Welcome to Dungeon Ledger. We are committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our application.

Data Controller

Threadnotes ("we", "us", "our") is the data controller responsible for the personal data collected through this website. If you have any questions about this Privacy Policy or wish to exercise your data protection rights, please contact us at support@threadnotes.co.uk.

Information We Collect

We may collect information about you in a variety of ways. The information we may collect on the Service includes:

• Personal Data: When you register, we collect personally identifiable information, such as your name, email address, and profile picture, primarily through authentication providers like Google. We use this to create and manage your account.
• User-Generated Content: All the content you create and upload, including campaign notes, maps, characters, sound files, and chat messages, is stored on our servers to provide the service to you and your fellow campaign members.
• Usage Data: We use Google Analytics to collect information our servers automatically log when you access the Service, such as your IP address, browser type, operating system, and access times. This helps us understand how the app is used and how to improve it. This data is only collected if you provide consent via our cookie banner.
• Data from Social Networks: If you sign in with Google, we receive information from that social network, such as your name, email address, and profile picture, which we use to populate your user profile.

Use of Your Information

Having accurate information about you permits us to provide you with a smooth, efficient, and customized experience. Specifically, we may use information collected about you via the Service to:

• Create and manage your account and campaigns.
• Display your campaign notes, maps, and other data to you and other users you have shared them with.
• Enable user-to-user communications within a campaign.
• Monitor and analyze usage and trends to improve your experience with the Service.
• Notify you of updates to the Service, if you have opted in to email communications.
• Request feedback and contact you about your use of the Service.

Legal Basis for Processing

Under the UK GDPR, we rely on the following legal bases to process your personal data:

• Performance of a contract: To create and operate your account, store and display your campaign content, and provide the features you ask for. Without this data we cannot provide the Service.
• Consent: For analytics cookies (via our cookie banner), optional email updates, and optional features you switch on such as voice dictation. You may withdraw consent at any time.
• Legitimate interests: To keep the Service secure, prevent abuse and fraud, diagnose faults, and improve how the Service works. We balance these interests against your rights.
• Legal obligation: Where we must retain or disclose data to comply with applicable law or a lawful request.

Data Retention

We keep your personal data for as long as your account remains active. If you delete your account, or ask us to delete your data, we remove your personal data and campaign content from our active systems. Residual copies may persist in routine encrypted backups for a limited period before being overwritten in the normal backup cycle. Where we are required to retain certain information to comply with a legal obligation, we keep only what that obligation requires and for no longer than necessary.

Disclosure of Your Information

We do not sell your personal information. We may share information we have collected about you in certain situations. Your information may be disclosed as follows:

• By Law or to Protect Rights: If we believe the release of information about you is necessary to respond to legal process or to protect the rights, property, and safety of others, we may share your information as permitted or required by any applicable law.
• Third-Party Service Providers: We use third-party services for backend functionality. This includes Firebase by Google for database hosting, authentication, and file storage, and Google Analytics for usage statistics where you have consented. Their privacy policies govern their use of data.
• AI Features: If you use an optional AI feature (such as note elaboration, summarization, the campaign chatbox, or dictation clean-up), the relevant text you submit is sent to our AI provider, Google, for processing and returned to you. AI features are optional and are only invoked when you actively use them. Raw microphone audio is never sent to us or to our AI provider.
• Within Your Campaign: Your username, avatar, and any content you explicitly share (e.g., "shared" notes) will be visible to other members of your campaigns.

Your Data Protection Rights (UK GDPR)

If you are in the United Kingdom or the European Economic Area, you have certain data protection rights. We aim to take reasonable steps to allow you to correct, amend, delete, or limit the use of your Personal Data.

• The right to access, update or delete the information we have on you. Whenever made possible, you can access, update or request deletion of your Personal Data directly within your account settings section. If you are unable to perform these actions yourself, please contact us to assist you.
• The right of rectification. You have the right to have your information rectified if that information is inaccurate or incomplete.
• The right to object. You have the right to object to our processing of your Personal Data.
• The right of restriction. You have the right to request that we restrict the processing of your personal information.
• The right to data portability. You have the right to be provided with a copy of the information we have on you in a structured, machine-readable and commonly used format.
• The right to withdraw consent. You also have the right to withdraw your consent at any time where we relied on your consent to process your personal information.

Please note that we may ask you to verify your identity before responding to such requests. If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us at support@threadnotes.co.uk.

You also have the right to lodge a complaint with a supervisory authority. In the UK this is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concerns directly before you do so.

Security of Your Information

We use administrative, technical, and physical security measures, provided in large part by Google Cloud and Firebase, to help protect your personal information. While we have taken reasonable steps to secure the data you provide to us, please be aware that despite our efforts, no security measures are perfect or impenetrable.

Policy for Children

We do not knowingly solicit information from or market to children under the age of 13. If you become aware of any data we have collected from children under age 13, please contact us using the contact information provided below.

Contact Us

If you have questions or comments about this Privacy Policy, please contact us at: support@threadnotes.co.uk