Privacy policy

What is stored

When you sign in, Splatbook keeps:

• Your account. The name, email address and avatar image supplied by whichever provider you signed in with (Google or Discord), plus the access and refresh tokens that keep you signed in. Splatbook never sees or stores your password — it has none.
• What you make. Your characters, campaigns, dice rolls and session notes, and which campaigns you belong to.

That is the whole list. There is no advertising, no tracking pixels, and nothing you write is read, mined or sold. The one measurement on the site is Cloudflare Web Analytics: aggregate page counts so one person can tell whether anyone visits. It is cookieless, it does not fingerprint you, it stores nothing about you, and it cannot follow you to another site — which is why there is still no consent banner to click.

Card tables, and playing without an account

A card table is the one part of Splatbook you can use without signing in. Somebody with an account starts the table and shares its link; anyone holding that link can take a seat. If that is you, here is the whole of what is kept:

• The name you type when you sit down. The form asks for your character's name rather than yours, and that is the honest advice — it is shown to everyone at the table and it is the only thing about you that is stored. Nothing asks for an email address, and nothing tries to work out who you are.
• What happens at the table. Which cards moved between which piles, and any label somebody types onto a face-down card. It is the game, not you.

A table is deleted six weeks after it was last used, and the seats go with it — names included. Nobody has to ask and no reminder is sent; it simply goes. If you want your name off a table sooner than that, the person who started it can delete the whole table at once, which takes effect immediately. That is the practical route for a guest, because a seat is not an account and there is nothing for an erasure request to name you by.

Why it is stored

Solely to make the app work: to know who you are between visits, to show your characters back to you, and to let the other players at your table see the campaign you share with them. Your characters and notes are visible to you and to the members of any campaign you join — not to anyone else, and not to the public.

Who it is shared with

Nobody. Your data is not sold, rented, or handed to advertisers or data brokers. It is not used to train machine-learning models. The only third parties involved are the ones needed to serve the site at all:

• Cloudflare, which hosts the app and its database, and which processes requests on our behalf.
• Google or Discord, whichever you chose to sign in with — they tell Splatbook who you are, and their own privacy policies govern that exchange.

The site does carry two outbound links that are commercial: a Ko-fi tip jar and a DriveThruRPG affiliate link. If you follow either, that company's cookies and privacy policy apply on their site — not here. Following them is entirely optional and nothing is shared about you when you do.

Cookies

Three at most, and never all three at once. Every one is needed to make something work; none of them watches you.

• Where to send you back to, set the moment you arrive — before you sign in, and even if you never do. It is part of the sign-in machinery and holds a page address on this site, nothing else.
• Your sign-in session, once you have signed in, so the site knows it is still you on the next page.
• Your seat at a card table, and only if you take one without an account — signed in, your seat is found by your account and this is never set. It holds a secret proving the seat is yours, so closing the tab does not lose your hand. Scripts cannot read it, it is not sent to other sites, and it says nothing about who you are.

There are no advertising or analytics cookies — the page-count measurement above is cookieless by design — which is why you are not being asked to click a consent banner.

Deleting your data

It is your data and you may have it back or have it destroyed. Email [email protected] and ask, and your account and everything attached to it will be deleted. There is no retention period and no dark pattern — asking once is enough. You may also ask for a copy of what is held about you.

If you only ever sat at somebody's card table, there is no account to delete and no need to write: ask whoever started the table to delete it, or leave it and it will age out within six weeks by itself.

Where it lives

On Cloudflare's infrastructure, which is distributed globally, so your data may be stored or processed outside your own country. It is transmitted over HTTPS in every case.

Changes, and checking my work

If this policy changes materially, the date above changes with it. Splatbook is free software and the source is public — if you would rather verify than trust, the code that stores all of the above is at https://github.com/blockbeard/splatbook.

Contact

Questions, corrections, or a deletion request: [email protected].