Privacy
A plain-language summary for this server. Whoever runs it is responsible for it; if this server is open to the public, they should check it against the law where they are.
What is stored
- Your account: display name, email address, a securely hashed password (never the password itself), and whether you have confirmed your email.
- Sign-in sessions: a session cookie, plus the IP address and browser of each session, so you stay signed in.
- What you write: campaigns, entries, notes, sessions, clues, maps, pins and party journal posts, and who created them.
- Uploaded images: map images, stored on this server.
- Abuse protection: short-lived counters of sign-in, sign-up and reset attempts per IP address and per email address, deleted after a day.
- Backups: copies of all of the above, kept for 14 days by default.
Who can see it
Only members of a campaign can see it, and players only see what a DM has revealed. Other members of a campaign see your display name, and while you have it open, that you are online. The campaign owner sees members' email addresses. Nothing is sold or shared with anyone else, and there is no tracking or advertising.
If email is set up on this server, it sends invite links, email confirmations and password reset links, and nothing else.
Cookies
Only the ones needed to work: your sign-in session, and a setting that remembers when a DM is in player view. No analytics or tracking cookies.
Your rights
On your account page you can download everything you own as a file, and delete your account. Deleting it removes your account and the campaigns you own; in other people's campaigns, your journal posts and private notes are deleted and what you shared stays with the campaign's owner. Copies in backups disappear when those backups expire.