Privacy notice for DMs
Draft for legal review (#271). Anything marked TODO is a fact Adam or the lawyer must fill in or check before this goes live.
Last changed: TODO (date of the reviewed version)
This notice is for anyone with an account: DMs and co-DMs. Players who join a table with a code have their own, shorter notice.
Who we are
The Ledger is run by Adam Hardwick, a sole trader in the UK. Adam is the "controller" for everything The Ledger holds. That means Adam decides what is kept and why, and answers for it. This covers your account, your campaigns, and everything you, your players or your Claude write in them, including what you write about your players.
You are not responsible for your players' data on The Ledger: we are. If a player or a parent asks you about their data, send them to us.
- Contact: privacy@TODO (domain, once the new public name is chosen)
- Trading name and postal address: TODO (Adam)
- ICO registration number: TODO (once the ICO fee is paid)
What we hold
Your account
- Your name and email address
- Your password, stored only as a hash we can't reverse (if you set one)
- Passkeys and two-step sign-in settings (if you turn them on)
- An id from Google or Discord (if you sign in with them). We don't get your Google or Discord password
- That you confirmed you are 13 or older, and when
- Your plan, and the ids Paddle gives your customer record and subscription
- Claude connections you make to The Ledger
- Your sign-in sessions: the browser and IP address, to keep your account secure
Your campaigns
- Everything you and your Claude write: characters, notes, fights, the world, how-tos and the session log
- What your players write: backstories, notebooks, asks and rolls
- Pictures you upload (portraits, monster art and maps). We re-save each one without its hidden details, like where and when it was taken
Seats
- The seat's name, which you choose. Please use only a first name or a nickname, never a full name
- A scrambled copy of the seat's device key, when it was last used, and whether it is "At table" or "Remote"
Problem reports
- What you type into "Report a problem". We add nothing about you, so add your email in the message if you want a reply
To keep the service working
- Our hosting's request logs, which include IP addresses
- Counters that stop too many tries in a row, kept by IP address for up to an hour
- Error reports with personal details taken out (no names, emails, IP addresses or anything players wrote)
We don't hold card details or billing addresses. Paddle takes payments and keeps those.
Why we hold it
The law needs us to have a reason, called a "lawful basis", for everything we hold.
- To run your account and The Ledger for you (contract): your account, campaigns, seats and pictures.
- To keep The Ledger safe and working (legitimate interests): sign-in sessions, rate limits, error reports, backups and problem reports. We use these only to keep the service secure and to fix it.
We don't ask for consent for anything, because we don't do anything that needs it: no advertising, no tracking and no marketing emails. We only email you about your account and the service: sign-in links, codes, billing notices and replies to your reports.
TODO (lawyer): check these lawful bases, and whether what DMs write about players needs anything more.
Cookies
We use only the cookies The Ledger needs to work, so there is no cookie banner.
| Cookie | What it does | How long |
|---|---|---|
Session (the-ledger-session) |
Keeps you signed in while you use the site | 2 hours after you last do something |
XSRF-TOKEN |
Stops other websites sending forms as you | Same as the session |
remember_web_… |
Keeps you signed in if you tick "Remember me" | TODO (check the length) |
seat_… |
Keeps a player's device on their seat | 180 days |
display_… |
Keeps a TV on your table display | 180 days |
sidebar_state |
Remembers if your sidebar is open | 7 days |
appearance |
Remembers if you chose light or dark | 365 days |
| Paddle's cookies | Taking payment, on billing pages only | Set by Paddle |
No third-party script ever loads on player or TV pages.
TODO (lawyer): confirm each of these counts as strictly necessary, including
sidebar_stateandappearance.
Who else handles it
These companies run parts of The Ledger for us. They may only use your data to do that job.
| Company | What for | Where |
|---|---|---|
| Laravel Cloud | Runs the app, database, cache and logs | London, UK |
| Cloudflare R2, through Laravel Cloud | Stores uploaded pictures | EU |
| Sentry | Error reports, with personal details taken out | Frankfurt, Germany |
| Resend | Sends our emails | Ireland |
Resend sends our emails from Ireland but keeps its own account records, such as its email logs, in the USA. Each of these has a parent company in the USA. TODO (lawyer): name the safeguard for each (the EU–US Data Privacy Framework and UK extension, or standard contractual clauses).
These are not working for us, so their own privacy notices apply:
- Paddle takes payments and handles tax and invoices as the seller.
- Google and Discord, only if you sign in with them.
- Your own Claude (Anthropic). When you connect Claude, it reads and writes your campaign because you ask it to, under your own terms with Anthropic. We never send your campaign to an AI company ourselves.
We never sell your data or share it for advertising.
How long we keep it
| What | How long |
|---|---|
| Your account | Until you delete it |
| Campaigns, seats, characters and pictures | Until the campaign or your account is deleted |
| A player's notebook | Until its seat is deleted, or you give the seat to a new player |
| Sign-in sessions | Until they run out or you sign out |
| Rate-limit counters | Up to 1 hour |
| Error reports | 90 days |
| Hosting logs | TODO (Adam: check how long Laravel Cloud keeps them, and write it in the record) |
| Problem reports | 12 months |
| Backups | Deleted data is gone from backups within 30 days |
If nobody signs in to an account and it runs no live session for 3 years, we email to warn you. If nobody signs in within 30 days after that, we delete the account.
TODO (Adam): data export from Settings and the 3-year clean-up come in Phase 6. Until then, export is by email to privacy@, answered by hand.
When you delete your account, it goes from The Ledger at once, with every campaign you own and all their seats, notebooks and pictures. Campaigns you only co-ran or played in stay with their owner.
Your rights
You can ask us to:
- give you a copy of your data
- correct it
- delete it (you can also delete your account yourself from Settings)
- stop or limit using it
- send it to you in a form another service can read
Email privacy@TODO. We answer within one month. We may ask you to prove the account is yours first.
If you are unhappy with how we handle your data, please tell us first. You can also complain to the Information Commissioner's Office (ICO) at ico.org.uk, or to the data protection authority where you live.
Children
Accounts are for people aged 13 or over (16 or over where the law where you live says so). Players of any age can join a table with a code and need no account. Players get a notice written for them.
Changes
If we change this notice, we change the "Last changed" date and list what changed below. If a change affects what we hold or who we share it with, we email you.
- TODO: first published version