Privacy

• Account details: your name, email address, user identifier, and authentication information.
• Campaign content: the lore, notes, comments, questions, images, and other material you choose to put in the service, together with campaign membership and permissions.
• Session recordings: audio a Dungeon Master uploads, plus the transcript and recap made from it. A recording may include the voices and personal information of people who do not have an account.
• Technical data: information needed to operate, secure, diagnose, and understand use of the service, such as request, device, and usage information.
• Messages to us: information you include in support or privacy emails.

We use account, campaign, and technical data to provide the service you ask for: signing you in, keeping your campaigns available, enforcing access controls, searching your lore, and responding to support requests.

When you choose a conjuring, search, image, or recording feature, the relevant content is sent to the provider needed to perform that request. We also use limited technical data for our legitimate interests in protecting, maintaining, and improving the service, and use data where necessary to meet legal obligations.

For session recordings, we rely on legitimate interests in helping a Dungeon Master produce a transcript and recap. The Dungeon Master must tell everyone at the table before recording. A recorded participant can object or ask for their recording data to be deleted without having an account or giving a reason.

• Clerk provides account sign-in and identity services.
• MongoDB stores service and campaign data.
• Vercel hosts the service, stores uploaded audio, and provides website analytics.
• Anthropic processes text for conjuring, chat, summaries, and other writing features.
• OpenAI processes text for semantic search and images, and transcribes session audio.

These providers may process data outside the UK. Contact us for details of the locations and safeguards that apply to a particular request.

Account and campaign data is kept while you use the service. A campaign marked for deletion can be restored for 30 days; after that, its service data is permanently purged.

We tell tables that session audio is intended to be deleted about 7 days after transcription. Automatic deletion is not yet operating, so audio may be kept longer. It may remain with the campaign until it is permanently deleted or we uphold a recorded participant's deletion request. Transcripts and recaps are kept with the campaign on the same terms. Records showing that a privacy request was handled are kept separately and do not include the requester's contact details.

Support and privacy emails are kept only as long as needed to answer the request, keep an appropriate record, or meet a legal obligation. Our service providers may keep their own limited copies under their published retention terms.

Depending on the circumstances, you may have rights to access, correct, delete, restrict, or receive a copy of your personal data, and to object to how it is used. Email privacy@arcanecompendium.com to make a request. We may need enough information to verify that the data is yours.

If your voice was captured at someone else's table, use the public recording deletion request. You do not need an Arcane Compendium account.

You can also complain to the Information Commissioner's Office. We would appreciate the chance to address your concern first.

The data controller is Stoke Labs Limited, company number 17033711. For privacy questions or requests, email privacy@arcanecompendium.com.