Privacy Policy

This policy explains how Larpify (“we”, “us”) handles personal information when you visit larpify.me or use the apps we host (together, the “Service”). Larpify is a tool for making fictional wallet, store and payouts screens for entertainment, mockups and props. It is not a bank, wallet, exchange, store or payment processor, and the figures in it are not real financial records.

The short version: we collect what we need to run your account, take payment and keep the Service safe. We do not sell your information, we do not use advertising cookies, and we only send marketing email if you opt in.

1. Who we are

The Service is run online in Australia trading as Larpify. We are the “controller” of the personal information described here (the business responsible for it).

Privacy questions and requests: [email protected]. General support: [email protected].

2. What we collect

Most of this comes from you. Some is created automatically when you use the Service.

• Account details. Your email address and password (our authentication provider stores the password in hashed form, and we never see it). If you add a passkey, the public part of that credential and the device name. When you created the account, when you confirmed your age, and when you last signed in.
• Profile (optional). Anything you type into your brand profile: name, business name, business domain, preferred currency and locale, avatar initials and colour, and baseline figures used to fill the apps.
• Saved setups. The presets you save in each app: fictional balances, names, tokens, orders, customers and layout choices. They are make-believe, but they can contain personal information if you type it in, so please do not enter real people’s details without their permission.
• Wallet handle and transfers (optional). If you publish a wallet handle, we store the handle, display name, avatar colours and the address shown in your wallet. If you send a fictional transfer to another user, we store the amount, token details, any memo you write, your handle and display name, and the time it was sent and claimed.
• Push notifications (optional). If you turn on wallet notifications, we store the push address your browser gives us, its encryption keys, a short browser description (user agent) and when it was last used.
• Billing. Stripe handles payment and we never receive your full card number. We store your Stripe customer and subscription IDs, plan, status and renewal date. We also keep copies of the payment notifications Stripe sends us, which can include your name, email, billing country or address, and limited card details such as brand and last four digits.
• Referrals. Your referral code. If you signed up through someone’s link, which account referred you. If you refer others, which accounts signed up through your link, whether they have paid, the amounts they paid (to work out your tier and any commission), and the rewards, commission and payouts that resulted. If you apply for affiliate commission, the payout method and details you give us (such as a PayPal email, bank details or a wallet address) and when you accepted the programme terms. The person who referred you sees only a masked version of your email and whether you have paid, never your name or what you paid.
• Marketing preferences. Whether you opted in to marketing email and when, and a log of the marketing emails we sent you (subject, type, any personal promo code and whether it was delivered).
• Safety and moderation. If we suspend an account or block an email address, we record the reason and when it happened. We keep an internal log of the actions our administrators take on accounts.
• Messages. Anything you send us by email, including support requests and misuse reports.
• Technical and usage data. Our hosting provider records standard request logs (such as IP address, browser and the page requested). We use privacy-focused web analytics that count page views, referring sites, approximate country and device or browser type, without cookies. We use error monitoring that records errors and performance data, and for a sample of visits (about one in ten, plus every visit where an error occurs) a replay of how the page behaved. Replays mask text and form inputs by default. We read your browser’s language setting to choose the language and display currency, but we do not store it.
• Earlier demo sign-ups. We previously offered a demo that asked only for an email address. If you used it, we kept that address, the app you tried and when, and linked it to your account if you later signed up. This demo is closed and no longer collects new addresses.

Some data stays only on your device. The apps keep a copy of your setups in your browser’s local storage so they work offline and before you sign in. That copy does not reach us unless you are signed in, in which case it syncs to your account.

3. How we use it, and our legal basis

Where the EU or UK GDPR applies, we need a legal basis for each use. Here is what we do and why.

• Run your account and the apps (sign-in, syncing setups, wallet handles and transfers, showing or removing the watermark, the free demo window). Basis: performing our contract with you.
• Take payment and manage your plan through Stripe. Basis: contract. Keeping billing records for tax and accounting: legal obligation.
• Send push notifications about incoming wallet transfers. Basis: your consent, given through your browser’s permission prompt. You can turn it off at any time in your browser or the wallet.
• Send marketing email with product news and offers, such as a free month or a discount code. Basis: your consent. See section 4.
• Confirm your age at sign-up. Basis: legal obligation and legitimate interests (keeping the Service away from young children).
• Keep the Service safe, enforce our Terms of Use (including suspending accounts and blocking addresses), investigate misuse and cooperate with people who were misled by a Larpify screen. Basis: legitimate interests in preventing fraud and abuse.
• Fix bugs and improve the Service using hosting logs, analytics and error monitoring. Basis: legitimate interests in running a reliable product.
• Answer you and respond to legal requests. Basis: contract, legitimate interests or legal obligation, depending on the request.

Where we rely on legitimate interests, we have weighed them against your rights, and you can object (see section 9). We do not sell personal information, and we do not use it to train AI models.

4. Marketing email

Marketing email is off by default. You opt in by ticking the box when you create your account or by switching it on in your account settings. We never opt anyone in automatically.

We choose who receives an offer using simple rules: whether you are on a paid plan, how long ago you signed up, how recently you signed in and when we last emailed you. This can happen automatically. It decides only whether you get an offer, and has no legal or similarly significant effect on you.

Every marketing email has an unsubscribe link that works without signing in. You can also switch marketing off in your account settings. Unsubscribing takes effect straight away and does not affect account, security or billing emails, which we send as part of running your account.

5. Who we share it with

We use the service providers below to run Larpify. They handle personal information on our instructions and only for the purposes listed.

