Effective Date: May 18, 2026
NovaEventus ECM, LLC — doing business as QuothGM
QuothGM does not sell your data. QuothGM does not serve advertisements. Your campaigns are private. These are not policies subject to change — they are the foundation of how this product was built.
1. Who We Are and How to Reach Us
QuothGM is operated by NovaEventus ECM, LLC, a Washington State company. If you have any questions about your privacy, email us.
This Privacy Policy describes how NovaEventus ECM, LLC, a Washington limited liability company doing business as QuothGM ("QuothGM," "we," "us," or "our"), collects, uses, stores, and protects personal information in connection with the QuothGM application and website at quothgm.com (the "Service").
This policy applies to all users of the Service, including Game Master subscribers, player account holders, and visitors to quothgm.com.
Contact for privacy matters: info@quothgm.com. Mailing address: NovaEventus ECM, LLC / QuothGM, PO Box 29, Loon Lake, WA 99148.
2. Information We Collect
We collect only what we need to run the service. We measure traffic on our public marketing pages and nowhere else — once you sign in, nothing measures how you use the app.
2.1 Information You Provide Directly. Account registration: your email address and, if you are a GM subscriber, payment information required to process your subscription. Payment card data is processed and stored exclusively by Stripe, Inc. — QuothGM does not store your card number, expiration date, or security code.
2.2 Profile Information. You may optionally provide a display name, pronouns, biography, and avatar image. This information is visible to other users within campaigns you participate in.
2.3 User Content. Worlds, campaigns, adventures, sessions, codex entries, session log entries, character information, player notes, and images you upload are stored on your behalf. This content is yours.
2.4 Cookies and Session Data. QuothGM sets session cookies to keep you signed in. These are strictly necessary — without them the Service cannot tell who you are — and they cannot be switched off while you are using an account. We set no advertising cookies, no third-party tracking cookies, and no analytics cookies. The marketing measurement described in 2.6 uses no cookies of any kind.
2.5 Browser Storage. QuothGM keeps a small amount of interface state in your browser. None of it is your content, and none of it identifies you. There are four items: your light or dark appearance choice, mirrored from your account so the correct appearance is drawn before the page appears; a marker recording that you dismissed the "set a password" banner; a short-lived note that carries invitation warnings from the quickstart form to the confirmation message and then deletes itself; and a marker recording that you dismissed the quickstart prompt, kept only for the current browser session. Clearing your browser storage loses none of your data — everything above is either a preference stored on your account or a temporary convenience.
2.6 Marketing-Page Analytics. On our public marketing pages — the home page, features, pricing, blog, and similar pages you can reach without signing in — we use Vercel Web Analytics to count visits and understand which pages bring people to QuothGM. Its purpose is marketing measurement, and it is limited to those pages. This measurement sets no cookies and stores nothing on your device. You are not identified by name or account: Vercel derives a hash from the incoming request, and that hash is discarded after 24 hours. It cannot follow you to other websites and cannot reconstruct your activity across visits. For each page view it may record the time, the page address and its route pattern, the page that referred you, filtered query parameters, an approximate location derived from your network address (country, region, and city), your device type, operating system and browser with their versions, and the version of the measurement script. Vercel processes this for us as our processor.
2.7 Public Codex Pages Are Excluded. A Game Master can publish individual codex entries to a public address. Those addresses contain the names of their world and their entry, which is their content rather than our marketing data, so we deliberately exclude public codex pages from the measurement described in 2.6. No page view for a public codex entry is recorded.
2.8 Inside the Application. Once you sign in, none of section 2.6 applies. QuothGM runs no analytics inside the application. There are no tracking pixels, no session recording, no heatmaps, no behavioural profiling, and no measurement of which features you use or how you move through the app. The Game Master, player, and account areas load no analytics software at all. This is how the application is built, not a setting we have chosen to leave switched off.
2.9 Server Logs. Our hosting provider, Vercel, automatically collects standard web server log data, which includes network addresses and request details, as a necessary part of delivering the Service and keeping it secure. We do not use this data for marketing or behavioural tracking.
2.10 What We Do Not Collect. We do not sell, rent, or trade your personal information to any third party, for any purpose. We serve no advertisements and have no advertisers. We do not build behavioural profiles and we do not track you across other websites. Apart from the marketing-page measurement described in 2.6, we do not collect data about which features you use or how you navigate the Service.
3. Operational Records
To run the service we keep a few records about accounts rather than about content — when you last signed in, your account standing, and a log of support and safety actions. These are visible only to QuothGM administrators.
3.1 What This Covers. Running the Service requires keeping a small number of records about accounts rather than about creative content. They exist so the Service can be operated, supported, and kept safe. They are visible only to QuothGM administrators, and they are described here so that you know they exist.
3.2 Account Activity. We record the time you last signed in. It tells us whether an account is still in use and helps us assist you if you report a problem.
3.3 Aggregate Counts. Our administrative view shows totals across the whole Service — for example how many accounts exist, how many subscriptions are in trial, and how many support items are open. These are counts. They are not lists of what any individual did.
