Dungeon Ledger accounts are shutting down. Accounts and campaigns are deleted on 15 November 2026. Download yours now

Privacy Policy for Dungeon Ledger

Last updated: November 1, 2026

Welcome to Dungeon Ledger. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application.

Data Controller

Threadnotes ("we", "us", "our") is the data controller responsible for the personal data collected through this website. If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at support@threadnotes.co.uk.

Information We Collect

We may collect information about you in a variety of ways. The information we may collect on the Service includes:

  • Personal Data: When you register, we collect your email address and a username, plus an avatar if you upload one. We use these to create and manage your account.
  • User-Generated Content: All the content you create and upload, including campaign notes, maps, characters, sound files, and chat messages, is stored on our servers to provide the service to you and your fellow campaign members.
  • People You Invite: If a Dungeon Master invites someone by email, we store that address with the invitation and email the invitation to it. We rely on our legitimate interest in letting people invite their players. If you were invited and want your address removed, contact us. Invitations contain nothing but the invitation.
  • Public Wikis and Moderation: If you publish a campaign as a public wiki, the notes it contains are screened automatically for prohibited content, reviewed by a person before going live, and shown to anyone on the internet along with the Dungeon Master's display name. See Automated Decision Making below.
  • Feedback and Questionnaires: If you send feedback or answer a questionnaire, we keep what you submitted and the result, linked to your account.
  • Technical Data: Our hosting provider, Google Cloud, receives your IP address and browser details in order to serve pages and keep the Service secure, and may keep them briefly in server logs. We do not use analytics, and we do not show adverts.
  • Google Sign-In: If you sign in with Google, Google gives us your name, email address and profile picture. We keep your email address to run your account. We do not put your name or picture on your profile: you start with a generated username, which you can change. Firebase Authentication, our sign-in provider, holds Google's copy with your sign-in record until your account is deleted. If you joined before November 2026, your username may be the name Google supplied, and you can change it in your profile.
  • Bug Reports: If you report a bug, we also record the page you came from and your browser details, to help us reproduce it.

Campaign notes and other content you create may contain references to third-party tabletop roleplaying games, settings, adventures, or characters. That content is created by you, and such references remain the responsibility of the user who creates them. We host user-created content; we do not publish third-party material on your behalf.

Cookies

We only use cookies and similar storage that the Service needs: a sign-in cookie to keep you logged in, and settings you switch on yourself, such as your theme or whether the dice roller makes a sound, which stay in your own browser. These do not need consent, and we do not use analytics, advertising or tracking cookies.

The soundboard can play YouTube videos. When a Dungeon Master plays one, your browser loads YouTube's player, and Google receives your IP address and may set cookies under its own terms. This only happens inside a campaign that is using a YouTube track.

If you open a friend's referral link (an address beginning /r/), we set one first-party cookie, dl_ref, holding their referral code, so that when you create an account the bonus credits you were offered reach you and your friend is credited. It holds nothing about you, is never read by or shared with any third party, expires after 30 days, and is deleted as soon as you sign in. If you sign up, we record which account referred you and the days on which you create or edit notes during your first 21 days, which is how we decide whether the referral qualifies. Your friend sees your username and that progress, never your email address.

Use of Your Information

Having accurate information about you permits us to provide you with a smooth, efficient, and customized experience. Specifically, we may use information collected about you via the Service to:

  • Create and manage your account and campaigns.
  • Display your campaign notes, maps, and other data to you and other users you have shared them with.
  • Enable user-to-user communications within a campaign.
  • Monitor and analyze usage and trends to improve your experience with the Service.
  • Send you marketing emails and updates, only if you ticked the box at sign-up. You can ask us to stop at any time.
  • Request feedback and contact you about your use of the Service.

Legal Basis for Processing

Under the UK GDPR, we rely on the following legal bases to process your personal data:

  • Performance of a contract: To create and operate your account, store and display your campaign content, and provide the features you ask for. Without this data we cannot provide the Service.
  • Consent: For optional email updates and optional features you switch on, such as voice dictation. You may withdraw consent at any time.
  • Legitimate interests: To keep the Service secure, prevent abuse and fraud, diagnose faults, and handle invitations and requests. We balance these interests against your rights, and you can object at any time by contacting us.
  • Your age: We rely on your confirmation that you are 16 or over and do not otherwise check it.
  • Legal obligation: Where we must retain or disclose data to comply with applicable law or a lawful request.

Data Retention and Deleting Your Account

Accounts and campaigns are closing. Sign-in closes on 15 November 2026, and all account data is permanently deleted on 15 November 2026. If you miss the first date, email us before the second for a copy.

You can delete your account yourself on your You page (Account & plan → Delete my account). If you cannot sign in, email support@threadnotes.co.uk from the address on the account.

Deleting your account removes your profile, sign-in, private notes, characters, the messages you sent, your avatar and audio uploads, questionnaire answers and referral records, straight away. Campaigns you own are deleted for all their members, and we show you a list before you confirm. Notes you shared in someone else's campaign stay there, along with any maps or images you added to it, because other people are relying on them, but they stop being linked to you. Published roadmap items you suggested stay without your name.

