Privacy on the pilot server
This notice applies to accounts and sessions on the server we run for the pilot tables. The website has its own privacy policy, and other Taleward servers have the notice of whoever runs them.
As of 23 October 2026.
Which server
The pilot server is reachable at taleward.taleward.org. It hosts the campaigns of the pilot tables.
Controller
Benjamin Welk, Goldacker 7, 58675 Hemer, Germany. Email: info@taleward.org
What is stored
For your account: username, your password only as a one-way check value, and if you like an email address for account purposes. For your campaign: recordings of the session with the voices of everyone at the table, the transcript, the chapters, the campaign bible, characters, comments and dates. A voice profile is optional; then only a voiceprint is stored, not the recording, and it never leaves the server.
Recording only happens when every person at the table has agreed themselves. The game master cannot do that for others.
What for
So that a transcript and a chapter come out of the recording and your group can read it. During the pilot we also learn from your feedback what we need to improve. Whatever of it we publish appears without names.
The legal basis is your consent (Art. 6(1)(a) GDPR), and for the optional voiceprint your explicit consent (Art. 9(2)(a) GDPR). You can withdraw it at any time; whatever was processed until then remains lawful.
How long
The server deletes recordings as soon as the game master releases the chapter, at the latest after 7 days. Whoever extends the period has to ask everyone at the table to agree again.
Transcript, chapters and campaign stay until the game master deletes them or you delete your account. That also applies after the pilot ends: accounts and campaigns stay on the server.
Cloud
The cloud stays off until the game master switches it on for their campaign; everyone at the table can see that it is on. Then Mistral in the EU takes over the transcript and the chapter. Without the cloud, a worker that we run ourselves processes the session.
The provider is Mistral AI, 15 rue des Halles, 75001 Paris, France. Processing takes place in the EU. A data processing agreement with Mistral is in place, and training on our data is switched off.
Who has access
In the app, only you and your group see your campaign, and only the game master sees the game master’s secrets. As the operator of the server we could technically see the data. We only look if you ask us to because something went wrong. The server administration shows accounts, queue and costs, but no campaign content.
Only Benjamin Welk has access to the server, as its operator and administrator.
Processors
Server host: netcup GmbH, Emmy-Noether-Str. 10, 76131 Karlsruhe, Germany. The server is located in Nuremberg.
Cloud, only when switched on for the campaign: Mistral AI, Paris, France (see above).
Email to us: mailbox.org (Heinlein Hosting GmbH, Schwedter Straße 9a, 10119 Berlin, Germany), processing only in the EU.
Deleting
You delete your account and your own data in the app under “Account” → “Delete data and account”. The game master can delete a whole campaign including all files. If you like, we delete everything that was created for your table; just write to us.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability and objection (Art. 15 to 21 GDPR). You can withdraw consent at any time for the future. Write to the address above.
You can also lodge a complaint with a data protection authority, for example the State Commissioner for Data Protection and Freedom of Information of North Rhine-Westphalia (LDI NRW).