GG Medium — Privacy Policy

_Last updated: October 29, 2026_

1. Who we are (data controller)

GG Medium is a sole proprietorship operated by Syfy Jones-Harrell, of Durham, North Carolina. GG Medium is the data controller responsible for the personal information described in this policy, collected through the interactive-story platform at ggmedium.com (the "Service").

For any privacy question or request, contact us at: mark@ggmedium.com

This policy explains what personal information we collect, the purposes for which we use it, how long we keep it, the processors that handle it on our behalf, and the rights you have over it.

2. Information we collect and why

We collect only the categories of information needed to operate the Service, for the purposes stated:

2.1 Account information. Your email address and your password, collected when you register. Passwords are stored only as cryptographic hashes (see Section 6); we never store or have access to your plain-text password. _Purpose:_ creating and securing your account, authenticating you, and communicating with you about your account.

2.2 Story and session data. Your story progress, saved games, choices, the actions you type into a story ("write-ins"), and — for creators — the stories you create and publish. _Purpose:_ providing the Service: saving your place, generating your stories, and hosting creator content. When you play, the relevant story context and the actions you type are transmitted to our AI (large language model) provider solely so it can generate the next part of your story.

2.3 Subscription and billing status. Whether you hold an active GG Medium Subscription, and the billing records our payment processor sends us (such as amount, date, and payment status). _Purpose:_ managing your subscription and our accounting records. We never receive, collect, or store your card number or other full payment-card details — those are provided by you directly to Stripe (Section 5).

2.4 Basic technical logs. Routine server records such as IP address, browser and device type, timestamps, and error records. _Purpose:_ operating and securing the Service, diagnosing problems, and preventing abuse and policy violations.

We do not collect any categories of personal information beyond those listed above, and we do not use your information for advertising or marketing profiling.

3. What we do not collect or do

• No card data. Payments run entirely through Stripe. Your card details go to Stripe and never touch GG Medium's servers.
• No sale or sharing of personal information. We do not sell your personal information, and we do not share it for cross-context behavioral advertising or any other advertising purpose, as those terms are used in the California Consumer Privacy Act (CCPA) and similar laws. You do not need to opt out, because it does not happen.
• No third-party tracking. We do not use advertising trackers, analytics cookies, or cross-site tracking technologies.

4. Cookies

We use one essential session cookie, which keeps you signed in to your account. That is the only cookie the Service sets. Blocking it will simply sign you out. Because we use no advertising or analytics cookies, we do not present a cookie-consent banner.

5. Service providers (processors)

We use a small number of service providers, each of which processes personal information only as needed to provide its part of the Service, under its own terms and privacy commitments:

• Stripe — payment processing and subscription billing. Stripe receives your payment-card details and billing information directly from you and processes payments on our behalf.
• Fly.io — application hosting and database infrastructure. Account, story, and session data are stored on Fly.io infrastructure.
• Our AI (LLM) provider — story generation. Story context and the actions you type are transmitted to this provider solely to generate your story text.

We do not disclose your personal information to any other third parties except (a) with your direction, (b) to comply with a legal obligation or lawful request, or (c) to enforce our Terms of Service and protect the Service, our users, or the public, as permitted by law.

6. Security

We use measures appropriate to the size and nature of the Service to protect your information, including:

• Hashed passwords. Passwords are stored using the scrypt key-derivation function; plain-text passwords are never stored.
• Encrypted transport. Connections to the Service are encrypted in transit (HTTPS/TLS).
• Payment isolation. Card data never touches our servers; payment processing is handled entirely by Stripe.
• Limited access. Access to account data is limited to what is necessary to operate the Service.

No system is perfectly secure, and we cannot guarantee absolute security; we will notify affected users of a data breach where required by applicable law.

7. Retention

• Account data (account information, story and session data, subscription status) is retained for as long as your account remains active, because the Service cannot preserve your stories without it.
• Deletion. When you delete your account — through the in-app deletion option or by request under Section 8 — your account, saved stories, and associated personal information are deleted within thirty (30) days, except: (a) records we are legally required to retain (for example, transaction and tax records), (b) records held by Stripe under its own retention obligations, and (c) limited archival copies that persist in routine backups until those backups cycle out, after which they are deleted in the ordinary course.
• Technical logs are kept only as long as reasonably needed for security, operations, and abuse prevention, and are then deleted or de-identified.

8. Your privacy rights

Subject to applicable law, you have the right to:

• Access the personal information we hold about you, and receive an explanation of how it is used.
• Correct inaccurate or incomplete personal information.
• Delete your account and personal information, as described in Section 7.
• Portability. Creators may export their stories and content from the Service at any time; you may also request a copy of your personal information in a commonly used format.
• Non-discrimination. We will not discriminate against you for exercising any of these rights.

To exercise any of these rights, email mark@ggmedium.com from the address associated with your account (or use the in-app account deletion option for deletion). We will respond to verified requests within thirty (30) days, and sooner where the law requires. We may ask you to verify your identity (for example, by confirming control of the account email address) before fulfilling a request, to protect your information from unauthorized disclosure.

9. Children's privacy

The Service is not directed at children under 13, and we do not knowingly collect personal information from children under 13. One part of the Service — the "Demon" path — is adult-oriented and is restricted to users who confirm they are 18 or older, as set out in the Terms of Service. Sexual content involving minors is prohibited everywhere on the Service and is blocked and refused. If you believe a child under 13 has provided us personal information, contact mark@ggmedium.com and we will delete it promptly upon verification.

10. Changes to this policy

If we change how we handle your information, we will update this page and revise the "last updated" date above. For material changes, we will make a reasonable effort to notify account holders by email or in the Service before the change takes effect. Your continued use of the Service after a change takes effect constitutes acknowledgment of the updated policy.

11. Contact

GG Medium

Syfy Jones-Harrell, Durham, North Carolina

Privacy requests and questions: mark@ggmedium.com