Privacy policy

Dan & Dragons Companion
Version 1 · Effective date: 1 November 2026 · Last updated: 1 November 2026

This policy explains what personal data the Dan & Dragons Companion app ("the app") collects, why, who processes it, where it is stored, how long it is kept, and what your rights are under the General Data Protection Regulation (GDPR).

1. Who is responsible

The controller of your personal data is Daniel Christiani, an individual developer in the Netherlands ("we", "us"). For anything about your data, including the requests in section 9, email info@dananddragons.com.

2. The short version

We only collect what the app needs to work: your account, your profile name, what you and your group add to your campaigns, and a device token if you allow notifications.
No ads, no analytics, no tracking, no profiling. We never sell your data.
Your app data is stored in the EU (Belgium and the Netherlands) by Google Firebase. Sign-in and push notifications also involve Google services outside the EU (section 6).
You can delete your account and data in the app at any time (Profile → Delete account).

3. What we collect and why

3.1 Your account

Data	Why	Legal basis
Email address, password (stored by Firebase Authentication as a one-way hash, never readable by us), whether your email address is verified, when the account was created and when you last signed in	To create your account, let you sign in, verify your address and reset your password	Contract (Art. 6(1)(b))
If you continue with Google: the name, email address and Google account ID that Google sends to the app, and a link to your Google profile picture if you have one (stored by Firebase Authentication; the app doesn't use or show the picture)	To sign you in with your Google account	Contract (Art. 6(1)(b))
Display name, when your profile was created, and which version of the terms you accepted	Your display name is shown to the members of your campaigns; the terms version records your acceptance	Contract (Art. 6(1)(b))

When you sign up with Google, your Google name becomes your display name; you can change it on the Profile screen. Your email address is never shown to other users.

3.2 What you add to campaigns

Everything you add to the app is stored so that you and the members of your campaigns can use it (contract, Art. 6(1)(b)):

Campaigns (as DM): name, description, cover image, settings, and the campaign's invite code.
Membership: which campaigns you are in, your role (DM or player), when you joined, a copy of your display name, and your notification setting for that campaign.
Characters (as a player): name, ancestry, class, level, backstory, portrait, hit points and Armor Class.
Inventory: items (name, quantity, notes, details), coins, private notes, and who gave you an item.
DM content: NPCs, maps and lore, with their images and the DM's notes on them.
Session journal: session numbers and dates, the DM's recaps and notes, and players' session notes.

Images: the app shrinks and re-encodes every image on your phone before uploading it. This also removes metadata embedded in photos, such as where a photo was taken.

Who can see it:

What	Who can see it
Campaign name, description and cover; members' display names; characters' profiles and portraits; session dates; players' session notes	All members of the campaign
A character's hit points and Armor Class	The player and the DM; the whole campaign while the DM's "Show HP and AC to the party" setting is on
A character's inventory, coins and private notes	The player and the DM of that campaign (they're private from the other players, not from the DM)
NPCs, maps, lore and recaps	The DM; players only once the DM reveals them
The DM's notes on content and sessions; the invite code	Only the DM
Players' session notes the DM has hidden	The note's author and the DM

Other members can also share what they see in the app with others outside it (for example in a screenshot); we can't prevent that.

3.3 Push notifications

If you allow notifications on your Android phone, the app stores a device token from Firebase Cloud Messaging for that phone with your account, together with a random device ID that the app creates, the platform (Android) and when it was stored or updated. We use it only to send you notifications about your campaigns: when the DM reveals a recap, an NPC, a map or lore; when a player adds session notes; when a player joins your campaign (as DM); when someone gives you an item or coins, or the DM changes your coins or items; and when the DM changes your character's hit points.

You can switch notifications off per campaign on the campaign's Campaign tab, or for the whole app in Android's settings. The device token is deleted when you log out on that phone and when you delete your account, and tokens that Firebase reports as no longer valid are deleted when we try to send to them.

Legal basis: your consent (Art. 6(1)(a)), given through Android's notification permission. You can withdraw it at any time as described above.

3.4 Reports

When you report something, we store your user ID, the campaign, what you reported and the reason you gave, and when. The report is emailed to the developer with your display name and user ID, so we can review it and act on it. We also count how many reports you sent that day, to limit reports to 10 a day; that count is deleted 7 days later.

When someone reports content you added, the report refers to that content and the campaign it is in. When someone reports you as a member of a campaign, the report refers to you there, and the email to the developer includes your display name and user ID.

