Privacy

Building a character needs no sign-in. A character made that way is stored in your browser and nowhere else — it does not reach a server, and clearing your browser data deletes it for good.

Signing in is what makes a character follow you to another browser, and it is the only way to sit at a campaign with other people.

Google is the only way in. When you sign in, Google hands this app four things and it keeps all four: an account id (Google’s own identifier for you), your email address, the display name on your Google account, and the web address of your Google profile picture.

Alongside those it stores the handle you go by here, the day the account was made, and the day it was last used. The handle is the only one of these that other people see. Your email address is used to tell you apart from everybody else and to show you which account you signed in with. Nothing is ever sent to it — there is no mail from this app at all.

Passwords are Google’s problem, not this app’s. It never sees one.

Signed in, this app stores the things you make with it: your characters, the campaigns you run — the chat, the documents, the credstick entries, the NPCs, the factions — and any portraits you upload. That is the app working, not a side effect of it.

Two smaller things live in your browser rather than on your account: which theme you picked, and an unsaved draft of a campaign document you were part-way through, kept so a closed tab does not lose your writing.

• At a campaign. Everybody at a table can see the table: the chat, the shared documents, the pinned faces, the credstick, and each other’s handles. The person running it sees more, because running a game requires it.
• A share link. A character you share by link can be read by anybody holding the link, without signing in. Those pages ask search engines not to index them and do not name your account, but a link is a link — anyone you send it to can send it on. Revoking it makes it stop working immediately.
• Software you authorise. An access token you issue lets a program act as you, within the permissions you tick when you make it. Deleting the token ends that at once.

Nobody else. Your data is not sold, not rented, not handed to advertisers, and not used to train anything.

The only cookies here are the ones that sign you in and keep you signed in. There is no cookie banner because there is nothing to ask you about — there is no advertising cookie, no tracking cookie, and nothing that follows you off this site. Signed out, nothing sets one at all.

The site includes Vercel’s Web Analytics, which counts visits without a cookie and without following anyone between websites. It records which page was opened and coarse details like country, browser and whether it was a phone. It is not tied to your account and it is not used to build a profile of you.

The app runs on Vercel. Accounts, characters and campaigns are stored in Amazon DynamoDB and portraits in Amazon S3, both on Amazon Web Services in the United States. Sign-in goes through Google. Those three companies are the only ones involved, and each is there to run the app rather than to receive anything.

You can delete any single thing whenever you like: a character, a campaign, a document, a face, an access token.

You can also delete the whole account, yourself, from your profile page. That takes your sign-in record, your handle, every character you own and its portrait, every campaign you run and everything inside it, your seat at any campaign you only play in, every access token you have issued, and whatever is still saved in the browser you do it from. It is immediate and there is no bin to fish any of it back out of.

Two things it does not take, and both for the same reason:

• A character somebody else owns and shared with you stays theirs. You simply stop being able to open it.
• A campaign somebody else runs carries on without you — including anything you wrote in its chat or its documents, which by then belongs to that table’s record of its own game rather than to you alone. Delete what you would rather not leave behind before you delete the account.

• Backups. Amazon keeps its own backups of the database on its own schedule. Deleting something removes it from the app at once; it can survive in those backups for a while afterwards.
• Uploaded images outlive a single delete. Deleting one character or one campaign removes the row that pointed at its portrait, but the image file itself stays in private storage, where nothing links to it and nobody can find it without the exact address. Deleting your account does remove those files. This is a gap and it is written down rather than glossed over.
• This is one person’s side project. It is built carefully — sign-in is Google’s, the image bucket is private and served through the app, and access tokens are stored as hashes so a copy of the database is not a set of working keys — but it has not been audited by anybody, and it makes no promise it cannot keep. Do not put anything here you could not stand to lose or to have seen.

This is not built for children and is not aimed at them. If you are under 13 — or under whatever age counts where you live — please do not make an account.

The date at the top changes with it. If the change is a real one — a new thing collected, a new company involved — the page will say so plainly rather than quietly gaining a clause.