Privacy
What Tome & Quill stores about you, who helps run it, and how to delete it.
Who runs Tome & Quill
Tome & Quill is run by [Owner: name of the person or organisation], who is responsible for the data described here. Questions go to the contact at the end of this page.
What we store when you have an account
You sign in with a link sent to your email address; there is no password.
- Your email address.
- Sign-in sessions, each with the IP address and browser description it started from.
- Characters you save to your account.
- Worlds you build: maps, settlements, places, NPCs, factions, items and lore.
- Campaigns you run or play in: sessions and notes, invites, your seat and display name, onboarding answers, journal entries, attendance, and reminder settings.
What stays in your browser
Characters you build without signing in are saved in this browser's own storage (IndexedDB) and never leave your device unless you upload them from your account page. Tool settings, a character draft in progress and your light or dark theme choice are kept in the browser's local storage. Clearing your browser data removes them.
Cookies
We set one cookie: the session cookie that keeps you signed in. There are no advertising, analytics or tracking cookies.
- Sign-in links, only when you ask for one.
- A campaign invite, when a Dungeon Master enters your address to invite you.
- Session reminders, only if you turn them on for a campaign. They are off by default.
Services that help run the site
- Vercel hosts the site; like any web host it sees your IP address and keeps request logs.
- Neon hosts the database that holds your account data.
- Resend delivers our emails, so it receives your address and the message.
- dnd5eapi.co and Open5e provide the 5e rules reference. While you build a character, your browser contacts them directly, so they see your IP address and which rules it looks up. The compendium pages fetch from them on our server instead.
Deleting your account
You can delete your account at any time from your account page. This removes your account, your sessions, your cloud characters, your worlds, the campaigns you run, and your seats in campaigns you play in, with their onboarding answers, journals, attendance and reminders. Unused sign-in links are removed too.
NPCs, pins and labels you added to another Dungeon Master's world stay part of that world, without your name on them. Characters saved in your browser stay there unless you choose to remove them. Backups and host logs may keep copies for [Owner: retention period].
Contact
For questions about your data, write to [Owner: contact email]. [Owner: add the governing law and any rights statement required where you operate.]