3.4 Account Standing. We record your account's standing, your role, your subscription tier, and any administrative note attached to your account — for example a note recording that an account has been restricted under the Acceptable Use Policy. You may request a copy of any note held about your account by emailing info@quothgm.com.
3.5 Support and Safety Records. When an administrator takes a support or trust-and-safety action, we record what was done, when, and by whom. Where an action concerns a specific piece of content, the record may include a short excerpt of that content — enough to identify which item was acted on.
3.6 Notification Records. When we send a campaign digest email we record that it was sent, to which account, for which campaign, and how many updates it covered, so that the same digest is not sent to you twice.
4. How We Use Your Information
We use the information we collect only to run the service, communicate with you about your account, and keep the platform secure.
QuothGM uses the information we collect only to: create and manage your account; process subscription payments through Stripe; deliver the Service — storing, displaying, and managing your content; send transactional communications (account verification, billing notices, campaign invitations); send optional communications you have consented to (which you may opt out of independently); respond to support requests; detect and prevent fraud and security incidents; and comply with applicable legal obligations.
We do not use your content — your worlds, campaigns, codex entries, or any other creative material — for any purpose other than providing the Service to you and the users you authorize.
6. Your Content and Privacy
Your campaigns are private by default. Only you and the players you invite can see your campaign content. The personal notes a player takes are private to them — not even the GM can read them. Notes a player chooses to send through Pass a Note are moderated by the GM.
6.1 Campaign Privacy. All campaign content is private by default and accessible only to the subscribing GM and the players they explicitly invite. QuothGM staff do not access campaign content except as necessary to respond to a support request you have initiated, to investigate a reported Terms of Service violation, or as required by law.
6.2 Player Notes. The personal notes a player takes within a campaign are private to that player — not accessible to the GM, to other players, or to QuothGM staff in the ordinary course of operations. This does not apply to a note a player chooses to send through the Pass a Note feature: a note sent to the GM is readable by that GM, and a note sent to another member is readable by the recipient and by the GM who runs the session (the GM moderates notes passed between players). A passed note cannot be edited or unsent after it is sent.
6.3 Public Codex Entries. A GM may choose to mark individual codex entries as publicly accessible. Public entries are accessible via a shareable URL to anyone who has that URL and may be indexed by search engines. The GM is solely responsible for the content of any entry they make public.
6.4 Uploaded Images. Images are stored in a cloud storage bucket configured for public read access. Any user who obtains the direct URL to an uploaded image can view it without authentication. GMs should be aware of this when uploading sensitive or proprietary imagery.
6.5 How We Treat Your Content. We do not read your content to produce analytics, to sell or serve advertising, or to train artificial-intelligence models. We do not sell your content and we do not share it with anyone outside the service providers listed in section 5, who process it only to deliver the Service. QuothGM administrators can access content where it is necessary for trust-and-safety purposes — investigating a report, responding to a support request you have made, or complying with a legal obligation — and administrator access is limited to those purposes.
7. Data Retention
Your data stays in your account for as long as your account exists. If you delete your account, your personal data is permanently deleted within 30 days.
7.1 Active Accounts. We retain your personal information and user content for as long as your account remains active.
7.2 Lapsed Subscriptions. If your GM subscription lapses, your account transitions to a read-only state. Your data is retained indefinitely and is not deleted. You may restore full access by resubscribing.
7.3 Account Deletion. Upon your request to delete your account, your personal information and user content will be permanently deleted within thirty (30) days. Content you contributed to another GM's campaign will be retained in anonymized form.
7.4 Legal Retention. We may retain certain records for longer periods as required by applicable law or for fraud prevention and dispute resolution.
8. Your Rights and Choices
You have real control over your data. You can update your profile, request a copy of your data, delete your account, and manage your email preferences.
8.1 Access and Correction. You may update your display name, pronouns, biography, avatar image, and email address directly through your account settings at any time.
8.2 Data Export. You may request a copy of your personal data by emailing info@quothgm.com. We will deliver your data within seven (7) to ten (10) business days.
8.3 Account Deletion. You may request deletion of your account by emailing info@quothgm.com. Account deletion is permanent and cannot be undone.
8.4 Email Preferences. You may opt out of optional email communications through your account settings page. Transactional emails cannot be opted out of while your account is active.
8.5 Do Not Track. QuothGM does not engage in behavioural tracking and serves no targeted advertising. The only measurement we run is the aggregate marketing-page count described in section 2.6, which sets no cookies, follows no one between sites, and discards its identifier within 24 hours. Because there is no cross-site tracking to switch off, we do not respond to browser Do Not Track signals.
9. Data Security
Your data is protected by database-level access controls — each user can only access their own data. We will notify you promptly if we become aware of a breach.
9.1 Security Measures. QuothGM implements industry-standard security measures including database-level row security controls that isolate each user's data, encrypted data transmission via HTTPS, and access controls limiting staff access to user data.
9.2 No Absolute Guarantee. No security system is impenetrable. In the event of a data breach affecting your personal information, we will notify you as required by applicable law.
9.3 Your Responsibility. You are responsible for maintaining the security of your account credentials. Notify us immediately at info@quothgm.com if you suspect unauthorized access.
