Privacy

Ohne Konto bleibt alles in deinem Browser (localStorage) und wird nirgendwohin geschickt. Die Seite setzt keine eigenen Cookies, nutzt keine Werbung und verfolgt dich nicht über andere Seiten hinweg.

Mit der freiwilligen Cloud-Speicherung wird dein Konto über Google Firebase Authentication verwaltet, und deine Kampagnen liegen in Google Cloud Firestore: E-Mail-Adresse, Konto-ID, die Namen deiner Speichercodes und Kampagnen, die gespeicherten Daten und Zeitstempel (Art. 6 Abs. 1 lit. b DSGVO). Die Daten bleiben, bis du die Kampagne oder dein Konto löschst; eine gelöschte Kampagne liegt noch 30 Tage im Papierkorb.

Wenn du in den Einstellungen die Tischansicht (Table screen) einschaltest und teilst, liegt eine kurze Momentaufnahme des Kampfs unter einer langen Zufallsadresse in Firestore; wer den Link hat, kann sie ansehen. Sie wird gelöscht, wenn du die Tischansicht löschst, die Einstellung ausschaltest oder dein Konto löschst. Beim Pausieren bleiben der Link und die Adresse bestehen; solange alle Bildschirme dunkel sind, wird nichts vom Kampf gesendet.

Wenn du die Karte benutzt, gehört sie zu dieser Kopie: Formen, gemalter Boden und Spielfiguren, die die Spieler sehen dürfen (versteckte Formen sowie Felder im Nebel werden weggelassen). Jede Spielerfigur bekommt einen geheimen Schlüssel im eigenen Link. Mit diesem Schlüssel kann ein Spieler dir eine Anfrage (Weg, Spurt, Tür), einen Ping oder einen Angriff schicken. Diese Nachrichten sind klein und werden gelöscht, sobald du antwortest oder die Tischansicht beendest.

Gehostet wird bei Vercel, das kurzzeitig Server-Logs führt (Art. 6 Abs. 1 lit. f DSGVO). Vercel Speed Insights misst Ladezeiten ohne Cookies und ohne Profil. Google und Vercel können Daten auch außerhalb der EU verarbeiten, nach eigener Angabe auf Grundlage des EU-US Data Privacy Framework oder von Standardvertragsklauseln.

Um zu sehen, wie viele Menschen die Seite besuchen, nutzt die Seite Vercel Web Analytics. Es zählt Seitenaufrufe ohne Cookies und ohne ein Profil von dir anzulegen (Art. 6 Abs. 1 lit. f DSGVO, ein Überblick über die Nutzung). Einige einfache Summen (Downloads, neue Konten, geteilte Tische, genutzte Funktionen, Fehlerseiten) werden ohne jeden Personenbezug gespeichert; dabei wird nichts auf deinem Gerät abgelegt. Das Zählen lässt sich für deinen Browser in den Einstellungen unter Daten und Backup ausschalten (Don’t count my visits).

Du kannst Auskunft, Berichtigung, Löschung, Einschränkung, Widerspruch und Datenübertragbarkeit verlangen. Angemeldet findest du im Cloud-Menü Account & data: alle Cloud-Daten herunterladen oder dein Konto samt allen Daten löschen. Du hast das Recht, dich bei einer Datenschutzaufsichtsbehörde zu beschweren.

Der ausführliche Text steht unten auf Englisch. Kontakt: feedback@dnd-toolkit.com. Verantwortlich: siehe Impressum.

Luca Torres Neuer, Mehrbachstr. 58a, 53567 Asbach, Deutschland/Germany. Email: feedback@dnd-toolkit.com.

More in the Impressum.

Your collection, party, encounters, session notes, settings and theme are saved in your browser’s own storage (localStorage). They are not sent anywhere unless you use cloud save. Clearing the site’s data in your browser removes them.

Small helper values live there too: the pointer to your cloud campaign, a random id of this browser, a flag that you are signed in, and whether you dismissed a hint. If you set up automatic backup, the browser remembers which file you chose (the file itself stays on your device).

The site sets no cookies of its own, uses no advertising and does not follow you from site to site.

