Privacy

Who's responsible

Parchment People is run by one person, based in the United Kingdom, who is the data controller for the purposes of the UK GDPR. Privacy questions and requests go to hello@parchmentpeople.com, which reaches them directly.

What's collected

• Your account. An email address, so you can sign in and recover access. If you sign in with Google, that email comes from your Google account - Parchment People never sees your Google password.
• Your profile. A username, which other players in your groups can see, and optionally a profile picture.
• What you create. Your characters and everything on them, uploaded portraits, the groups you run or join, and any private notes a DM keeps on their party.
• Feedback you send. If you use the feedback form, the message is stored along with which page you were on, your screen size, your browser's user-agent string and language, and which build of the app you were using. That's so a problem can actually be reproduced. Nothing from your characters is included, and the form is only available when you're signed in.
• Technical records. The services that host the app keep standard server logs, which include IP addresses and timestamps. These are used to keep the service running and secure.

What isn't collected

There is no advertising, no tracking across other websites, and no profiling. Nothing is sold or shared for marketing, and no attempt is made to work out who you are.

There is a privacy-friendly analytics tool, described below, which counts visits to pages. It cannot follow you anywhere else, and the addresses of your character sheets are stripped before anything is recorded, so it never sees a character name.

Cookies

Parchment People doesn't use cookies. Not for tracking, not for analytics, and not for keeping you signed in. The analytics tool is deliberately one of the few that stores nothing on your device at all. That's why you've never been asked to dismiss a cookie banner here - there's nothing to consent to.

Staying signed in is handled by your browser's local storage instead, which works only on this site and is never sent to anyone else. The one exception is outside this site: if you sign in with Google, that step happens on Google's own pages, where Google sets its own cookies under its own privacy policy.

Stored on your device

Along with your sign-in, a few small values are kept in your browser's local storage so the app behaves sensibly between visits: your light or dark theme preference, whether the spell search is limited to SRD sources, whether you've already seen the guided tour, a cache of spell data to avoid re-fetching it, and a record of which group notifications you've already been shown. None of this leaves your device. You can clear it at any time through your browser - you'll simply be signed out and see the tour again.

Why it's allowed to be stored

Under the UK GDPR, processing needs a lawful basis. Your account and the content you create are processed on the basis of contract - the app cannot give you a character sheet without storing your characters. Server logs, security measures, crash reports and the page counts described above rest on legitimate interests: keeping the service available, protecting it from abuse, and knowing whether anything is broken or being used. None of that requires knowing who you are, so none of it tries to.

Who else is involved

• Supabase - hosts the database, authentication, and uploaded images.
• Vercel - hosts and serves the app itself.
• Resend - delivers the automated emails the app has to send, such as confirming your address and resetting your password. It handles your email address for that purpose and nothing else; there are no marketing emails to unsubscribe from, because none are sent.
• Google - only if you choose to sign in with Google.
• Open5e - the open spell database the spell search queries. Your search terms are sent to Open5e; your characters are not.
• Umami - counts page visits. It sets no cookies and stores nothing on your device, and it cannot recognise you on any other website. Page addresses are stripped of anything identifying before they are sent, so a visit to a character sheet is recorded as "a character sheet" and never as which one. It also respects your browser's Do Not Track setting, if you have it switched on.
• Sentry - records technical details when something in the app crashes, so it can be fixed. It receives the error and where in the code it happened. It does not record your screen, your characters, or what you typed, and page addresses are stripped the same way.

Fonts and other assets are served from Parchment People's own domain, so loading a page doesn't announce your visit to anyone else.

What other players can see

Groups are the only place your data is visible to another person, and only because you asked for it:

• Your username is visible to members of groups you belong to.
• A character sheet becomes visible to the group's DM when you link that character to the group, and to the rest of the party only if you turn on sharing for it.
• Shared sheets are always read-only. Nobody else can edit your characters.
• Private DM notes are visible only to the DM who wrote them, never to the player they're about.

How long it's kept

Your characters are kept until you delete them or delete your account. The app also keeps a version history of each character so you can undo a bad edit - up to 50 snapshots per character, taken at most once every ten minutes, with the oldest discarded after that.

Deleting your account removes your profile, your characters, their version history, your groups and memberships, your uploaded images, and any feedback you sent. This is a real deletion, not a flag on a row: the data is removed from the live application and is no longer accessible. It can't be undone - so export anything you want to keep first.

Backups are the one thing that outlives a deletion, so it's worth being exact about them. Copies of the database, and of uploaded images, are kept by the person who runs Parchment People on their own equipment in the UK - so that a mistake or a failure can't destroy everyone's characters at once. Content you've deleted can survive in those copies for a while afterwards, but no longer than 90 days, after which it's gone from there too. Backups aren't reachable from the app, aren't shared with anyone, and aren't used for anything except restoring the service.

Your rights

You can ask for a copy of your data, correct it, delete it, ask that processing be restricted, or object to it. Two of these you can do yourself, immediately: every character can be exported as JSON or PDF from its own sheet, and your account can be deleted from the account page. For anything else, email hello@parchmentpeople.com - that's the contact address for any privacy question or request, and the fastest way to reach the person responsible.

There's no charge for any of this. Requests are answered within one month. The only exception is the one the law allows for: a request that is manifestly unfounded or excessive - typically a repetitive one - may attract a reasonable fee or be declined, and you'd be told why rather than simply ignored.

If you think your data has been handled badly, you can complain to the Information Commissioner's Office. If you're in the EU, you can complain to your own country's supervisory authority instead.

Where your data goes

Your account, characters and uploaded images are stored in Switzerland (Supabase's Zurich region). Switzerland sits outside the UK and the EEA, but both the UK and the EU formally recognise it as providing an equivalent standard of data protection, so no additional safeguards are needed for storing your data there.

Crash reports go to Sentry's European region, so they stay within the EEA.

The backups described above are held in the United Kingdom, by the person who runs Parchment People. They aren't handed to a third party, so there's no transfer to account for.

The app itself is served by Vercel from a global network, so the request that loads a page may be handled by a server elsewhere. Where that involves personal data leaving the UK or the EEA for a country without such recognition, Vercel relies on the UK International Data Transfer Addendum and the EU Standard Contractual Clauses.

Children

Parchment People isn't aimed at children and shouldn't be used by anyone under 13. If you believe a child has created an account, email hello@parchmentpeople.com and it will be removed.

Changes

If this policy changes, the date at the top changes with it. If a change actually affects how your data is handled - rather than just rewording something - you'll be told in the app rather than left to notice.