Privacy
Who else touches your data
The whole list of anyone other than Kaperkunde involved in running Lore Spawner, and what each of them is for. It is short on purpose.
Effective date: 21 September 2026
Provider: Kaperkunde
KVK number: 42061326
Address: Prof. E.M. Meijerslaan 1, Amstelveen, The Netherlands
Privacy/GDPR requests: privacy@kaperkun.de
This list names everyone other than Kaperkunde who touches Lore Spawner data, and what each one is for. Company-wide subprocessors are listed in §5.1 of the Privacy Policy; the ones below are Lore Spawner's own.
It is a short list on purpose. Everything the service is made of — the database, the GraphQL API, the mail server, the app itself — is Kaperkunde's own software, running on servers Kaperkunde rents. Nothing is delegated to a platform.
Current subprocessors
| Subprocessor | Purpose | Location / notes |
|---|---|---|
| Hetzner Online GmbH | The servers Lore Spawner runs on: the application, the database, and outbound mail | European Union. The only processor with access to stored data. |
| Google (FCM) | Relaying push notifications to Chrome and Android browsers, where a player has turned them on | Relay only. The payload is encrypted to keys only that browser holds, so the service cannot read what it passes on. |
| Apple (APNs) | Relaying push notifications to Safari, where a player has turned them on | Relay only, on the same terms. |
| Mozilla (autopush) | Relaying push notifications to Firefox, where a player has turned them on | Relay only, on the same terms. |
The language model, where one is configured
Lore Spawner can be pointed at a language model, which is what lets a character be played by an AI and lets a player talk with one about a world. It is off unless the campfire has been given a model to use, and it is configured per deployment rather than built in — the app speaks the OpenAI-compatible protocol and nothing more particular than that, so the model may be one Kaperkunde runs on its own servers or one somebody else serves.
| Where the model runs | What it means for your data |
|---|---|
| On Kaperkunde's own servers | Nothing leaves the infrastructure already listed above, and there is no additional subprocessor. |
| Served by a third party | That provider receives the part of the world the AI is acting in and whatever you have said to it. They are a subprocessor, and this list names them before the feature is turned on. |
At the time of this list's effective date, no third-party model provider is in use. Turning one on is a change to this file in the same breath, because a list that did not name them would be untrue the moment the first request went out.
The three push services are named for completeness rather than because they hold anything. A push message is encrypted under RFC 8291 to a key pair generated by the player's own browser; the service is handed ciphertext and an address, and can read neither the message nor the account behind it. A player who never turns notifications on never reaches them at all.
What this list does not cover
An AI assistant a player connects themselves. Lore Spawner can be connected to an AI assistant over OAuth. That assistant acts as the player who allowed it, under limits they set, and what it does with what it reads is between them and whoever makes it. It is the player's relationship, not Kaperkunde's, and it is not a subprocessor of ours. A connection can be withdrawn at any time from the AI page in the account.
Changes to this list
Lore Spawner may add or replace subprocessors as needed to run the service. Where required by applicable data-protection law, Kaperkunde will give reasonable notice of material changes.
Adding one is a change to this file and to the Lore Spawner Privacy Notice in the same breath — the notice says there is one processor, and a second would make that untrue.
To ask questions or object to a material change, contact privacy@kaperkun.de.