Privacy policy

Last updated 22 September 2026

Who we are

Dungeon Screen ("we", "us") is an independent business based in Queensland, Australia. Questions about this policy or your data go to contact.dungeonscreen@gmail.com.

What we collect

To run your account we store your email address and the campaigns you create: pages, cards, compendium entries, maps, story points and settings. If you set a display name we store that too. If you import a character from D&D Beyond we fetch the public character on your behalf and keep only the names and numbers needed for the sheet, never the descriptive text.

Players who join with a code are not asked for an account. The name a player enters is kept in their own browser. Rolls and edits a player makes on a card the DM shared with them are stored against that campaign so the DM can see them.

If you subscribe, the sale is made through Stripe, which acts as the seller of record for payments. Stripe collects your name, billing address and payment details to take payment and work out the tax that applies where you live, under its own privacy policy. We never see your card number. We store your Stripe customer reference, which plan you are on and its status.

How it is used

Your data is used to show you your campaigns, to deliver sign in emails, to share the cards you choose with the people you share them with, and to bill you if you subscribe. We do not sell it, use it for advertising, or train models on it. There are no ads on Dungeon Screen and there never will be.

Sharing

A card is only visible outside your account once you mark it as shared. From then on it is visible to whoever holds the matching code or link, and to anyone they pass it to. Passcodes limit that: a link protected by a passcode reveals nothing until the passcode is entered, and repeated wrong guesses lock the link for a while. Passcodes are short by design so they can be read out at a table, so treat them as a convenience, not a vault. Cards not marked as shared never leave your account.

Where it lives

Your data is hosted by Supabase in Sydney, Australia, for the database and sign in; Netlify for the site itself, served from a global network. Stripe handles payments, tax and receipts as seller of record. Each of these providers processes data on our behalf under their own security commitments. A copy of your open campaign is cached in your browser so the screen keeps working if your connection drops.

Cookies and storage

We use browser storage to keep you signed in, to cache your campaign, and to remember preferences like the bookshelf view, display layouts and which tours you have seen. There are no advertising or tracking cookies. Stripe sets its own cookies on its checkout pages.

How long we keep it

Your campaigns stay until you delete them or your account. Player rolls and edits are kept with the campaign they belong to. Stripe keeps billing records for as long as tax law requires. Server logs are kept for a short period to keep the service running and are then discarded.

Your choices

You can export every campaign as a file, edit or delete campaigns at any time, and delete your account from the Account page. Deleting your account removes your campaigns, shared cards and player links immediately, cancels any subscription straight away and removes your saved payment details from Stripe. If you want a copy of the data we hold about you, or want something corrected, email us.

Children

Accounts are for people 16 and over. Players joining with a code do not need an account and we do not ask them for personal details.

Changes

If this policy changes in a way that matters, the date at the top moves and signed in users are told on their next visit.