Krakenworks
Privacy Policy
Effective October 10, 2026
Krakenworks website, Rules Bot, and Dungeon Inc. playtests
The public website and browser game are hosted through GitHub Pages. GitHub may process basic request information under its own privacy terms when serving the site. Rules Bot questions and playtest reports are sent to a Krakenworks-operated API through an encrypted tunnel. Cloudflare Turnstile processes anti-abuse signals under Cloudflare's privacy terms.
Rules Bot questions are stored for QA only when the question-sharing checkbox is selected. A tied bad-answer report stores its category and response ID. A Dungeon Inc. report stores the player-selected category and severity, report text, build, page, platform, and viewport after explicit consent. Krakenworks does not write names, email addresses, IP addresses, full user-agent strings, or citation/rulebook text to the feedback queue. Network providers may process IP addresses transiently to deliver and protect requests.
Feedback queue records are kept only while needed for playtest QA and are reviewed for deletion during regular queue maintenance. A reporter can request deletion by sending the receipt ID to admin@krakenworks.app. Do not submit private information, account details, private campaign notes, or copyrighted rulebook passages.
Piper Mail
Piper Mail is the website's name for the owner's private Google integration with Piper, a personal OpenClaw assistant. It uses explicitly authorized accounts and is not offered as a public service.
Information accessed
The Google authorization covers Gmail, Calendar, Contacts, Docs, Drive, Sheets, YouTube, and account identity. Granted permission does not mean a service is used. Gmail tasks may access messages, threads, sender and recipient information, labels, timestamps, and attachments. Calendar information is read for owner-requested tasks. Access is limited to explicitly authorized accounts and permissions. Google account passwords are not collected or stored.
How information is used
Authorized data is used for owner-requested mailbox tasks and Calendar reads, including requested summaries and records. Any action that sends messages or changes mailbox data is subject to the owner's task rules and approvals. Existing OAuth permissions do not replace those instructions or authorize unrelated actions.
AI processing and service providers
Google tool results enter OpenClaw's conversation and model context to perform requested tasks. Returned email and Calendar information may be processed by its configured AI model providers, which may include OpenAI and Anthropic, under their applicable service terms and configurations. No fixed provider retention period is promised here. Gmail data is not sold, used for advertising, or shared for unrelated purposes.
Storage and retention
OAuth credentials are stored in the owner's private, self-hosted environment using protected credential storage. Locally retained records may include authorization material, downloaded files, generated outputs, conversation transcripts and logs, scheduled-task instructions, review records, and task summaries. These records may contain Google information returned during tasks. Revoking Google access does not automatically erase previously retained records. No fixed retention or automatic deletion period is promised for transcripts, logs, or data held by model providers.
Security
Piper Mail uses Google OAuth rather than account passwords. Access is limited to approved accounts, requested scopes, and the owner's secured OpenClaw environment. Reasonable technical safeguards are used to restrict network, device, and credential access.
Google API Services User Data Policy
Piper Mail's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Your controls
The account owner can review or revoke access through Google Account third-party connections. The owner may separately request review and deletion of locally retained credentials, downloaded files, generated records, and related transcripts or logs. Provider-held records are subject to the provider's own retention and deletion controls.
Changes
This policy may be updated when the private integration's features, providers, or data practices change. The effective date will be updated when material amendments are published.
Contact
Questions about Piper Mail or this policy can be sent to admin@krakenworks.app.