Privacy policy

Effective date: September 1, 2026

Privacy without static.

Inflict.io never sells or resells personal information for money, never rents customer lists, and never gives contact details to outside companies for their unrelated marketing. We use personal information only for Inflict.io storefront sales and service, the Scenario Manager, Inflict.io news and marketing, and the security and legal work needed to support those activities. We honor enabled Do Not Track and Global Privacy Control signals.

What this policy covers

This Privacy Policy explains how Inflict.io LLC ("Inflict.io," "we," "us," or "our") handles personal information when you use inflict.io, shop.inflict.io, the Inflict.io storefront, Scenario Manager, customer accounts, support, news, marketing, or related services. Personal information means information that identifies you or can reasonably be linked to you. It does not include anonymous or de-identified information.

Information we collect

What we collect depends on how you interact with Inflict.io and can include:

• Storefront and order information: name, email, billing and delivery details, items viewed or purchased, cart activity, order history, returns, and transaction status.
• Account and preference information: account identifiers, saved settings, marketing choices, and product or event interests.
• Communications: information you include in support requests, reviews, surveys, event registrations, or other messages to us.
• Scenario Manager information: scenario names, descriptions and private host notes; character names, descriptions, questionnaire prompts, public-template tags and publication status; submitted answers, current answer drafts, and host-only Quick Reference notes; host and recipient Shopify customer identifiers and email addresses; invitations, character claims, delivery and completion status; timestamps; and related security events.
• Device and usage information: IP address, approximate location, browser and device attributes, referring pages, cookie or similar identifiers, and interactions with our sites.

Shopify and payment providers process payment credentials needed to complete a sale. Inflict.io does not need to receive or store your complete payment-card number. We collect information directly from you, automatically from your browser or device, and from Shopify or another provider that helps us operate the storefront.

How we use personal information

Inflict.io limits its use of personal information to these purposes:

• Storefront sales and service: run carts and accounts; process payments, orders, delivery, returns, and refunds; provide customer support; and keep transaction records.
• Scenario Manager: create, organize, privately deliver, answer, display, and administer scenarios and character questionnaires; save in-progress answer drafts; create an optional AI summary when an eligible host requests it; verify hosts and recipients through Shopify accounts; and prevent invitation abuse.
• Inflict.io news and marketing: send news, event information, product updates, and offers about Inflict.io when you opt in or applicable law otherwise permits it.
• Support those activities: secure accounts and transactions, prevent fraud and abuse, troubleshoot our services, honor privacy choices, and meet legal or accounting obligations connected with operating Inflict.io.

We do not use your information to market unrelated third-party products. If we ever want to use personal information for a materially different purpose, we will provide any notice and obtain any consent required by law.

We do not resell personal information

Inflict.io never sells or resells personal information for money. We do not rent or exchange customer lists, and we do not provide your contact details to unaffiliated companies for their own direct marketing.

We disclose information only as needed to operate Inflict.io—for example, to Shopify and providers that support payments, hosting, database storage, email delivery, security, customer service, fulfillment, shipping, or returns, including Amazon Web Services for the Scenario Manager—or when you direct us to, when required by law, or when reasonably necessary to protect rights and safety. These operational disclosures do not give providers permission to use your information for unrelated purposes.

A scenario host can see invited player addresses, invitation status, completion status, claimed characters, submitted answers, and Quick Reference notes. Only hosts and restricted administrators can see Quick Reference notes. Players cannot see these notes. Only the player who wrote a saved answer draft can see it. Before a player claims a character, the player can see only the scenario and available character descriptions. The questionnaire then shows one question at a time. After completion, the player can review all questions and submitted answers. Restricted administrators can review stored scenario content, prompts, submitted answers, ownership, invitations, claims, security events, and last-observed account IP addresses.

When a host intentionally publishes a public character template, its character name, description, tags, and question prompts become available to signed-in hosts for search and import into their own scenarios. Public templates never include player identities, assignments, saved answer drafts, or submitted answers.

