Privacy notice

What we collect and why

When you create a reader account

Your email address, the display name you choose, and your password, which we store only in a scrambled form that cannot be read back. We also keep whether you asked for the newsletter, when you passed the age check, which version of our terms you accepted and when, and a scrambled form of the internet address you signed up from, to slow down abuse. The age check asks for the month and year you were born; we keep only whether you passed, not the date. We use these to sign you in and to keep your bookmarks, characters and orders together.

When you use profiles, friends and campaigns

What you choose to put on your profile (a short bio, pictures, an accent colour, characters to show), your friends and the people you block, the campaigns you run or join, the messages and rolls you post in campaign chats, and any reports you send to our moderators. Pictures you upload are copied without their hidden details, such as the camera or the place a photo was taken.

When you build characters

Everything you enter in the character builder is saved to your account, including any portrait you add.

When you place an order

Your name, email address, shipping address and what you ordered. The store is a preview: no payment is taken and nothing ships.

When you sign up for the newsletter

Your email address and a record of your consent: when you gave it, the words you agreed to, a scrambled form of your internet address and your browser details. Nothing is sent until you confirm from the email we send you.

When you write to us

Your name, email address and message, with a scrambled form of your internet address and your browser details, so we can answer and keep spam out.

When you visit

Our servers keep technical logs to run and protect the site. When studio staff use our tools, we record what they did and the internet address they worked from.

Cookies, storage and analytics

We use only the cookies the site needs to work, so we do not ask you to accept cookies:

• a sign-in cookie for reader accounts (30 days) and one for studio staff (8 hours);
• a cart cookie that remembers what you put in your cart (14 days);
• a cookie that remembers, for a day, that this browser did not pass the age check;
• for studio staff, a cookie proving the second sign-in step and one used while connecting our Google Drive.

Your browser also keeps a few things for you, such as your reduced-motion choice and the character builder’s display settings and Crucible library. They stay on your device.

We count page views with Cloudflare Web Analytics, which sets no cookies and stores nothing on your device. If your browser sends a Do Not Track or Global Privacy Control signal, we do not load it at all.

Some pages show videos from YouTube or Vimeo. A video loads only when you press play, and from then on that service sees your visit under its own privacy policy. We use YouTube’s privacy-enhanced mode and ask Vimeo not to track.

Who can see your data

• Other readers see what you make public on your profile. If your profile is friends-only, only your friends see all of it. People in a campaign with you see your display name and picture, the campaign’s chat, and the cards of the characters at the table. A campaign’s GM can open and edit a sheet you bring to that campaign while it is in play there. Friends you share a sheet with can view it, or edit it if you allow that.
• Studio staff handle support and moderation. Our publishers and administrators can read campaign chats, reports, characters and orders when they need to. Each time staff open a campaign in our tools, it is recorded.
• Companies that run parts of the site for us: Hostinger (our server and our email) and Cloudflare (the network your visit passes through, file storage and page-view counts). They handle data only to provide those services.
• When the law requires it, or to protect people from harm or the site from abuse.

We do not sell or rent personal information, and we do not share it with advertisers.

Google data in our staff tools

Our staff tools connect to the studio’s own Google Drive account so the team can share files. Google gives the connection access to that account’s Drive; our tools use it only inside one studio folder, and only for staff. The connection’s key is stored encrypted. Nothing from that Drive is shared with anyone else or used for advertising, and an administrator can disconnect it at any time. Readers’ data is never sent to Google.

Our use of information received from Google APIs follows the Google API Services User Data Policy, including its Limited Use requirements.

How long we keep it

• Your account, profile, characters, friends and campaign records: until you delete them or your account.
• Messages you post in a campaign chat: in the chat until you or the GM remove them. When an account is deleted, its messages stay as “removed”, without the words or the name.
• Messages sent through our contact form: one year.
• Newsletter consent records: as long as you are subscribed, and afterwards as proof of what you agreed to.
• Orders: kept in the store’s records, even after an account is deleted.
• Encrypted backups of the site: 14 days.

Children

This site is for a general audience. Reader accounts are for people 13 and older, and we do not knowingly collect personal information from children under 13. If you think a child under 13 has given us personal information, write to [email protected] and we will delete it.

Your choices

• See and change your details on your account page.
• Download a copy of your data, or delete your account, from your account page.
• Make your profile friends-only, block people, take sheets out of campaigns, and remove your own messages.
• Ask us for a copy of what we hold about you, to correct it, or to delete it, at [email protected].

Security

The site is served over an encrypted connection. Passwords are stored scrambled, studio owners and administrators sign in with a second step, and backups are encrypted. No system is perfectly safe; if something goes wrong that affects your data, we will tell you.

Changes to this notice

When this notice changes, the date at the top changes too. If a change affects how we use what you have already given us, we will tell account holders before it applies.

See also our terms of use.