Legal

Privacy Policy

Effective 9 September 2026Last updated 9 September 2026Version 1.0

This Privacy Policy explains how We Are All Warriors (“WAAW”, “we”, “us”) collects, uses, stores, shares and protects information when you use the We Are All Warriors game at app.weareallwarriors.com, our mobile app, and this website at www.weareallwarriors.com (together, the “Service”).

The Service is operated by Matell Software Pty Ltd (ABN 25 474 835 475), an Australian company. We are the entity responsible for the information described here.

1. Information we collect

1.1 Sign-in information from Google or Microsoft

We Are All Warriors has no passwords of its own. You sign in with an existing Google or Microsoft account using OpenID Connect. When you do, that provider shows you a consent screen and then sends us an identity token containing a limited set of claims. We request exactly three scopes — openid, profile and email — and from them we store:

• Your email address — your account identity, and how we send you invites and service notices.
• Your name (given name and family name, where the provider supplies them) — used as your default display name at the table.
• A provider-issued account identifier (the OpenID sub claim), stored in the form google:<identifier> or microsoft:<identifier>. This is what links you to your characters and campaigns each time you sign in.
• Sign-in timestamps — the date and time you last signed in.

Your provider’s identity token and refresh token are held only inside an encrypted, HttpOnly session cookie in your browser, so the game can act on your behalf while you play. They are not written to our database. See Cookies.

We never receive or store your Google or Microsoft password.

1.2 Information you create in the game

The Service exists to store the things you make. That includes:

• Characters — names, races, classes, levels, attributes, equipment and backstory text.
• Campaigns and sessions — settings, party membership, session state and outcomes.
• Narrative entries — every line of the story, including the actions and dialogue you type and the narration the AI Dungeon Master returns.
• Session artifacts — saved session files held as blobs in our Azure storage account.
• Invite codes you redeem to enter the alpha, and when you were admitted.

Please treat free-text fields as visible to your table. Don’t put real-world personal information — addresses, phone numbers, identity documents, health information — into character backstories, campaign notes, or messages to the Dungeon Master.

1.3 Information we generate or observe

• Operational logs and diagnostics — error records, request traces and performance data, used to keep the alpha standing up. These can include your account identifier and the endpoints you called.
• Security records — sign-in attempts and authorisation failures.

1.4 Information from this website

If you submit the alpha signup form at weareallwarriors.com/signup, we collect the name, email address, party size, play style and interests you enter, and use them only to contact you about alpha access and playtests. This marketing site sets no cookies of its own and runs no analytics or advertising scripts. Fonts are loaded from Google Fonts, which means your browser makes a request to Google’s font servers; that request is subject to Google’s Privacy Policy.

1.5 What we do not collect

• No payment details — the alpha is free and we do not take payments.
• No advertising identifiers, no ad networks, no cross-site tracking, no third-party analytics.
• No precise location, no contacts, no calendar, no files, no biometric data.
• No raw IP addresses stored against your account in our application database.
• We never sell your personal information, and we never disclose it for cross-context behavioural advertising.

2. Google user data

This section describes specifically how We Are All Warriors handles data received through Google APIs. It applies in addition to the rest of this policy.

• What we access. Only the openid, profile and email scopes. We request no sensitive or restricted scopes. We do not access Gmail, Google Drive, Google Calendar, Google Contacts, Google Photos, or any other Google service or API.
• How we access it. Through a standard OpenID Connect authorisation-code flow with PKCE. We do not call the Google userinfo endpoint; the claims we use come from the identity token itself. We request offline access solely so that a play session can be renewed without signing you out mid-game.
• How we use it. Only to authenticate you, create and identify your player account, populate your default display name, and send you service email such as alpha invitations. We do not use Google user data for advertising, profiling, or model training.
• How we store it. Your email address, name and Google account identifier are stored in our database in Microsoft Azure’s Australia East region, encrypted at rest. Google tokens are held only in an encrypted session cookie in your browser; they are never written to our database and never shared with any third party.
• How we share it. We do not sell, rent or trade Google user data. It is disclosed only to the infrastructure providers listed in section 5, acting on our instructions to host the Service and deliver our email, and only to the extent needed to operate the Service.
• Google user data is never sent to the AI Dungeon Master or to any AI model. See section 3.
• How to revoke it. You can withdraw our access at any time at myaccount.google.com/permissions. To also delete the data we hold, see section 8.

We Are All Warriors’ use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

3. The AI Dungeon Master

The heart of We Are All Warriors is an AI Dungeon Master that narrates your campaign. It runs on large language models hosted by Microsoft inside our own Azure AI Foundry resource in Australia. We do not route your game through consumer AI services, and we do not send it to a provider that trains on it.

3.1 What is sent to the model

Each time the Dungeon Master narrates, we assemble a prompt from your game state and send it to the model. That prompt contains:

• Your in-game character details — character name, race, class, level and relevant attributes.
• The current scene, and whether the party is in combat.
• A short window of recent story events — typically the last few narrative entries.
• The action text you type as your character.
• Passages of our own game lore, retrieved to keep the narration consistent with the setting. That lore is written by us and contains no player data.

3.2 What is never sent to the model

• Your real name, as supplied by Google or Microsoft.
• Your email address.
• Your account identifier, player ID, or any Google or Microsoft token.
• Your IP address, device identifiers or location.
• Any data from other players’ campaigns.

In short, the model sees a fantasy character in a scene — not a person with an account. The one thing that can carry personal information into a prompt is text you choose to type, which is why we ask you not to enter real-world personal details into the game.