Some privacy laws define "sale," "sharing," or "targeted advertising" more broadly than an exchange for money. Shopify features can involve processing covered by those definitions. Where applicable, you can use Shopify's data-sharing opt-out or an enabled Global Privacy Control signal.

Do Not Track and Global Privacy Control

Inflict.io honors enabled Do Not Track (DNT) and Global Privacy Control (GPC) browser signals. When either signal is present, Inflict-owned code does not initialize optional analytics, marketing, or preference tracking. On the Shopify storefront, our shared code sends equivalent denials to Shopify's Customer Privacy API when available, and Shopify also handles GPC in regions configured for data-sale opt-outs.

Processing that is essential to a feature or transaction you request—such as sign-in, cart, checkout, payment, fraud prevention, security, or remembering a privacy choice—can continue. The inflict.io domain also publishes machine-readable GPC support and the EFF Do Not Track Compliance Policy under its /.well-known/ paths.

Cookies and marketing choices

The storefront uses necessary cookies and similar technologies for accounts, carts, checkout, security, and preferences. Where consent is required, Shopify's cookie banner controls non-essential categories. You can use the unsubscribe link in an Inflict.io promotional email or contact us to stop marketing. Opting out of marketing does not stop receipts, order updates, security notices, or replies to your requests.

Shopify, OpenAI, and service providers

Shopify powers shop.inflict.io and processes information needed to provide its storefront, account, checkout, payment, security, and related services. Shopify also processes some information for its own purposes. Review the Shopify Consumer Privacy Policy and use the Shopify Privacy Portal for information or choices concerning Shopify-controlled processing.

OpenAI processes questionnaire text only when a Survivor or Unlimited host confirms the one-time AI fill. Inflict.io sends submitted question-and-answer pairs and a one-way account pseudonym for abuse detection. We do not send character descriptions, host notes, player email addresses, raw account IDs, invitations, or current answer drafts. We set the OpenAI API request not to store the response. Inflict.io stores the Quick Reference in its AWS database. The host can edit it after the AI fill.

OpenAI states that it does not use business API inputs or outputs to train its models by default. OpenAI can keep limited abuse-monitoring logs under its API data controls unless a different approved retention control applies. Review OpenAI's Business Terms, Privacy Policy, and API data controls for its current practices.

Retention, security, and children

We retain personal information only as long as reasonably needed for the purposes above, including to complete orders, maintain records, honor choices, resolve disputes, prevent fraud, and comply with law. We use reasonable safeguards appropriate to the information, but no transmission or storage system is perfectly secure.

Scenarios, host notes, character questionnaires, public character templates, invitations, claims, answer drafts, submitted answers, and Quick Reference notes are configured to expire 365 days after their most recent creation, edit, template publication, invitation, claim, draft, answer, or Quick Reference activity. Related security audit records are configured to expire after 730 days. The last-observed account IP address shown to restricted administrators is stored in a separate encrypted record configured to expire 10 days after the observation. Database expiration is asynchronous, and deleted records can remain in encrypted operational recovery backups for up to 35 additional days. Authorized administrators may reset isolated development/test scenario data earlier; that control cannot select production data. The tool uses Shopify account checks, recipient-bound private links, encryption, sequential disclosure, content sanitization, restricted administration, and abuse and email limits.

Inflict.io is not directed to children, and we do not knowingly collect personal information from children below the age at which they can provide valid consent where they live. A parent or guardian can contact us to request a review.

Your privacy rights

Depending on where you live, you may have rights to access, correct, delete, or receive a copy of personal information; withdraw consent; object to or restrict processing; opt out of qualifying sale, sharing, targeted advertising, or direct marketing; and appeal a privacy-request decision. These rights can be subject to legal exceptions. We will not discriminate against you for exercising a privacy right and may verify a request as permitted by law.

Changes to this policy

We may update this policy when our services, providers, or legal obligations change. We will post the revised version here, update the effective date, and provide additional notice when required.

Contact Inflict.io

For privacy questions, requests, marketing opt-outs, or appeals, email support@inflict.io. This is the sole public contact for this policy.