Who we are
This policy explains what personal data MaxLarp collects when you use maxlarp.com, the studio and its companion apps, and how we use it. It takes effect on October 19, 2026. MaxLarp is the controller of this data. Contact: hello@maxlarp.com.
What we collect
- Account: your email address and a securely hashed password.
- Your work: personas, dashboards, settings, schedules and the photos and media you upload.
- Purchases: the plan you bought, its period, price, status and the reference numbers from our payment providers, Card and payment details are collected by SellAuth or Stripe; we never receive your full card number.
- Devices: when you turn on notifications or install a phone or desktop companion app, the push subscription or device token needed to deliver them.
- Usage and security: technical data our hosting provider records when you visit (such as IP address, browser and pages requested), and, if you are part of a landing page test, a random visitor ID with the page views, plan clicks and purchases attributed to that test.
What we do not collect
We never ask for, connect to or store logins for any real bank, card, wallet, exchange, store or social account. We do not use advertising trackers or third-party analytics, and we do not sell or rent personal data.
How we use it
To provide the Service (sign-in, saving and syncing your work across devices, sending the notifications you schedule), to process payments and give access to what you bought, to prevent fraud and enforce our Terms and Acceptable Use Policy, to improve the site, to answer you, and to meet legal obligations. Our legal bases are performing our contract with you, our legitimate interests in running and protecting the Service, your consent where we ask for it, and legal obligations.
Cookies and storage on your device
We use only cookies and browser storage needed to run the Service: sign-in session cookies, a checkout cookie that lets a buyer who paid before creating an account claim that purchase (up to 7 days), and a landing-test cookie that keeps the version of the home page you see consistent (up to 90 days). The studio also keeps preferences and caches in your browser's local storage and IndexedDB so it loads quickly. You can clear these in your browser settings; some features will stop working.
Who we share it with
Service providers that process data for us under contract: Supabase (database, sign-in and file storage), Vercel (hosting), Cloudflare (media storage), SellAuth and Stripe (payments), Google (if you use Google sign-in) and Apple and Google push services (to deliver notifications). We also share data when the law requires it, to protect rights, safety and the Service (including with payment providers and law enforcement about fraud or misuse), and with a buyer or successor if MaxLarp is sold or merged.
These providers may process data outside your country, including in the United States. Where required, we rely on appropriate safeguards such as standard contractual clauses.
How long we keep it
Account data and your work: while your account is open, and deleted within 30 days of an account deletion request, apart from backups that expire on their normal cycle. Purchase records: as long as tax, accounting and anti-fraud obligations require. Push subscriptions: until you turn notifications off or the subscription expires. Landing-test data: until the test ends and its results are analysed. Hosting logs: for the provider's short retention period.
Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal data, to object to or restrict some processing, and to withdraw consent. Email hello@maxlarp.com from your account address and we will respond within 30 days. You may also complain to your local data protection authority. California residents: we do not sell or share personal information for cross-context behavioural advertising.
Security and children
We use encryption in transit, access controls and reputable providers to protect your data, but no system is perfectly secure. The Service is for adults only; we do not knowingly collect data from anyone under 18 and will delete it if we learn we have.
Changes
We will post any update here with its effective date and tell you by email or in the Service if the change is material.