StoryForge Pledges

Privacy Policy

Effective 2026-06-28

StoryForge Pledges helps tabletop creators run their Kickstarter pledge manager. This document explains what personal information we handle, why, and the rights you have over it.

1. Who we are

StoryForge Pledges is operated by The Arcane Gate Ltd (the "platform", "we", "us"), trading as StoryForge at storyforgerpg.com. Contact: james@storyforgerpg.com.

2. Who this applies to

Two distinct audiences interact with the platform, and we handle their data differently:

Creators — tabletop publishers who use StoryForge Pledges to manage their campaigns. We act as a data controller for the personal information you give us about yourself when you sign up and use the admin product.
Backers — the people who pledged on Kickstarter for a creator's project. The creator is the data controller for backer personal data, and StoryForge Pledges acts as their data processor. The terms of that relationship are set out in our Data Processing Agreement.

3. What we collect from creators

When a creator signs up and uses the admin product, we collect:

Account information — name, email address, authentication tokens (handled by our identity provider Clerk). Optionally: brand name, logo, payout details.
Campaign metadata — Kickstarter project slug, currency, reward tier titles and prices, item catalog, add-on configuration, fulfillment status.
Usage data — pages viewed, actions taken, error reports. Used to improve the product. We do not run third-party advertising trackers.
Payment data — handled by Stripe. We store only the last four digits of any card on file plus a Stripe customer ID. Full card numbers never touch our servers.

4. What we collect about backers

Backer personal information is imported either from a CSV the creator exports from Kickstarter, or (optionally) by a one-time read of the creator's Kickstarter account when the creator chooses to use the Kickstarter-connect flow. The data we receive about each backer typically includes:

Name and Kickstarter username
Email address (sometimes a Kickstarter private-relay address)
Pledge amount, reward tier, add-on selections
Shipping address (if the creator collected one)
Backer notes the creator chose to import

We do not receive credit-card information from Kickstarter. Backer payment is handled separately by Stripe under the creator's account when (and only when) the creator triggers a post-campaign charge.

5. Why we process this data

To provide the service — running the admin product, hosting public campaign pages, sending surveys, processing charges, generating shipping manifests.
To communicate with you — transactional emails (e.g. survey invitations, shipment notifications), and product updates if you opt in.
To secure the service — abuse detection, rate-limiting, audit logging.
To comply with the law — tax records, fraud investigations, court orders.

Our lawful bases under GDPR are: performance of a contract (with the creator), the creator's legitimate interests (for backer data they direct us to process), legal obligation (tax/AML), and consent (where required, e.g. marketing opt-in).

6. If you connect Kickstarter

Kickstarter does not offer a public API for pledge data. If a creator chooses to use the Kickstarter-connect flow instead of CSV upload, they hand us their Kickstarter credentials for a one-time, single-use authentication to fetch backer data and reward images. We do not store the credentials at rest. We do not re-use them for any other purpose. We do not share them with any third party.

See the Security Overview for the technical details of how credentials are handled, and the Terms of Service for the creator's authority to delegate access to their account.

We share data only with the third parties on our public sub-processor list, and only as needed to provide the service. We do not sell personal information. We do not share backer data with Kickstarter, with other creators, or with marketing networks.

8. How long we keep it

Active campaign data — for the lifetime of the creator's account.
Closed campaign data — kept for 7 years to support tax/legal queries, then deleted or anonymised.
Backer survey responses — until the creator deletes their campaign, or for 30 days after a verified backer deletion request.
Audit logs — 12 months.

9. Your rights

Depending on where you live, you have the right to access, correct, export, restrict, or delete personal information we hold about you, and to object to certain processing. Backers should use our Backer Rights page. Creators can email james@storyforgerpg.com.

We respond within 30 days. If your request relates to data we hold as a processor on a creator's behalf, we will forward it to the relevant creator (the controller).

10. International transfers

StoryForge Pledges operates from the United Kingdom. Our infrastructure providers (see the sub-processor list) may store or process data in the United States and the European Economic Area. Where data leaves the UK or EEA, we rely on the European Commission's Standard Contractual Clauses and on the UK Addendum to those Clauses.

11. Security

See the dedicated Security Overview for our technical and organisational measures.

12. Children

StoryForge Pledges is not directed to children under 16. We do not knowingly collect personal information from children. If you believe we have, please contact us and we will delete it.

13. Changes to this policy

We will notify you of material changes by email and by updating the "Effective" date at the top of this page. Continued use of the service after a change means you accept the updated version.

14. Contact & complaints

Privacy questions: james@storyforgerpg.com. If you are in the UK or EEA and are unhappy with how we have handled your data, you have the right to complain to a supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk).