Privacy policy

What we collect

Your account. When you sign up, you give us your name and email address and choose a password. We store the password only as a one-way hash, so we cannot read it.

Signing in with Google. If you choose Continue with Google, Google sends us your basic profile, which includes your name, your email address, whether Google has verified that address, an ID for your Google account, and a link to your profile picture. We store your name, your email address, the account ID, and the picture link. We never receive your Google password, and we do not ask for access to your email, contacts, or files.

What you build. We store the characters, house rule sets, portraits, and notes you create, and the settings that belong to them. We also store when you last opened each character.

Guest characters. In the Guest Sandbox, you can build a character without an account. We store that character temporarily. If you do not create an account to keep it, we delete it 7 days after your last change, or straight away if you discard it. We send our team a count of guest characters started, with no personal details.

Password resets. When you ask to reset your password, we create a single-use link that expires after 60 minutes and email it to you.

Bug reports. If you send a bug report, we receive what you write and the recent messages from your browser console. We also receive a screenshot of the page unless you turn it off, and any screenshot you paste. With each report we receive the full page address, your browser type, your window size, and a few technical details about the page, such as the numbers in its address and how many validation warnings it showed. If you are signed in, we link the report to your account. A screenshot can show whatever was on your screen, so check it before you send.

Security and abuse prevention. To stop automated abuse, we use your IP address to limit repeated attempts to create accounts, start guest characters, reset passwords, and send bug reports. For bug reports we use a salted hash of the address that changes every day, and we do not store the address with the report.

Analytics. We count page views and the features people use, so we can see what works. We run our analytics service ourselves, on the same host as the site, so no analytics company receives your visits. We set no cookies for analytics. We record page paths and the campaign tags a link carries (utm_source, utm_medium, utm_campaign, utm_term, and utm_content). We record no other query parameters, so the codes in password reset links never reach analytics. We do not build a profile of you or follow you to other sites.

We do not ask for your age, location, or payment details. Billing is not active on the site today.

Cookies and browser storage

We set only the cookies the site needs to work: a session cookie that keeps you signed in, a security cookie that protects signing in and out from forgery, and a cookie that remembers which page to return to after you sign in. When you sign in with Google, we also set two short-lived cookies so we can check that the sign-in came back from Google unaltered. We also save your theme choice, your layout choices, and your unsaved edits in your browser, so you keep your work if a page reloads.

When you use the Guest Sandbox, we set one cookie that lets this browser return to your guest character. It lasts 7 days, and we remove it when you keep or discard the character.

We use no advertising cookies and no third-party tracking scripts, so we do not show a cookie banner.

Why we use your information

• We use your information to run your account and keep your characters and house rules available to you. We need it to provide the service you signed up for.
• We use your email address to send the password reset links you ask for.
• We use it to keep the site secure, prevent abuse, and fix bugs. These are our legitimate interests in running a safe and working service.
• We use it to understand, in aggregate, which parts of the site people use. This is our legitimate interest in improving the site.

We do not sell your information, we do not share it for advertising, and we do not send marketing email.

Who else handles your information

We use a small number of service providers, and we give each one only what it needs.

We may also disclose information if the law requires it, or to protect the safety of our users or the service.

How long we keep it

• We keep your account, characters, and house rules until you delete them or ask us to delete your account.
• We delete guest characters 7 days after their last change unless you keep them in an account.
• Password reset links expire after 60 minutes.
• We keep bug reports for 12 months and then delete them, unless an open bug still needs them.
• Our host keeps server logs and database backups for a limited period and then deletes or overwrites them. When we delete your account, copies in existing backups are deleted when those backups expire.

Your rights

You can ask us to:

• tell you what information we hold about you, and give you a copy;
• correct information that is wrong;
• delete your account and everything you created;
• export your characters in a portable format;
• stop using your information for a purpose you object to.

To do any of these, write to support@ars-saga-manager.com from the address on your account. We may ask you to confirm the request before we act, and we answer within 30 days.

If you live in the European Economic Area or the United Kingdom, you can also complain to your local data protection authority. If you live in California, you have the same rights to know, delete, and correct, and we do not sell or share personal information as California law defines those terms.

Where your information goes

Our servers are in the United States, and the service providers listed above are based there too. If you use the site from outside the United States, we send your information to the United States.

Children

The site is not meant for children under 13, and we do not knowingly collect information from them. Where local law sets a higher age for using online services without a parent's consent, that higher age applies. If you believe a child has given us information, write to support@ars-saga-manager.com and we will delete it.

Security

We store passwords as hashes, send everything over encrypted connections, and limit repeated attempts to create accounts and reset passwords. No system is perfectly secure, so if we learn of a breach that affects your information, we will tell you.

Changes to this policy

If we change this policy in a way that matters, we will update the effective date above and tell signed-in users on the site before the change takes effect.