1. Who we are

Campaign Tracker is an independent, open source campaign management tool for tabletop RPG Dungeon Masters. It is not operated by a company and has no advertising or data monetisation business.

For privacy questions contact privacy@campaign-keeper.netlify.app.

2. What we collect

• Email address — used only to send your magic link sign-in. Never shared with third parties or used for marketing.
• Campaign data — sessions, NPCs, locations, factions, events, plot threads, and anything else you create inside the app. This data belongs to you.
• Uploaded images — portraits, location banners, and faction artwork you upload. Stored in AWS S3.
• Session feedback — optional anonymous poll responses submitted by your players after a session.
• Session cookie — an HttpOnly cookie that keeps you signed in for up to 5 days. It contains no personal information and is required for the app to function.

We do not use analytics trackers, advertising cookies, or fingerprinting.

3. Why we process it

All processing is necessary to provide the service you signed up for (legal basis: contract). We do not process your data for any other purpose.

4. Who we share it with

We use the following sub-processors to operate the service. Each has a Data Processing Agreement in place.

• Google Firebase / Firestore — stores your account and all campaign data. Data is processed in the United States under Google's standard contractual clauses.
• Amazon Web Services (S3) — stores uploaded images. Data is processed in the region configured for the bucket.
• Netlify — hosts the web application.

We do not sell, rent, or trade your data to any other party.

5. How long we keep it

We keep your data for as long as you have an account. When you delete your account, all Firestore records and uploaded images associated with your account are permanently deleted. Anonymous session feedback is deleted at the same time as the campaign it belongs to.

6. Your rights

Under GDPR (if you are in the EEA or UK) you have the right to:

• Access — request a copy of the data we hold about you.
• Erasure — delete your account and all associated data at any time from Account Settings.
• Rectification — correct any inaccurate data (campaign data can be edited directly in the app).
• Portability — request an export of your data. Contact us at the email below.
• Object — object to any processing. As we only process data to provide the service, deletion is the appropriate remedy.

To exercise any right, email privacy@campaign-keeper.netlify.app. We will respond within 30 days.

7. Cookies

Campaign Tracker uses a single HttpOnly session cookie (named session) that is strictly necessary for authentication. No consent is required for this cookie under GDPR. No third-party cookies are set.

8. Changes to this policy

If we make material changes we will update the “Last updated” date at the top of this page. Continued use of the service after changes constitutes acceptance.