If you sign in, your account is handled by Google Firebase Authentication (Google or email and password), and your cloud campaigns are stored in Google Cloud Firestore. Signing in with Google tells Google that you sign in to this site. With email and password, Firebase Authentication also sends one email to the address you give, with a link to confirm that the address is yours.

What is stored for you:

• your email address, account id and, with Google sign-in, your display name;
• for each save code: the name you gave it, your account id and email as its owner, and timestamps;
• for each campaign: its name, its setting, the NPC and session counts, the full saved data (collection, party, encounters, notes, settings; compressed), timestamps, and the random id of the browser that saved last.

This is done to provide cloud save, which you ask for by signing in (Art. 6(1)(b) GDPR). Only your account can open your campaigns. The admin account of this site can read and delete campaigns, which is used to remove abuse and to fix problems.

Data stays until you delete the campaign or your account. A deleted campaign sits in “Recently deleted” for 30 days and is then removed the next time you open My campaigns.

If you turn on the Table screen in Settings and start sharing, a short copy of the fight you are running is stored in Google Cloud Firestore under a long random address: the names of the characters and creatures in the fight, the hit points of the players’ side, whether each enemy is fine, hurt or dead, conditions, whose turn it is, and the one-line message you may type. Enemy hit points and notes are not included, and an enemy with the Hidden or Invisible condition is left out.

Anyone who has the link can open the page; viewers do not sign in. The link is not listed anywhere, and the site does not record who looks. The copy is deleted when you delete the table, when you switch the setting off, or when you delete your account (Art. 6(1)(b) GDPR, it is part of the feature you turn on). Pausing keeps the table and its links, and while every screen is dark nothing about the fight is sent.

If you use the battle map, it is part of that copy: the shapes, painted ground and tokens the players may see (shapes you hide and squares in the fog are left out). Each player character gets a secret key in its own link. With that key a player can send you a request (a route, a Dash, a door), a ping or an attack. These messages are small and are deleted as soon as you answer, or when you stop the table.

The site is hosted by Vercel. Like any web host, it handles your IP address and request details to deliver the pages and keeps short-lived server logs (Art. 6(1)(f) GDPR, keeping the site running and safe). For the plan this site uses, Vercel’s documentation lists one hour of runtime logs in its dashboard; Vercel may keep limited operational or security data for longer under its own terms.

Vercel Speed Insights measures how fast pages load. It uses no cookies and builds no profile of you.

To see how many people visit, the site uses Vercel Web Analytics. It counts page views and shows roughly where visitors come from (country, page, referring site) without cookies and without building a profile of you (Art. 6(1)(f) GDPR, an overview of how the site is used). A few plain totals are kept as well: downloads, new accounts, cloud save codes, shared tables, player phones that joined a table, whether a feature was used in a visit (rolling an NPC, starting an encounter, giving loot, opening the map), and how often an error screen showed. They are numbers only, with nothing about who. Nothing is stored on your device for this.

Nothing is counted on a test or preview address. You can turn all counting off for your browser in Settings, under Data and backup (“Don’t count my visits”). That choice is the only thing saved, on your device.

If you write to feedback@dnd-toolkit.com, the email address and what you write are used to answer you. “Report a bug” only opens your email program with a prefilled message (app version, setting, number of NPCs, whether a cloud campaign is connected, your browser). You read and edit it before sending; nothing is sent automatically, and your account email and save code are not included.

The toolkit is not aimed at children under 16. Cloud accounts are meant for people old enough to agree to the processing themselves; if you are younger, ask a parent or guardian, or use the toolkit without an account.

Google and Vercel can process data outside the EU, including in the USA. According to their own documentation they do this under the EU–US Data Privacy Framework or standard contractual clauses.

You can ask what is stored about you, have it corrected or deleted, restrict or object to its use, and receive it in a common format. Signed in, the cloud menu has Account & data: it downloads all your cloud data as one file and deletes your account with everything in it. You can also write to feedback@dnd-toolkit.com. You have the right to complain to a data protection authority.

Nothing is sold or passed on for advertising.