Privacy Policy

This policy explains what data this app collects, why, and what happens to it. It's written in plain language. If anything here is unclear, contact the keeper at the address at the bottom.

This app is a personal project, currently operated by an individual developer rather than a registered company. References to “the keeper,” “we,” or “us” refer to that individual.

What This App Collects

Account information. When you sign up, the app stores your email address and a hashed version of your password. Passwords are never stored in plain text and the keeper cannot see them.

Content you create.Characters, character portraits, campaigns, encounters, NPCs, initiative tracker state, and any notes you write are stored in the app's database so they're available to you across sessions. Portraits are stored in Supabase Storage; everything else lives in a Postgres database hosted by Supabase.

Basic usage analytics. The app uses Vercel Web Analytics, which is cookieless and does not collect personally identifying information. It records anonymized data like which pages are visited and roughly where visitors come from (country/region level). It does not track you across other sites.

Technical logs. Like most web apps, the hosting infrastructure (Vercel, Supabase) keeps short-lived logs of requests for security and debugging — things like IP address, browser type, and timestamps. These are not used to build a profile of you.

What This App Does Not Collect

• No tracking cookies for advertising.
• No third-party ad networks.
• No social login providers (currently email/password only).
• No payment information.
• No location data beyond the rough region inferred from your IP.
• No data from other sites or services about you.

How Your Data Is Used

Your data is used to make the app work. Specifically:

• Your email lets you log in and recover your account.
• Your content is stored so you can access it later.
• Anonymized analytics help understand which features are used and where things break.
• Logs help diagnose bugs and detect abuse.

Your data is not used to train AI models. Your characters, campaigns, and notes are yours. They are not fed into any model, sold to anyone, or shared with third parties for their own purposes.

When AI Features Are Used

The app may offer optional features that send specific content to Anthropic's Claude API — for example, an “Expand with AI” button on an NPC or campaign element. These features are opt-in: they only run when you explicitly trigger them.

When you use one of these features, the relevant content (and only that content) is sent to Anthropic for processing. Anthropic's handling of that data is governed by their own policies. The keeper does not store the AI's response separately from your content, and the keeper does not log what you submit beyond what's needed to deliver the feature.

If you don't want any data leaving this app's infrastructure, don't use the AI features. Every other feature in the app runs locally on the app's own servers.

Who Can See Your Data

You can see your own data. That's the point of the app.

Collaborators you invite can see what you share with them.If you add someone to a campaign, they can see campaign content according to their role. The app uses row-level security at the database layer to enforce this — meaning even a bug in the frontend cannot expose your data to users who shouldn't see it.

The keeper has technical access to the database. This is unavoidable for any small app. The keeper does not browse user data and only accesses it when necessary for debugging, security, or legal reasons. The keeper does not read your campaign notes for fun.

Service providers that run the app's infrastructure can technically access data on their servers:

• Vercel hosts the app and may process request data.
• Supabase hosts the database and storage.
• Anthropic processes only what you submit through opt-in AI features.

Each of these companies has its own privacy policy and security practices.

Law enforcement may request data with valid legal process. The keeper will comply when legally required and will notify you when legally permitted to do so.

Where Your Data Is Stored

The app's database and storage are hosted in the United States. If you're using the app from outside the US, your data will be transferred to and stored in the US.

How Long Data Is Kept

• Account and content data is kept as long as your account is active.
• When you delete content, it is removed from the live database promptly.
• When you delete your account, all associated content is deleted.
• The app does not currently run automated backups.This means deleted data is gone immediately, but it also means the keeper cannot restore data lost to accidental deletion, database errors, or other technical failures. Back up anything you can't afford to lose by exporting or saving locally.
• Analytics data is anonymized and retained per Vercel's defaults.
• Logs are kept short-term (typically days to weeks) per the infrastructure providers' defaults.

Your Choices

You can:

• Access your data — everything you've created is visible to you in the app.
• Edit or delete your data — characters, campaigns, and notes can be removed at any time.
• Delete your account — use the account deletion option in Settings, or contact the keeper at the address below.
• Export your data — request a copy of your data by contacting the keeper. (Self-service export is on the roadmap.)

For California Residents

California's Consumer Privacy Act (CCPA) gives California residents specific rights. You have the right to:

• Know what personal information has been collected about you.
• Request deletion of your personal information.
• Opt out of the sale of personal information. (This app does not sell personal information to anyone, so there's nothing to opt out of, but you have the right regardless.)
• Not be discriminated against for exercising these rights.

To exercise any of these rights, contact the keeper at the address below. You'll need to verify your account ownership before personal information can be released or deleted.

For Users Outside the US

This app is currently operated for users in the United States. If you use it from elsewhere, you do so understanding that your data will be processed in the US under US law, which may offer different protections than your home country.

If the app expands to formally serve users in the European Union, the United Kingdom, or other jurisdictions with stronger data protection laws, this policy will be updated with the additional disclosures and rights those laws require.

Children's Privacy

This app is not intended for children under 13. The keeper does not knowingly collect data from anyone under 13. If you believe a child under 13 has created an account, contact the keeper and the account will be removed.

Security

The app uses standard security practices: encrypted connections (HTTPS), hashed passwords, row-level security at the database layer, and the security controls provided by Vercel and Supabase. No system is perfectly secure, and the keeper cannot guarantee that data will never be exposed. If a breach occurs that affects your data, you will be notified.

Changes to This Policy

This policy may be updated as the app changes. Material changes will be announced in-app or by email. The “last updated” date at the top will always reflect the current version.

Contact

Questions, requests about your data, or privacy concerns can be sent to: thekeeper@tavernkeeper.app

The keeper reads everything. Responses to data requests typically take a few days.