Back to home

Privacy Policy

This Privacy Policy describes what information PF1e Campaigner collects, how it is used, and the third-party services involved in operating the app.

Last updated: 20 May 2026

1. Information we collect

Account information. When you sign up, Clerk (our authentication provider) collects your email address and any other identifiers you provide (display name, profile image). A minimal profile row mirroring your Clerk user id is written to our database so that characters and campaigns can be associated with you.

Application content. Characters, campaigns, party rosters, treasure ledgers, encounters, notes, homebrew content, uploaded portraits, and DM-staged images that you create are stored in our Supabase Postgres database and Supabase Storage buckets so that they persist across sessions and devices.

Billing information. If you subscribe to Pro, your payment card details are collected and stored by Stripe via Clerk Billing. We never see or store your full card details. We do record a small amount of subscription state (plan slug, trial-consumed flag, subscription id) in our database so we can correctly gate Pro features.

Support content. If you file a bug report or leave feedback, the content of those messages and your account id are stored in our database so we can respond and improve the app. AI-assisted triage may analyse bug reports automatically; the analysis is admin-only and never shared with other users.

Technical data. Our hosting provider (Vercel) logs basic request information (IP address, user-agent, timestamps) for operational and security purposes.

2. How we use it

We use the information above to operate the Service: to authenticate you, to render your characters and campaigns, to broadcast realtime updates to seated campaign members, to charge for Pro subscriptions and gate Pro features, to respond to support requests, and to detect and fix bugs.

We do not use your application content (characters, campaigns, notes, etc.) for advertising, profiling, or sale to third parties. We do not train AI models on your data.

3. Third-party services

PF1e Campaigner relies on the following providers. Each has their own privacy practices; we summarise what they do for us and link to their policies.

  • Clerk— user authentication, account management, and billing front-end. clerk.com/privacy
  • Stripe— payment processing, accessed via Clerk Billing. Card details are tokenized by Stripe; we never receive them. stripe.com/privacy
  • Supabase— Postgres database and storage buckets that hold your characters, campaigns, notes, and uploaded images. supabase.com/privacy
  • Vercel — web hosting and request logging. vercel.com/legal/privacy-policy

4. Cookies and local storage

We use cookies and browser local storage strictly to operate the Service:

  • Clerk sets authentication cookies that keep you signed in.
  • A pf1e_mode cookie remembers whether you chose the Player or DM interface.
  • Local-storage keys remember small UI preferences (help-tour dismissals, item favorites, theme choice).

We do not use third-party advertising or analytics cookies.

5. Sharing and visibility within the app

Within the app, content is visible to the other people who need to see it. If you join a campaign, the GM can see your seated character’s stats and your display name. Other seated players can see the same party-view summary the GM uses. If you publish a DM image, every seated player can see it. We do not share your application content outside the app without your action.

6. Data retention

We retain your account and content for as long as your account exists. If you delete a character or campaign, the underlying rows are removed from our database. If your Pro subscription lapses, your data is preserved so you can reactivate later (see Terms § 5). You can request full account deletion via the support channels below; we will delete your account and associated content within a reasonable time.

7. Your rights

Depending on where you live, you may have rights to access, correct, export, or delete the personal data we hold about you, and to object to or restrict certain processing. You can exercise these rights by contacting us through the in-app feedback channel. We’ll respond within the timeframe required by your local law.

8. Children’s privacy

The Service is not directed to children under 13 and we do not knowingly collect personal information from them. If you believe a child under 13 has created an account, contact us and we’ll remove the account and its data.

9. Security

We use industry-standard providers for authentication, payment processing, hosting, and storage. Database access is gated by row-level security policies tied to your account. No system is perfectly secure; if we become aware of a breach affecting your data, we will notify you in line with applicable law.

10. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be surfaced in-app and the “Last updated” date at the top of this page will be revised.

11. Contact

For privacy questions or data-rights requests, please use the in-app feedback form or the bug-report channel.