• Supabase: sign-in and the database that stores your account, profile, setups and plan. Data location: AP-NORTHEAST-1. Privacy policy.
• Vercel: hosting, request logs, scheduled jobs and web analytics. Data location: United States and Vercel’s global network. Privacy policy.
• Stripe: checkout, subscriptions, invoices and the billing portal. Stripe also uses payment data for its own fraud prevention and legal compliance, as an independent controller. Privacy policy.
• Resend: delivers our marketing email. Account emails (confirmation, sign-in links and password resets) are sent through Resend. Data location: Tokyo, AP-NORTHEAST-1. Privacy policy.
• Sentry: error monitoring, performance tracing and session replays. Data location: European Union (Germany). Privacy policy.
• Browser push services (for example Google, Apple, Mozilla or Microsoft, depending on your browser), only if you turn on notifications. The message content is encrypted so the push service cannot read it.
• Other Larpify users, only for features you choose to use. Once you publish a wallet handle, signed-in users who search for it can see your handle, display name and avatar colours. When you send a transfer, the recipient sees your handle, display name, the amount and any memo. Your email address is never shown.
• Authorities and people affected by misuse, when the law requires it, or when we reasonably believe someone used the Service to deceive or defraud another person.
• A buyer or successor, if Larpify is sold or restructured. We would tell you before your information became subject to a different privacy policy.

We do not sell personal information, and we do not share it for cross-context behavioural advertising. We have no advertising partners and use no advertising pixels.

6. International transfers

We are based in Australia, and our providers store or process data in the United States, the European Union and other countries where they operate. When personal information about people in the EU, UK or Switzerland leaves those regions, we rely on an adequacy decision, the EU-US Data Privacy Framework where the provider is certified, or the Standard Contractual Clauses (with the UK Addendum) in our providers’ data processing terms. You can ask us for more detail on the safeguard for a given provider.

For Australian users: by disclosing information to the overseas providers listed above, we remain accountable under the Australian Privacy Principles for how they handle it.

7. Cookies and similar technologies

We do not use advertising or cross-site tracking cookies. We use:

• Sign-in cookies (set by Supabase, names start with “sb-”). Keep you signed in. Essential. Last until you sign out or the session expires.
• larpify_wallet_customize. Remembers whether you hid the Customize button in the wallet. Set only when you change that setting. Lasts one year.
• larpify_ref. Remembers the referral link you arrived through, so the referral can be recorded if you create an account. Set only when you open someone’s referral link. Lasts 30 days.
• larpify_locale. If present, stores your preferred language and region.
• larpify_demo. Used by the former email-only demo and no longer set. An old one may remain in your browser for up to a year.
• Local storage. Holds your setups, and remembers small choices such as dismissing the install banner or the passkey prompt, and the PIN that opens the wallet’s Customize panel on this device. If you turn on the wallet’s app lock, its settings and a one-way hash of its password are kept here too, on this device only, and are cleared when you sign out. Fingerprint or Face ID unlock uses your device’s own authenticator: your biometric data never leaves your device and is never sent to us.
• Session storage. Used by our error monitoring to group the events from one visit into a single replay.
• Offline cache. The wallet installs a service worker that stores app files on your device so it works offline.

Our web analytics do not use cookies or local storage. You can block or delete cookies and site data in your browser. If you block sign-in cookies, you will not stay signed in, and clearing site data deletes any setups that were not synced to an account.

8. How long we keep it

• Account, profile, setups, wallet handle, transfers and push subscriptions: until your account is deleted. Deleting an account removes these records. A push subscription is also removed when your browser reports that it has expired.
• Billing records, including copies of Stripe notifications, to meet tax and accounting law. Stripe keeps its own records under its policy.

When we no longer need information, we delete it or make it anonymous. We may keep information longer if the law requires it or if we need it for a legal claim.

9. Your rights

Wherever you live, you can ask us to access, correct or delete the personal information we hold about you. Depending on where you live, you may also have the right to:

• receive a copy of your information in a portable format;
• object to processing based on legitimate interests;
• restrict how we use your information while a concern is resolved;
• withdraw consent at any time (this does not affect what we did before);
• not be discriminated against for exercising your rights.

Some of this you can do yourself:

• edit your profile, password and passkeys in your account settings;
• switch marketing email on or off in your account settings or any marketing email;
• export any saved setup as a file from the app’s Customize panel;
• stop accepting transfers in the wallet, which also hides your handle from search, and turn wallet notifications off;
• update payment details, see invoices or cancel a subscription in the billing portal.

To delete your account or make any other request, email [email protected] from the address on your account. We may ask for more information to confirm it is you. We will reply within 30 days (one month in the EU and UK), and tell you if we need longer. We do not charge for requests unless they are clearly unfounded or excessive. An authorised agent can make a request for you with written permission.

If you are not happy with our response, you can complain to a regulator. In Australia, that is the Office of the Australian Information Commissioner (oaic.gov.au). In the UK, it is the Information Commissioner’s Office (ico.org.uk). In the EU, it is the data protection authority where you live or work. We would appreciate the chance to fix the problem first.

10. Children

Larpify is not directed at children. You must be at least 16 to create an account, or have a parent or guardian’s consent, and children under 13 must not use the Service. If you believe a child under 13 has given us personal information, email [email protected] and we will delete it.

11. Security

We use encryption in transit (HTTPS), access controls that limit each user to their own records, hashed passwords, single-use sign-in links, signed unsubscribe links, and limited admin access with an audit log. No system is perfectly secure. If a data breach is likely to cause you serious harm, we will notify you and the relevant regulator as the law requires.

12. Changes to this policy

We will post any changes on this page and update the date at the top. If a change is significant, we will also email the address on your account before it takes effect.

13. Contact

Email [email protected]. See also our Terms of Use.