Privacy policy

GralRPG is a free tool that runs in your browser. If you do not sign in, we collect nothing about you at all. An account exists only so that you can keep your documents with us, and this policy says what it stores.

Who is responsible

The controller of your personal data is Grzegorz Marczewski. Write to legal@gralrpg.com about anything in this policy.

If you do not sign in

Nothing is collected. There is no analytics, no advertising, no tracking pixel and no third-party script anywhere on this site. Your drafts, and the images you upload into them, are saved in your own browser's storage, on your device, and leave it only if you sign in and save a document to your account.

Our hosting provider records ordinary request logs, including the IP address the request came from. That is what keeps the site running and lets us see abuse.

If you sign in

An account comes into being the first time you sign in; there is no separate registration step and there are no passwords. From that moment we store:

• the identifier your sign-in provider gives us (Google or Discord), or the email address you typed to receive a code
• your email address, if the provider confirmed to us that it is yours
• the date the account was created and the date you last signed in
• the documents you choose to save to the account, with their titles
• the pictures in those documents, as image files. Your browser redraws every picture before it is kept, which strips the location, the camera and the other details a photograph can carry
• the music albums you make: their names and descriptions, and the title, link and note of each track
• if you run a campaign: the names you give the players you invite into it, which you choose yourself, and which of your handouts each of them has been given
• if you accept a game master’s invitation: that your account joined their campaign as the player they named, and when

We ask your provider for no name at all, and hold none: not the one Google shows on your account, not your Discord nickname. We do not ask for and do not hold a password, a telephone number, a postal address, a date of birth or any payment details. We do not profile you and we make no automated decisions about you.

Players and game masters

A game master invites a player with a link they make here and send themselves. We never ask for the address of the person invited and never write to them. A player who accepts can read, and download, the handouts the game master has put in their suitcase, as those handouts are now, for as long as they stay there; they see the campaign's name and the name the game master gave them, and nothing else of the game master's account. The game master sees that the player joined and when, and nothing else of the player's account: not their address and not how they signed in.

Why, and on what legal basis

• To run your account and keep the documents and pictures you save — art. 6(1)(b) GDPR, performance of the contract the terms describe.
• To send a sign-in code to the address you gave — art. 6(1)(b) GDPR.
• To show a player the handouts a game master gave them, and to show the game master that the player joined — art. 6(1)(b) GDPR, the service both of them asked for.
• To keep the service available and unabused: request logs, rate limits, quotas — art. 6(1)(f) GDPR, our legitimate interest in a service that works and is not flooded.

Who else sees it

• Cloudflare — serves the site itself.
• Fly.io — runs our API, in Frankfurt.
• MongoDB Atlas — holds the database, in Frankfurt.
• Cloudflare R2 — holds the pictures in the documents you save, in the European Union.
• Resend — receives your address in order to deliver a sign-in code, and only if you sign in that way.
• Google and Discord — if you sign in through them. They are separate controllers of what happens on their side, under their own policies.

Your data sits on servers in the European Union. The providers above are companies from outside it whose staff may hold administrative access; where that happens it rests on standard contractual clauses or on an adequacy decision. We sell nothing to anybody and we have no advertising partners.

How long we keep it

Your account, its documents and their pictures stay until the account is deleted, and we delete an account you have not signed into for two years. A picture that no saved document uses any more may be deleted once it is 30 days old, when the account needs the room. A player stops being linked to your account the moment you leave their campaign, the game master removes them or deletes the campaign, or either account is deleted. An invitation link stops working once it is used, replaced or two weeks old. A sign-in code and its record are deleted automatically within an hour. Server logs live as long as the hosting provider keeps them.

Your rights

You may ask for access to your data, for a copy of it, for it to be corrected, deleted or restricted, and you may object to processing based on our legitimate interest. Write to legal@gralrpg.com and we will answer within one month.

You may delete the account yourself, in the app settings, or write to us from the address the account holds. Either way the account goes with everything saved to it, and this cannot be undone. If you think we are handling your data wrongly, you may complain to the President of the Personal Data Protection Office (ul. Stawki 2, 00-193 Warszawa).

Cookies and browser storage

There is no cookie banner here because there is nothing to ask consent for. We use no advertising or analytics cookies. This is everything stored on your device; each item is either necessary for the service you asked for or a choice you made yourself:

• browser storage holding your drafts and the pictures in them, on your device, until you clear it
• browser storage remembering the colours you chose for the app, on your device, until you clear it
• browser storage remembering that you chose to skip the tour on the start page, on your device, until you ask to watch it again or clear it
• browser storage remembering the game system you chose in the app settings, on your device, until you choose none or clear it
• browser storage remembering the paper you chose in the app settings when it differs from the one your time zone suggests, on your device, until you choose that one again or clear it
• your sign-in token: in session storage, which disappears when you close the tab, or, if you tick “Keep me signed in on this device”, in browser storage on your device for at most 30 days, until you sign out or clear it
• session storage carrying that choice while you sign in through Google or Discord, removed as soon as you are back
• session storage carrying an invitation you opened while you sign in to accept it, removed once it is accepted or no longer works
• one technical cookie on our API, set only while a sign-in is in progress, which expires after ten minutes

To choose paper for printing, the app reads your device's time zone inside the browser; it is neither stored nor sent anywhere. You can clear all of it in your browser's settings at any time, and the drafts alone in the app settings, where you can also download a copy of them first. Clearing it also removes the drafts kept in that browser, which exist nowhere else.

Security

Every connection is encrypted. We hold no passwords, because there are none. A sign-in code is stored only as a cryptographic digest, works once and expires after ten minutes. A saved document is readable only by the account that saved it, and by a player that account has given it to while it stays in their suitcase, and so is a picture: the storage it sits in is private, and it can be fetched only through a link our API signs, for its owner or for a player holding a handout it is in, which works for one minute. An invitation link is stored only as a cryptographic digest and works once.

Changes

This version is of 17 October 2026. We will say on the site before anything material changes, and the current version is always here. The rules of using the service are in the terms of service.