Draft. This text has not been reviewed by a lawyer yet and may change.
In short
- This website sets no cookies and loads no analytics or trackers.
- By default the client keeps your characters only on your computer.
- If you create an account, we store your email, display name, language and game data so that the cloud and campaigns work.
- If you sign in with Google, Discord or Twitch, we receive only your email, name and avatar link from that service. We never receive your password there.
- We do not sell your data and do not use it for advertising.
Who is responsible
The owner of the TTG Universe project. Questions about your data: support@ttg-universe.party.
The website
The website is static and hosted on Cloudflare. To serve pages and protect the site from attacks, Cloudflare processes technical request data: IP address, browser and time. We do not build visitor profiles from it.
The client without an account
Characters, portraits and settings are stored in the app folder on your computer. The app’s log is also stored locally and is not sent anywhere automatically.
Account and cloud
When you create an account or sign in, we process:
| Data | Why |
|---|---|
| Sign-in, emails with codes, contacting you about your account | |
| Password hash (only if you sign in with email and password) | Sign-in. We never see or store the password itself |
| Display name | Showing who you are in your account and campaigns |
| Interface language | The app language and the language of our emails to you |
| Characters, campaigns, journal, rolls, notes, uploaded images | Sync and playing together |
| IP address and sign-in time | Security: protection against password guessing and abuse |
| Your community role (“Enthusiast” or “Founder”) | Your profile badge and cloud access: the cloud and campaigns are open to the Founder role |
Who sees your data. Campaign data is visible to its members according to their roles. A character’s notes are visible to the game master of the campaign that character plays in. Other players and game masters of other campaigns cannot see them.
Sheet links. If you create a link to a sheet, anyone signed in to TTG Universe who has it sees a read-only snapshot of the sheet and your display name, and can save their own copy. Notes, the journal, portraits and the campaign are not shared through the link. We store a hash of the link code rather than the code itself, the expiry date, the number of opens and the time of the last open. You can revoke a link at any time under “My links”, and it stops opening immediately. Copies others have already saved stay with them.
Legal bases (for users in the EU): performing the agreement to use the service, legitimate interest in security, and consent for optional account linking.
Signing in with Google, Discord or Twitch
You can sign in with a Google, Discord or Twitch account instead of a password. You choose this yourself, and the service shows you what it will share before you agree.
What we receive from the chosen service:
- your account ID at that service;
- your email address and whether it is verified;
- your name or username;
- the link (URL) to your profile picture.
What we never receive: your password at that service. You enter it only on the service’s own page. We also get no access to your contacts, messages, files, servers, channels or anything else in that account.
How we use it: only to sign you in and to show your name and picture in your account. We do not use it for advertising, do not sell it and do not share it with anyone except the providers that run the service for us (see below).
How it is stored: together with your account in Supabase in the EU, see “Where data is stored”.
How to remove it: you can revoke access at any time in the settings of your Google, Discord or Twitch account. This stops new sign-ins through that service but does not delete what we already store. To delete it, delete your account as described in “Retention and deletion”.
Google user data
TTG Universe’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, we use Google user data only to sign you in and show your account. We do not use it for advertising, do not sell it, do not use it to train AI models, and do not let people read it unless you ask us to (for example, in a support request), it is needed for security, or the law requires it.
Where data is stored
We use these providers. They process data on our behalf and under their own data protection terms:
| Provider | What it does | Where |
|---|---|---|
| Supabase | Accounts, sign-in and the cloud database and files | EU, Ireland (eu-west-1) |
| Resend | Sending emails with codes (sign-up, sign-in, password reset) | EU, Ireland (eu-west-1) |
| Cloudflare | Hosting this website | Global network, nearest data centre |
If you are outside the EU, your data is transferred to the EU.
Cookies and local storage
This website sets no cookies and stores nothing in your browser.
The app is not a website and uses no cookies. To keep you signed in, it saves a session key in Windows Credential Manager. Windows encrypts it and only your Windows user can read it. Signing out removes it.
Donations
Donations are handled by Boosty under its own terms. We only see what Boosty shows to creators. Payment details never reach us.
Retention and deletion
We keep your account data for as long as you have an account.
How to delete your account. Deleting the account from inside the app is not available yet. Until it is, write to support@ttg-universe.party from the email of your account (or, if you sign in with Google, Discord or Twitch, from the email of that account) and ask us to delete it. We will delete your account and cloud data, including what we received from Google, Discord or Twitch, within 30 days and reply when it is done.
Characters stored on your computer are not affected: to remove them, delete them in the client or remove the app folder.
Backups are kept for a limited time and then overwritten automatically. Security logs are kept as long as needed to protect the service.
Your rights
You can request a copy of your data, correct or delete it, object to processing or withdraw consent. Write to support@ttg-universe.party. Users in the EU can also complain to their national supervisory authority.
Age
The service is not intended for children under 13. In the EU, children below their country’s age of digital consent need parental consent.
Changes
If this policy changes, we will update this page and the date below. We will announce significant changes in the app.
Last updated: