Privacy Policy

Tabletop Chronicles (“we,” “us,” or “our”) operates the website at tabletopchronicles.app. This Privacy Policy explains what information we collect, how we use it, and your rights regarding your data. We believe in being straightforward: your data powers your experience on the platform and nothing else.

1. Information We Collect

Account Information

When you create an account, we collect your email address, display name, and an optional avatar. If you sign up through a third-party provider (such as Google or Discord), we receive your name and email from that provider.

Campaign & Character Data

This includes everything you create on the platform: character sheets, campaign notes, session chronicles, maps, handouts, and any other content you upload or write. This data belongs to you.

Chat Messages

Messages sent through campaign chat channels (including in-character and out-of-character messages, dice rolls, and whispers) are stored to provide persistent chat history for your group.

Usage Data

We collect basic analytics such as pages visited, features used, and error logs. This helps us understand how the platform is used and where to improve it. We do not track you across other websites.

2. How We Use Your Data

Your data is used to:

• Provide and maintain the platform’s features
• Authenticate your account and manage sessions
• Process payments for premium subscriptions
• Send transactional emails (password resets, invitations, billing receipts)
• Improve platform performance and fix bugs

We do not sell, rent, or trade your personal data to third parties. We do not use your campaign content, character sheets, or chat messages for advertising, training AI models, or any purpose other than delivering the service to you.

3. Data Storage

Your data is stored on our self-hosted Supabase instance. File uploads (maps, handouts, avatars, and other media) are stored on Cloudflare R2 object storage.

We use industry-standard security practices including encrypted connections (TLS), encrypted data at rest, and role-based access controls. While no system is perfectly secure, we take reasonable measures to protect your information.

4. Third-Party Services

We use a limited number of third-party services to operate the platform:

• Stripe: payment processing for premium subscriptions. Stripe handles your payment details directly; we never see or store your full card number.
• Resend: transactional email delivery (password resets, campaign invitations, billing receipts).
• LiveKit: real-time voice and video chat during sessions. Audio/video streams are transmitted in real time and are not recorded or stored by us.
• Cloudflare: CDN, DDoS protection, and R2 file storage.

Each of these services has their own privacy policy. We only share the minimum data necessary for each service to function.

5. Cookies & Local Storage

We use cookies and browser local storage for essential functionality only:

• Authentication cookies: to keep you signed in across sessions.
• Local storage: to save your UI preferences (such as sidebar state, theme settings, and editor drafts) on your device.

We do not use third-party tracking cookies or advertising pixels. There is no cookie banner because we only use cookies that are strictly necessary for the service to function.

6. Your Rights

You have the right to:

• Access your data: you can view and download all your content from your account settings at any time.
• Export your data: request a complete export of your account data, campaigns, and characters in a portable format.
• Delete your data: request deletion of your account and all associated data. Once confirmed, this action is permanent.
• Rectify your data: update or correct any inaccurate personal information.
• Object to processing: withdraw consent for any non-essential data processing.

These rights apply regardless of where you live, though they are especially relevant under the GDPR (EU), UK GDPR, and similar regulations. To exercise any of these rights, contact us at [email protected].

7. Children’s Privacy

Tabletop Chronicles is not intended for children under 13 years of age. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us and we will promptly delete the account and associated data.

8. Data Retention

We retain your data for as long as your account is active. If you delete your account:

• Your personal data is deleted within 30 days.
• Campaign data where you are the sole owner is permanently deleted. Shared campaign data (e.g., chat messages visible to other players) may be anonymized rather than deleted to preserve the experience for other participants.
• Backups containing your data are purged within 90 days.

We may retain minimal records (such as billing transaction IDs) as required by law for tax and accounting purposes.

9. Changes to This Policy

We may update this Privacy Policy from time to time. If we make significant changes, we will notify you via email or a prominent notice on the platform. The “Last updated” date at the top of this page reflects the most recent revision.

10. Contact Us

If you have questions about this Privacy Policy or want to exercise your data rights, contact us at: