Privacy Policy

Effective Date: July 12, 2026

1. Information We Collect

We only collect information necessary to identify you and display your gaming roster profile. This includes:

• Account Details: Usernames and emails (for Google or Magic Link logins).
• Profile Images: Discord or Google avatar picture URLs (stored strictly to render your character chip on RSVPs and Chat logs).
• OAuth Identifiers: Your secure, unique Discord or Google account ID numbers (used for credential-free logging in). No password details are ever accessed or collected during OAuth.
• Custom Credentials: Salted and scrypt-hashed password keys if you register directly on the portal. We never store plain-text passwords.

2. How We Use Your Data

Your information is used solely to facilitate group coordination:

• Rendering your name and avatar on the D&D session RSVP lists.
• Displaying your sender card next to messages you write in the Tavern Chat room.
• Authenticating your role credentials (Player, Moderator, or Admin) to control scheduling permissions.

We do not use tracking cookies, analytics scripts, or commercial trackers. We do not sell, rent, or distribute your information to third-party organizations.

3. Data Storage and Security

All database logs are stored in a secure cloud database hosted by Neon Postgres. Login session tokens are issued as encrypted JSON Web Tokens (JWT) saved as secure, HttpOnly cookies to safeguard against cross-site scripting (XSS) intercept risks.

4. Cookie Disclosure

We use a single, strictly necessary session cookie to keep you logged in:

• Cookie Name: dnd_session
• Purpose: Stores an encrypted session token containing your secure user ID, display name, role, and avatar URL.
• Duration: Expires automatically after 7 days, or immediately when you click the "Sign Out" button.
• Security Properties: Set with HttpOnly (prevents client-side scripts from reading the token), Secure (only transmitted over HTTPS), and SameSite=Strict (prevents cross-site sharing).

5. Data Retention and Deletion

We retain your user data for as long as your account remains active in the group. If you wish to delete your account and wipe your profile details, chat history, or RSVPs, please contact the portal administrator.

6. Contact Us

For questions or account deletion requests, please contact your group's Dungeon Master or Portal Admin.