Your privacy

Updated 2 November 2026. Federico Romaniello, trading as Cartographer tools (United Kingdom), is responsible for the personal data described here. Contact cartographertools@gmail.com. A public postal business address remains to be finalised.

The short version

We need your account details to let you play. Other people at your table see the characters and content you share. Support administrators can inspect campaign data when needed for support or safety; inspections are logged. We do not sell your personal data or record your screen or keystrokes.

Use a nickname. Share invite codes only with people you trust, and avoid uploading addresses, passwords or private documents. If something worries you, leave the session and tell a trusted adult or contact us. You can ask us to explain, correct or delete your data. You will not lose gameplay access for refusing optional analytics.

Accounts and age information

We store your account name, email, verification status, account dates and password hash where you use email sign-in. Google and Discord sign-in are optional; they supply basic profile, email and provider identifiers. We may store a profile-image URL and encrypted provider tokens. We do not receive your provider password, Google mail or Discord messages.

We ask for an age band (13–15, 16–17 or 18+) and record the terms version and confirmation time, not a birthday or identity document. This is a self-declaration, not verified age assurance. Accounts are for ages 13+; parents or guardians should help under-18s decide whether to join. An adult must buy subscriptions. Under-18 accounts cannot enable optional analytics. Under-16 accounts cannot use the external AI reader or embedded YouTube playback. Contact us if the age band needs correcting or an under-13 account was created by mistake.

What we use and why

• Providing the service: account details, campaign membership, characters, uploaded images, game state and saved settings operate your requested account and campaign. We rely on performance of the service contract where applicable. For younger players, necessary account and safeguarding processing also requires a documented, child-focused legitimate-interest assessment by the operator.
• Security and support: sessions, IP/browser information, rate limits, inspection logs and support requests help protect accounts, prevent misuse and resolve problems. Our basis is legitimate interests in a secure service, balanced against your rights; legal obligations may also require processing.
• Payments: Stripe handles checkout and payment details. We store customer/subscription references, billing status and access dates. We rely on contract performance and applicable accounting, tax and consumer-law obligations.
• Optional analytics: only adult accounts that opt in on the account and device record app visits and up to five UTM campaign-source tags. This uses consent. Withdraw in privacy controls; withdrawal deletes the app’s recorded attribution and visit row. Sign-in/security session records are separate.
• Requests and compliance: we keep necessary privacy/content complaints, rights declarations and response records to handle requests, protect rights and meet legal obligations. We do not use game choices for decisions with legal or similarly significant effects.

Who can see your data

Campaign sharing follows ownership and GM permissions. Your nickname and shared table content are visible to fellow members; private game information remains subject to the app’s access rules. Administrators have a separate, audited support view which can include otherwise private campaign records. Do not treat campaign storage as an encrypted personal vault.

Cloudflare hosts the app, database and networking. Stripe processes payments. Google or Discord process sign-in when you choose them. OpenAI or Cloudflare Workers AI process the text you explicitly submit to the document reader; the creature reader also sends the image previews you review, including rendered PDF pages. YouTube receives device/network data when you choose to join playback. Email support uses Gmail. These providers have their own privacy notices and may process data internationally. Provider contracts and applicable UK/EU transfer safeguards must support those transfers; no UK/EU-only storage guarantee is made.

Documents and AI

PDF and Word preparation takes place on your device. Original documents, images and fonts are not uploaded by the class reader. Selecting a file does not start AI processing. When you choose Create class draft, the reviewed extracted text goes to the named provider. Do not include personal or confidential information you do not have permission to share.

The app does not store the original source text. It records limited allowance/cost and rights-declaration metadata, and stores the reviewed class when you save it. OpenAI requests disable response storage; provider abuse-monitoring retention can still apply. Read the document-reader details. Entering a class manually avoids external AI processing.

The creature importer sends reviewed text and reduced image previews to OpenAI only after you confirm permission and click Read creature. This includes rendered pages for scanned PDFs. Original PDFs and image metadata stay on your device. The app saves the creature sheet and optional cropped portrait you approve, not the source documents or previews. The same provider retention, age and allowance controls apply. Creature-reader details.

Cookies and device preferences

Sign-in cookies and security storage are needed to provide requested accounts. Accessibility choices, panel positions and other interface preferences use browser storage for the settings you request. Optional analytics use the cartographer-analytics preference and a tab-local campaign-source record, and stay off until enabled. Clear browser storage or use the privacy controls to change these choices.

YouTube does not load until you choose Join playback. Joining permits a connection to YouTube and its cookies or similar technologies, which may include advertising-related processing. It is optional; close the dock to disconnect. See the separate YouTube notice.

How long data stays

Account and campaign records remain while needed for the active service or until an applicable deletion request is completed. Deleting a shared campaign affects its members; we check ownership and others’ rights before handling a request. Subscription cancellation alone does not delete campaign content.

Session cookies normally expire after 14 days; server records can remain until cleanup. Analytics consent withdrawal removes the current attribution record. Support, security, AI usage and declaration records are retained only as needed for their purpose, disputes or legal duties, but a complete scheduled retention/deletion programme is still being established. Financial records may need longer legal retention. Ask us about a particular record; we will explain any lawful reason for keeping it. Backups and provider records may take longer to expire.

Your choices and rights

You can request access, correction, erasure, restriction, objection and portability where applicable, and withdraw consent without affecting earlier lawful processing. Use Accessibility & privacy to download a basic account copy or submit a request, or email us without an account. The download is not a complete statutory access response: ask us for other records. We may need proportionate identity checks to protect your account; do not send identity documents unless a secure, necessary method is agreed.

We normally respond to data-rights requests within one month. If the law allows an extension for complexity or volume, we will explain it within the initial period. Requests are normally free. Deletion can be limited by legal obligations or others’ rights; we will explain the outcome. You may complain to the UK Information Commissioner or your local EU supervisory authority, without contacting us first.

We will update this notice when practices change and give appropriate notice of material changes. This notice describes current controls and explicitly identifies unfinished operational work; it is not a claim of regulatory certification.