App privacy statement

Who is responsible

The Awesome RPG apps are made by Awesome RPG, registered with the Dutch Chamber of Commerce (KvK) under number 11053393 and owned by Stefan van Dockum, Populierstraat 10, 5271 NX Sint-Michielsgestel, the Netherlands. Awesome RPG is the data controller for everything described below. For any privacy question or request, e-mail super@awesomerpg.com.

Scope

This is one statement for all our apps. Not every app uses everything described here: some apps work without an account, and not every app sells something. Where an app does something specific with your data, such as printing your e-mail address on an export, the app tells you before it happens.

What we collect

Your account. If an app lets you create an account or sign in, we store:

• Your e-mail address, and a password if you set one. Passwords are stored as a secure hash, never as text.
• The sign-in identifiers and session tokens that keep you signed in.
• Profile details you choose to add, such as a display name.
• If you sign in with Google or Apple, the basic profile those services share with us: your name, e-mail address (with Apple this can be a private relay address) and an account identifier.

What you make. The sheets, characters, scenes, images and other things you create or upload in an app are stored with your account. They are private unless you choose to publish or share them.

Purchases. When you buy something, we keep what you bought, the price, the date, the payment status and a reference from the payment provider. We never see or store your full card or bank details.

E-mail. Apps send e-mail such as sign-in links, confirmations, password resets and receipts. If you opt in to news, we also send that, until you unsubscribe.

Usage statistics. Some web apps count visits with Plausible Analytics, which uses no cookies, stores no personal data and does not follow you across websites.

Our apps show no ads, and we do not sell your personal data.

Why we use it

• To run your account: signing you in, keeping you signed in, saving what you make.
• To sell and deliver what you buy: handling the payment, unlocking the purchase and sending a receipt.
• To talk to you: account e-mail and, if you opt in, the occasional update.
• To keep the apps working and safe: fixing bugs, preventing abuse and fraud.
• To meet the law: keeping financial records for the tax authorities.

Our legal bases under the GDPR are the performance of a contract (providing the app, your account and your purchases), a legal obligation (fiscal records), your consent (news by e-mail and optional features) and our legitimate interest (security, abuse prevention and basic statistics).

Who helps process it

The apps rely on a small set of providers, each acting as our processor or as an independent controller:

• Supabase stores accounts and app data in an EU region. See Supabase's privacy policy.
• Vercel hosts the web apps. See Vercel's privacy policy.
• Brevo delivers our e-mail. See Brevo's privacy policy.
• Mollie and Stripe handle payments in the web apps. As licensed payment institutions they process your payment details under their own policies. See Mollie's privacy statement and Stripe's privacy policy.
• Apple App Store and Google Play handle downloads and in-app purchases in the phone and tablet apps, under their own privacy policies.
• RevenueCat keeps track of which in-app purchases belong to your account, using the store's receipt and an app user ID. See RevenueCat's privacy policy.
• Google and Apple handle sign-in when you choose "Sign in with Google" or "Sign in with Apple".
• Plausible Analytics counts visits in some web apps, without cookies or personal data. See Plausible's privacy policy.

International transfers

We keep data in the EU where we can. Some providers, such as Stripe, RevenueCat, Google, Apple and Vercel, may process data outside the European Economic Area, including in the United States. Where that happens, the transfer is protected by the EU-U.S. Data Privacy Framework or the European Commission's standard contractual clauses.

How long we keep it

Account data and what you make are kept for as long as your account exists. Records of purchases are kept for seven years, because Dutch tax law requires it. When you delete your account, those records stay but are no longer linked to you. E-mail we sent or received is deleted within two years unless the law requires otherwise.

Deleting your account and data

You can delete your account and the personal data that belongs to it at any time, from the account settings in the app. Can't use that option? E-mail super@awesomerpg.com from the address tied to your account and we will do it for you. More on deleting your data.

Your rights

You have the right to access, correct, delete or export your data, to object to or restrict certain processing, and to withdraw consent at any time. To use any of these rights, e-mail super@awesomerpg.com; we answer within one month. You can also complain to the Dutch Data Protection Authority (Autoriteit Persoonsgegevens) or the data protection authority in your own country.

Children

Our apps are not directed at children under 13, or under the minimum age that applies where you live, and we do not knowingly collect their personal data. Purchases are meant to be made by adults. If you believe a child has given us personal data, e-mail us and we will delete it.

Security

We use established providers with industry-standard security, including encryption in transit and hashed passwords, and we only give access to the people and systems that need it. No system is perfectly secure, but we take reasonable steps to protect your data.

Changes

We may update this statement as the apps grow. The date at the top shows the latest version. If a change matters for how we use your data, we tell you in the app or by e-mail before it takes effect.

Contact

Awesome RPG, Stefan van Dockum
Populierstraat 10
5271 NX Sint-Michielsgestel
the Netherlands
KvK 11053393
super@awesomerpg.com