How long we keep things otherwise:

  • Your account and content: until you delete them or your account.
  • A note you delete: recoverable for at least 30 days, then removed for good the next time a note is deleted in that campaign. To have one removed sooner, contact us.
  • Earlier versions of a note: a limited number per note, until the note is deleted.
  • Invitations: they expire after 14 days, and the record stays until the campaign or the inviting account is deleted.

Residual copies may persist in routine encrypted backups for a limited period before being overwritten in the normal backup cycle. Where we are required to retain certain information to comply with a legal obligation, we keep only what that obligation requires and for no longer than necessary.

Disclosure of Your Information

We do not sell your personal information. We may share information we have collected about you in certain situations. Your information may be disclosed as follows:

  • By Law or to Protect Rights: If we believe the release of information about you is necessary to respond to legal process or to protect the rights, property, and safety of others, we may share your information as permitted or required by any applicable law.
  • Third-Party Service Providers: We use third-party processors for backend functionality, listed in the section below. Their privacy policies govern their use of data.
  • AI Features: If you use an optional AI feature (such as note elaboration, summarization, The Living Book, or dictation clean-up), the relevant text you submit, which for The Living Book includes campaign notes you are allowed to read, is sent to our AI provider, Google, for processing and returned to you. AI features are optional and are only invoked when you actively use them. Raw microphone audio is never sent to us or to our AI provider. We do not use your Content to train our own AI models.
  • Within Your Campaign: Your username, avatar, and any content you explicitly share will be visible to other members of your campaigns, as described under Sharing Within Campaigns below.

Service Providers

We currently use the following processors:

  • Google Firebase and Google Cloud — authentication, the Firestore and Realtime databases, file storage for uploads such as maps and audio, and application hosting.
  • YouTube (Google) — playing soundboard tracks that a Dungeon Master has added from YouTube.
  • GoDaddy (secureserver.net) — our email provider, which relays campaign invitations and receives support email.
  • Google AI (Gemini) — processing text you submit to an optional AI feature.

If you use browser-based voice dictation, your browser vendor's speech recognition service also processes the audio captured by your microphone. That happens in your browser under the vendor's own terms and is outside our control; we receive only the resulting text.

International Transfers

Our application servers run in the United States, and Google may process data in other countries, so your personal data is transferred outside the United Kingdom and the European Economic Area. We ensure appropriate safeguards are in place as required by UK data protection law, such as adequacy regulations or approved contractual safeguards including the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses. You may contact us at support@threadnotes.co.uk for further information about the safeguards applying to a particular transfer.

Sharing Within Campaigns

Notes and other content are private to you unless you choose to share them within a campaign. Uploaded files are the exception to how that works: an uploaded map, image, audio file or avatar is stored at a long, unguessable web address that is not password-protected, so anyone who obtains that address can open the file. Do not upload anything you would not want seen if its link were passed on. Content you share within a campaign is visible to the members of that campaign according to the visibility you set on it, and Dungeon Master notes marked as secret or DM-only are not shown to players. Your username and avatar are visible to other members of campaigns you join. Changing what you have shared does not retract copies another member has already read, exported, or written down elsewhere.

Your Data Protection Rights (UK GDPR and EU GDPR)

If you are in the United Kingdom or the European Economic Area, you have certain data protection rights. We aim to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data.

  • The right to access, update or delete the information we have on you. You can view and update much of your profile information directly in your account settings, and download or delete everything from your You page.
  • The right of rectification. You have the right to have your information rectified if that information is inaccurate or incomplete.
  • The right to object. You have the right to object to our processing of your Personal Data where we rely on legitimate interests. Contact us and we will stop unless we have compelling grounds to continue.
  • The right of restriction. You have the right to request that we restrict the processing of your personal information.
  • The right to data portability. You have the right to be provided with a copy of the information we have on you in a structured, machine-readable and commonly used format. "Download my data" on your You page gives you this as a JSON file.
  • The right to withdraw consent. You also have the right to withdraw your consent at any time where we relied on your consent to process your personal information.

Please note that we may ask you to verify your identity before responding to such requests. If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us at support@threadnotes.co.uk.

Complaints

You can complain to us at support@threadnotes.co.uk, or to a supervisory authority: in the UK, the Information Commissioner's Office (ico.org.uk), or in the EEA, the data protection authority where you live or work.

United States Visitors

Our Service does not respond to browser "Do Not Track" signals, because we do not track visitors. California residents may ask what personal information we hold, and ask us to correct or delete it, using the routes in this policy.

Automated Decision Making

We do not make decisions about you based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. The AI features in the Service generate text at your request; they do not make decisions about you. Public wiki screening can automatically refuse a publication, but it affects that publication rather than your account, and you can ask a person to review it by contacting us.

Security of Your Information

We use administrative, technical, and physical security measures, provided in large part by Google Cloud and Firebase, to help protect your personal information. While we have taken reasonable steps to secure the data you provide to us, please be aware that despite our efforts, no security measures are perfect or impenetrable.

Policy for Children

You must be 16 or over to create an account. We ask you to confirm this when you sign up. We do not knowingly collect information from or market to children under 16, and we do not knowingly collect any personal information from children under 13. If you become aware that a child under 16 has an account, please contact us using the details below and we will delete it.

Contact Us

If you have questions or comments about this Privacy Policy, please contact us at: support@threadnotes.co.uk