Legal
Privacy notice
Last updated 24 September 2026
Who is responsible
Alexander Hili, trading as Goblin Forge, based in Malta, is the data controller for personal data processed through Goblin Forge. Contact: alex+goblinforge@hiliconsulting.eu.
What we collect and why
- Account data (email, display name, sign-in credentials or Google sign-in identifier): to create and secure your account. Basis: contract.
- Adventures and settings you create: to provide, save and sync the service. Basis: contract.
- Subscription and usage records (plan, billing dates, adventures used): to apply your allowance. Basis: contract and legal obligation.
- Technical data (IP address, device and browser details, logs, error reports): for security, fraud prevention and fixing problems. Basis: legitimate interests.
- Support messages: to answer you. Basis: contract and legitimate interests.
We do not sell your data or use it for advertising. Card details are collected by Paddle, not by us.
Who we share it with
- Service providers who host the app, the database and AI models that write adventures, acting on our instructions.
- Paddle.com, our Merchant of Record, for the sale of subscriptions, payments, subscription management, tax compliance and invoicing.
- Professional advisers such as lawyers and accountants.
- Authorities, where the law requires it.
International transfers
Some providers process data outside the EEA. Where they do, we rely on adequacy decisions or the European Commission's Standard Contractual Clauses.
How long we keep it
We keep account data and adventures while your account is open. Deleting your account removes them. Billing records are kept as long as tax and accounting law requires. Logs are kept for a short period. When data is no longer needed it is deleted or anonymised.
Your rights
Under the GDPR you can ask for access, correction, erasure, restriction, portability, and object to processing based on legitimate interests. Where we rely on consent you can withdraw it. Email alex+goblinforge@hiliconsulting.eu; we reply within one month. You can also complain to the Information and Data Protection Commissioner in Malta or your local supervisory authority.
Security
We use encryption in transit, access controls and per-account data isolation to protect your data.
Cookies and storage
We only use essential browser storage: to keep you signed in and to save adventures on your device. We do not use analytics or marketing cookies. Paddle may set cookies needed to run the checkout.