3.3 How the AI provider handles it

Our AI processing runs in a Microsoft Azure AI Foundry resource under our own subscription, hosted in Australia. Under Microsoft’s terms for the Azure OpenAI Service:

• Your prompts and the model’s responses are not used to train, retrain or improve any Microsoft or OpenAI model.
• Prompts and responses may be retained by Microsoft for up to 30 days for abuse and misuse monitoring, and may be reviewed by authorised Microsoft personnel if that monitoring flags a potential policy violation. They are deleted afterwards.
• Content filters run over inputs and outputs to block prohibited content.

Separately, we store the resulting narration in your campaign’s story log so your table can read it back. That copy is yours, and it is deleted when you delete the campaign or your account.

3.4 The limits of AI narration

The Dungeon Master is a storyteller, not an oracle. Its narration is generated fiction: it can be wrong, inconsistent, or produce content you did not expect, and it must not be relied on as factual, professional, medical, legal or financial advice. We do not use AI to make any automated decision that produces a legal or similarly significant effect on you. If the Dungeon Master produces something harmful or inappropriate, please report it to hello@weareallwarriors.com.

4. How we use information

We do not use your information for advertising, profiling or automated decision-making, and we do not use your game content to train AI models — ours or anyone else’s.

5. Who we share it with

We share personal information only with the service providers below, who process it on our instructions in order to run the Service. We do not sell it, and we do not share it with advertisers or data brokers.

We may also disclose information where we are legally required to — to comply with a law, regulation, subpoena or lawful government request; to enforce our Terms of Service; or to protect the rights, safety or property of our players, the public, or us. If the Service is ever acquired or merged, personal information may transfer as part of that transaction; we will notify you before it becomes subject to a materially different privacy policy.

Our community lives on Discord, a separate service we do not operate. Anything you post there is governed by Discord’s Privacy Policy, not this one.

6. Where your data is stored

Our application, database and file storage run in Microsoft Azure’s Australia East region, and AI processing runs in an Azure resource hosted in Australia. Some of our providers — notably our email delivery provider, and the identity providers you sign in with — operate outside Australia, so limited data (principally your email address and name) is transferred overseas. Where we transfer personal information out of the EEA or the UK, we rely on the European Commission’s Standard Contractual Clauses or an equivalent safeguard offered by that provider. We take reasonable steps to ensure overseas recipients handle your information consistently with the Australian Privacy Principles.

7. How long we keep it

The Service is an alpha. We may reset campaign data between major builds; where we plan to, we will give notice in the app and on Discord first.

8. Your choices and rights

Wherever you live, you can ask us to:

• Access the personal information we hold about you, and get a copy of it.
• Correct anything inaccurate or out of date.
• Delete your account and the data in it.
• Export your characters and campaign logs in a machine-readable format.
• Object to or restrict processing we carry out under legitimate interests, and withdraw any consent you have given (without affecting processing already carried out).

Email hello@weareallwarriors.com with the subject “Privacy request”. We will verify that the request comes from the email address on the account, and respond within 30 days. These requests are free.

Deleting your account

Email hello@weareallwarriors.com with the subject “Delete my account”. We delete your player record, characters, campaigns and story logs from our live systems within 30 days, and purge them from backups within 90 days. We may retain a minimal record of the deletion itself, and anything we are legally required to keep. Deleting your account here does not delete your Google or Microsoft account — to also revoke our access to that account, visit myaccount.google.com/permissions or your Microsoft app permissions.

Complaints

If you think we have mishandled your information, tell us first — we would rather fix it. If you are not satisfied with our response, you can complain to the Office of the Australian Information Commissioner (OAIC). If you are in the EEA or the UK, you can also complain to your local supervisory authority.

9. Security

We protect your information with measures appropriate to a service of this size and stage:

• All traffic is encrypted in transit with HTTPS/TLS, and data is encrypted at rest by Azure.
• We hold no passwords — authentication is delegated entirely to Google and Microsoft, so there is no password of ours to breach.
• Session cookies are HttpOnly, SameSite=Lax and encrypted, so scripts running in your browser cannot read your tokens.
• Secrets and connection strings live in a managed secret store, never in our source code.
• Access to production data is limited to the people who need it to operate the Service.

No system is perfectly secure. If we become aware of a data breach likely to cause you serious harm, we will notify you and the OAIC as required by the Notifiable Data Breaches scheme.

10. Children

The Service is not intended for children under 13, and we do not knowingly collect personal information from them. If you are between 13 and 18, please get a parent or guardian’s permission before creating an account. If you believe a child under 13 has given us personal information, email hello@weareallwarriors.com and we will delete it promptly.

11. Cookies

We use cookies only to keep you signed in. There are no analytics, advertising or tracking cookies anywhere on our website or in the game.

Because these cookies are strictly necessary to deliver a service you asked for, we do not show a consent banner for them. You can clear them in your browser at any time; doing so signs you out.

12. Changes to this policy

We will update this policy as the Service grows. When we do, we will change the “Last updated” date above and bump the version. If a change materially affects how we handle your personal information, we will give notice in the app, on Discord, or by email before it takes effect. Continuing to use the Service after a change takes effect means you accept the updated policy.

13. Contact us

For any privacy question, request or complaint:

• Email: hello@weareallwarriors.com
• Post: Matell Software Pty Ltd, NSW 2174, Australia
• Community: our Discord server — please don’t post personal details in public channels

Back to Home Read the Terms of Service