10. Children's Privacy
QuothGM is for adults only. We do not knowingly collect information from anyone under 18.
The Service is intended for users who are at least eighteen (18) years of age. We do not knowingly collect personal information from anyone under eighteen. If we become aware that we have collected information from a minor, we will promptly delete it. Contact us at info@quothgm.com if you believe we have inadvertently collected information from a minor.
11. California Privacy Rights (CCPA)
California residents have specific rights under California law. We do not sell your data, which satisfies the most significant of these rights.
11.1 Right to Know. You may request disclosure of the categories of personal information we have collected and the purposes for which we use it. This Privacy Policy provides that disclosure. You may also submit a specific request to info@quothgm.com.
11.2 Right to Delete. You may request deletion of personal information we have collected. Email info@quothgm.com.
11.3 Right to Opt Out of Sale. QuothGM does not sell personal information. No opt-out mechanism is required.
11.4 Right to Non-Discrimination. We will not discriminate against you for exercising your CCPA rights.
12. Rights in the European Economic Area, the United Kingdom, and Switzerland
If you are in the EEA, the UK, or Switzerland: NovaEventus ECM, LLC is the controller of your personal data, your data is processed in the United States under Standard Contractual Clauses, and you have rights of access, correction, deletion, portability, and objection — plus the right to complain to your national regulator.
12.1 Data Controller. The controller of your personal data is NovaEventus ECM, LLC, doing business as QuothGM, PO Box 29, Loon Lake, WA 99148, United States. You can reach us about any matter in this section at info@quothgm.com.
12.2 Lawful Bases for Processing. We process your personal data on the following bases. Performance of a contract: creating and managing your account, delivering the Service, processing your subscription through Stripe, and sending transactional messages about your account. Legitimate interests: keeping the Service secure, preventing fraud and abuse, enforcing our Acceptable Use Policy, and measuring traffic to our public marketing pages in aggregate — we have considered these against your interests and rights, and you may object as described in 12.4. Consent: optional marketing emails, which you may withdraw at any time from your account settings without affecting the lawfulness of what came before. Legal obligation: retaining records where the law requires it and responding to valid legal process.
12.3 International Transfers. QuothGM is operated from the United States and your personal data is processed there. The United States has not received an adequacy decision from the European Commission or the UK government, so transfers rely on the safeguards below. Vercel, Inc., our hosting and analytics provider, acts as our processor under Standard Contractual Clauses and has certified to the U.S. Department of Commerce that it adheres to the EU-U.S. Data Privacy Framework, including the UK Extension and the Swiss-U.S. Data Privacy Framework. Supabase, Inc., our database and file-storage provider, acts as our processor under Standard Contractual Clauses, together with the UK International Data Transfer Addendum and the Swiss addendum; Supabase does not rely on a Data Privacy Framework certification. Stripe, Inc. and Resend, Inc. are also United States companies and process personal data for us under their own published data processing terms. You may request a copy of the transfer safeguards that apply to you by emailing info@quothgm.com.
12.4 Your Rights. Subject to the conditions and exemptions in applicable law, you have the right to: obtain confirmation of whether we process your personal data and request a copy of it; have inaccurate data corrected; have your data erased; restrict how we process it; object to processing carried out on the basis of our legitimate interests, including the marketing-page measurement described in 2.6; receive the data you provided to us in a structured, commonly used, machine-readable format and have it transmitted to another controller where technically feasible; and withdraw consent at any time where processing is based on consent. We do not make decisions producing legal or similarly significant effects about you by automated means, and we do not carry out profiling.
12.5 How to Exercise Your Rights. Email info@quothgm.com. We will respond within one month and may extend that period by two further months for complex requests, telling you if we do. The routes in sections 8.2 and 8.3 — data export within seven to ten business days, and account deletion within thirty days — remain available to you and are usually faster.
12.6 Complaints. If you believe we have handled your personal data unlawfully, you may lodge a complaint with the supervisory authority in the country where you live or work, or where you believe the problem occurred. In the United Kingdom this is the Information Commissioner's Office; in Switzerland it is the Federal Data Protection and Information Commissioner. We would appreciate the chance to address your concern first, but you are not required to contact us before complaining.
[TO BE COMPLETED BEFORE PUBLICATION — Article 27 representative. QuothGM has no establishment in the European Economic Area or the United Kingdom. Whether a representative must be appointed under Article 27 of the UK and EU GDPR, and if so who it is and how to contact them, is a question with counsel and is not answered in this draft. This bracketed paragraph must be replaced or deliberately removed before this policy is published.]
13. Changes to This Policy
Material changes get 30 days' notice through your account page and the login page.
We reserve the right to update this Privacy Policy at any time. For material changes, we will provide no less than thirty (30) days' advance notice. Your continued use of the Service after the effective date constitutes acceptance of the revised policy.
14. Contact
Questions about this policy or your data? Email us.
For questions or concerns about this Privacy Policy, to exercise your data rights, or to report a privacy concern: NovaEventus ECM, LLC / QuothGM, PO Box 29, Loon Lake, WA 99148. Email: info@quothgm.com.
QuothGM — Privacy Policy — NovaEventus ECM, LLC — quothgm.com/privacy