Privacy Policy

This Privacy Policy explains what personal data we collect when you use Waystones, how we use and protect it, and the choices you have. We are committed to protecting your privacy and to complying with the General Data Protection Regulation (GDPR) and other applicable data protection laws.

We collect and process the following personal data:

• Email address — used to create your account, sign you in, and send sign-in links and password resets.
• Password — securely hashed; we never store or see your plaintext password. If you sign in with Google or Discord, we receive your email address and name from that provider instead.
• Display name and character names — the name you choose for yourself, and the character name and class you give in each campaign.
• Campaign content — the campaigns, sessions and events your party logs: people, events, battles, locations and loot, with any notes, plus kill claims and MVP votes.
• Preferences — the theme you pick.
• Payment details — if you subscribe to Pro, Stripe processes your payment. We store your subscription status and Stripe's customer reference, never your card number.
• IP address and browser metadata — collected automatically by our hosting infrastructure for security and to run the service.

We process your personal data under the following legal bases as defined by the GDPR: (a) Contract performance — processing necessary to provide the Waystones service you signed up for, including your account, your party's log, and billing. (b) Legitimate interest — processing necessary for service security, abuse prevention, and running our infrastructure.

Members of a campaign see everything logged in it, including each other's display names and character names. Nobody outside a campaign can see it. A Waystone Card that the campaign's DM chooses to share by link is public to anyone who has that link until the DM stops sharing it; it shows the session's summary and character names, never email addresses. We do not sell personal data, and we do not use it for advertising.

Waystones is operated from the United States. We use the following third-party data processors: Supabase Inc. (database and authentication), Netlify, Inc. (hosting), Stripe, Inc. (payments), and an email delivery provider for account emails. Your data may be transferred to and processed in the United States. These transfers are protected by Standard Contractual Clauses (SCCs) and the data processing agreements we maintain with our processors.

Waystones uses only strictly necessary cookies, which keep you signed in. They are essential for the service to function and do not require consent under GDPR. We do not use tracking, advertising, or analytics cookies.

We retain your personal data for as long as your account is active. Campaign content is kept for as long as the campaign exists. When you delete your account, your name, email, sign-in and billing records are permanently deleted, along with the campaigns you run and every session and event in them. In campaigns run by other people, the character you played keeps its seat: the events you logged, your kill claims and your MVP votes stay with that party under the character's name only, with nothing linking them to you. The campaign's DM can remove that seat.

If you are located in the European Economic Area (EEA), you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate personal data. You can change your display name on the Account page and your character name in each campaign.
• Right to erasure — delete your account at any time from the Account page. To also have a character's seat removed from another party's campaign, ask that campaign's DM or contact us.
• Right to data portability — request an export of your data in a machine-readable format.
• Right to object — object to our processing of your personal data under certain circumstances.
• Right to restriction — request that we limit the processing of your personal data.

To exercise any of these rights, contact us at the address below. We respond within 30 days.

We implement appropriate technical and organizational measures to protect your personal data, including encrypted data transmission (TLS), secure password hashing, sign-in cookies that scripts cannot read, and row-level security policies on our database so that each campaign is readable only by its members. No method of transmission or storage is 100% secure, and we cannot guarantee absolute security.

We may update this Privacy Policy from time to time. We will notify you of any material changes by posting the updated policy on this page. Your continued use of Waystones after changes are posted constitutes acceptance of the updated policy.

If you have questions about this Privacy Policy or wish to exercise your data rights, contact us at:

Waystones is operated by Gyles Fohl. hello@waystones.cc