A library's activity log: No automatic deletion; entries stay until the library is deleted
- Data on your device: until you sign out or delete it.
Your rights
You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction (Art. 18), portability (Art. 20) and objection (Art. 21), and the right to complain to a supervisory authority (Art. 77). What Lorenzo offers for each:
- Rectification: you change your profile details yourself in your profile.
- Erasure: in your profile you can delete your picture and your account, leave libraries and revoke tokens. Deleting the account needs a sign-in, not a token.
- Access and portability: there is no button for this yet. Write to us; we assemble your data by hand.
- Objection, restriction: write to us.
Competent supervisory authority: Berliner Beauftragte für Datenschutz und Informationsfreiheit, https://www.datenschutz-berlin.de. Providing your data is necessary to use accounts; there are no automated decisions or profiling.
Links to other sites
The apps link to Ko-fi (https://ko-fi.com/ramsesoriginal) and to the source code on GitHub. These are links: nothing is embedded, and your browser contacts those sites only when you open the link.
Changes
When what Lorenzo does with data changes, this policy changes. The date of the last change is at the top; the history is in the project’s version control.
The German text is binding; the English version is a translation.