Privacy Policy

Dragons Lore is operated by Christopher Ray Levesque, 2151 N Colter Dr, Tucson, AZ 85705, USA ("we", "us"). We are the controller of the personal information described here. You can reach us about anything in this policy at support@dragonslorettrpg.com.

Your account. Your email address, a username if you choose one, and a password (stored only as a one-way hash by our authentication provider - we never see it). If you sign in with Google, Apple or Facebook, we receive your email address and basic profile identifier from that provider.

What you create. Campaigns, characters, maps, journal entries, notes, chat messages, dice rolls, handouts, uploaded images and everything else you write or upload. This is the point of the service, and it belongs to you (see the Terms).

Billing. If you subscribe, payment is handled by Stripe. Your card details go directly to Stripe and never reach our servers. We keep your plan, billing interval, subscription status and a Stripe customer reference.

Technical information. Like any website, our hosting provider receives your IP address, browser type and the pages you request, and keeps short-lived logs for security and troubleshooting. When something breaks, an error report (what failed, in which part of the site, your browser type) is sent to our error-monitoring service.

Feedback you send. If you use the Feedback button, we keep your message, your email address, the page you were on, your browser type and screen size, and - only if you tick the box for it - a screenshot of what was on your screen at that moment, which may show your campaign's content.

Usage analytics - only if you allow it. If you accept analytics cookies, we record which pages are visited (with campaign names and invitation codes removed from the addresses), how quickly they load (measured by PostHog and by Vercel Speed Insights), and product events such as "campaign created" or "player invitation accepted". These events deliberately contain no email addresses, campaign names or content. If you decline, no analytics are collected.

• To provide the service - signing you in, storing and showing your campaigns to the people you share them with, processing your subscription. (Legal basis: performance of our contract with you.)
• To keep it secure and working - preventing abuse, rate limiting, investigating errors. (Legitimate interests.)
• To send you service email - confirmations, password resets, invitations and billing notices. We do not send marketing email without your consent. (Contract; consent for anything promotional.)
• To understand how the product is used - only with analytics consent. (Consent, which you can withdraw at any time.)
• To meet legal obligations - for example keeping billing records for tax purposes. (Legal obligation.)

• Members of a campaign can see what is written in it, according to their role. Game masters can see more than players; content a GM marks secret is not shown to players.
• Your private notes are visible only to you.
• A campaign its owner marks public can be read by anyone who has its link. Public campaigns are never listed in our sitemap or offered to search engines by us.
• Our staff do not read campaign content except where necessary to provide support you ask for, investigate abuse, or comply with the law.

We do not sell your personal information, and we do not share it for advertising. We use these providers to run the service, each under a contract that limits what they may do with it:

• Supabase - database, authentication, file storage and live updates.
• Vercel - website hosting, and page-speed measurements (Speed Insights), only with your consent.
• Stripe - payment processing and subscription management.
• Our email delivery provider - sending account and invitation email.
• Sentry - error monitoring.
• PostHog - product analytics, only with your consent.
• Anthropic - only when a game master uses "Suggest updates" on a session write-up, the text of that write-up and the names of related campaign records are sent to Anthropic's AI model to generate suggestions. Anthropic does not use API data to train its models.
• Google, Apple, Facebook - only if you choose to sign in with them.

If you link a public character sheet from another site, our server fetches that public sheet from it; nothing about you is sent to that site beyond the character link you provide.

We may also disclose information if required by law, to protect someone's safety, or as part of a sale or reorganisation of the service, in which case this policy continues to apply.

• Essential - cookies that keep you signed in, and a record of your cookie choice. These are needed for the site to work and cannot be switched off.
• Preferences - your browser's local storage remembers things like dashboard layout and dismissed tips. This stays on your device.
• Analytics - PostHog cookies, and Vercel Speed Insights (which sets no cookies), used only after you click "Accept" on the cookie banner. You can change your mind with the "Cookie settings" link in the footer.

• Your account and content: for as long as you keep your account.
• When you delete your account, your account, profile, private notes, characters and the campaigns you alone belong to are deleted immediately. Copies in our encrypted backups are overwritten within 30 days.
• Contributions to campaigns other people run (for example journal entries or chat messages) stay with that campaign, no longer linked to your account, because they are part of a shared story. Ask us if you want specific entries removed.
• Billing records: as long as tax law requires (typically up to 7 years), held by Stripe.
• Error reports: up to 90 days. Analytics: up to 12 months.
• Feedback and any screenshot sent with it: while the beta runs, and deleted with your account.

Wherever you live, you can:

• Download your data - from your account page, as a file you can keep or move elsewhere.
• Delete your account - from your account page.
• Correct your information - most of it you can edit directly.
• Withdraw consent to analytics at any time with "Cookie settings" in the footer.
• Ask us for a copy of anything not covered by the download, or object to or restrict how we use your information, at support@dragonslorettrpg.com. We reply within 30 days.

If you are in the EU, UK or a similar jurisdiction you may also complain to your local data protection authority. If you are a California resident, you have the rights to know, delete and correct described above, and we do not sell or share personal information as those terms are defined by California law. We will not discriminate against you for exercising any of these rights.

Our database is hosted in the United States. Some of our providers process data in other countries, including the United States. Where data leaves the EU or UK we rely on the European Commission's Standard Contractual Clauses or an equivalent safeguard.

Data is encrypted in transit (HTTPS) and at rest. Access to campaigns is enforced in the database itself, so one campaign's members cannot read another's. No system is perfectly secure; if a breach affects your information we will tell you, and the authorities where required, without undue delay.

Dragons Lore is not for children under 13, and we do not knowingly collect information from them. If you are under the age of digital consent where you live, you need a parent or guardian's permission to use it. If you believe a child has given us information, contact us and we will delete it.

If we make a material change we will tell you by email or with a notice on the site before it takes effect. The date at the top of this page shows when it last changed.