Privacy Policy
Effective 4 October 2026
Who is responsible
d20scape is operated by Mattias Poopuu in Estonia. For data-protection questions or requests, email support@d20scape.com or write to Astangu tn 54-75, Haabersti linnaosa, Tallinn, Harju maakond, 13519, Estonia.
Information we process
- Account information: username, email address, password hash, legal-policy acceptance, and account timestamps.
- Content you create or upload: characters, campaigns, notes, maps, tokens, portraits, documents, audio, custom items, and related game data.
- Collaboration information: campaign membership, invitations and invitation email addresses, permissions, sessions, and activity needed to run shared games.
- Technical information: session and security-cookie identifiers, IP address and request information contained in server logs, browser details, and error or abuse reports.
Please do not upload sensitive personal information or content you do not have the right to share.
Why we use it
- To create and secure your account and provide the service you request. The legal basis is performance of our agreement with you.
- To save, synchronize, and share content according to your choices. The legal basis is performance of our agreement with you.
- To prevent abuse, protect users, diagnose failures, and keep the service secure. The legal basis is our legitimate interest in operating a safe and reliable service.
- To handle privacy, copyright, and lawful authority requests. The legal basis is compliance with legal obligations and our legitimate interests.
We do not sell personal data and do not use it for targeted advertising or marketing email.
Who can see information
Campaign owners and members can see content shared with their campaign according to their permissions. Content you mark public can be viewed by other users. Service administrators may access information when reasonably necessary for support, security, moderation, or legal compliance.
The service is hosted using Coolify on Hetzner infrastructure. These providers process stored data and technical logs only to provide hosting and infrastructure services. We may disclose information when legally required or necessary to protect users and the service.
Retention and account deletion
We keep account information while your account exists. You can delete your account from the account-deletion page. Private account content is deleted with the account. Before deletion, campaigns you own must be deleted or transferred. Other players retain their own characters. Content already shared or published may remain in an anonymized form where it is needed by collaborators, but you may ask support to review it.
Security logs are retained only as long as reasonably needed for security and troubleshooting. Disaster-recovery backups, if present, are isolated from normal use and expire or are overwritten on the hosting provider's backup schedule. Contact support for the current maximum backup-retention period.
Cookies
d20scape uses only cookies that are necessary for login sessions, security, and CSRF protection. We do not currently use advertising, analytics, or marketing cookies, so there is no optional-cookie consent banner.
Your rights
Depending on the circumstances, you may ask to access, correct, erase, restrict, or receive a portable copy of your personal data, or object to processing based on legitimate interests. Requests are handled through support@d20scape.com; we may need to verify your identity. You may also complain to the Estonian Data Protection Inspectorate or the supervisory authority where you live.
Age, security, and changes
Accounts are for people aged 16 or older. We use access controls, password hashing, HTTPS in production, and other reasonable safeguards, but no online service can guarantee absolute security. We will update the effective date and request renewed acceptance when a material policy change requires it.