Legal basis: our legitimate interest in keeping the app safe and free of abuse, and in enforcing the terms of use (Art. 6(1)(f)).

3.5 Technical data

IP address and request data: Google processes your IP address and similar technical data to deliver the app's requests and to protect the service against abuse.
Server logs: our server functions write logs (for example when an account is deleted) that can contain your user ID and technical details of a request, including the IP address. We use them to find and fix errors and to investigate abuse.
App Check: the app uses Firebase App Check with Google Play Integrity, so that our services can check whether requests come from the real app on a genuine Android device. Google Play services checks the device and the app, and the app sends the resulting token with its requests; we don't receive information about you or your device from it.

Legal basis: our legitimate interest in running the app securely and reliably (Art. 6(1)(f)).

3.6 On your phone

To work offline and start quickly, the app keeps data on your phone: a copy of the campaign data you can see, your campaign list, cover images and portraits, drafts of text you haven't saved yet, changes waiting to be sent, which revealed items you've already opened, and the random device ID for notifications. This stays on your phone and isn't shared with us. Some of it is removed when you log out; all of it is removed when you uninstall the app or clear its data.

3.7 What we don't do

No analytics or crash reporting, no advertising, no tracking across apps or websites, no profiling or automated decisions about you, and no selling or renting of your data.

4. Who processes your data

We use these processors, under data processing agreements:

Processor	What for	Where
Google (Firebase: Authentication, Cloud Firestore, Cloud Storage, Cloud Functions, Cloud Messaging, App Check; Google Cloud logging)	Hosting the app's data and images, sign-in, server functions, push notifications, device checks, logs	App data and images in the EU (section 5); Authentication, Cloud Messaging and App Check may process data globally, including in the United States
Brevo (Sendinblue SAS, France)	Sending the email about each report to the developer	EU

Google Sign-In is provided by Google; when you continue with Google, Google's own privacy policy applies to your Google account.

Within a campaign, the other members see what is described in section 3.2. We don't share your data with anyone else, unless the law requires us to (for example a court order), or to protect the safety of users when content is clearly illegal.

5. Where your data is stored

Your campaign data is stored in Cloud Firestore in the EU (the eur3 multi-region: Belgium and the Netherlands). Images are stored in Cloud Storage in the Netherlands (europe-west4), and our server functions run in the Netherlands (europe-west4).

6. Transfers outside the EU

Firebase Authentication, Firebase Cloud Messaging and App Check are global services of Google, which may process your account data, device token and technical data in the United States. Google LLC is certified under the EU-US Data Privacy Framework, and Google's data processing terms include the European Commission's standard contractual clauses.

7. How long we keep it

Data	Kept until
Your account and profile	You delete your account
A campaign and everything in it	The DM deletes the campaign or their account
Your character, with its inventory, coins, private notes, hit points and portrait	You leave the campaign, the DM removes you, the campaign is deleted, or you delete your account
Your session notes	You delete your account or the campaign is deleted (they stay in the journal when you leave a campaign; the DM can delete them)
Device tokens	You log out on that phone, the token stops being valid, or you delete your account
Reports	1 year after the report was made. If you delete your account, your reports are kept for that year without your user ID.
Your daily report count	7 days after the day it counts
Server logs	30 days
Report emails in the developer's mailbox	1 year, like the reports

8. Deleting your account

Delete your account in the app: Profile → Delete account (also on the "verify your email" screen). The app asks you to confirm with your password or Google account. Deleting your account permanently deletes:

your account and profile, and your device tokens;
every campaign you are the DM of, with everything in it, for all of its players;
your characters, with their inventory, coins, private notes, hit points and portraits, in every campaign you play in;
your session notes in every campaign, including campaigns you have left;
your daily report count, if it hasn't been deleted already.

Reports you sent are kept until their year is up (section 7), but without your user ID. This can't be undone.

If you can't use the app, email info@dananddragons.com from the address of your account and we will delete it for you. The steps are also explained at https://www.dananddragons.com/app/delete-account.html.

9. Your rights

Under the GDPR you have the right to:

access the personal data we have about you, and get a copy of it;
rectify it (you can change your display name and everything you added in the app yourself);
erase it (section 8);
restrict its processing, or object to processing based on our legitimate interest;
data portability: receive the data you gave us in a common, machine-readable format;
withdraw your consent for notifications at any time (section 3.3).

Email info@dananddragons.com to use these rights. We answer within one month. We may ask you to confirm that the account is yours, for example by writing from its email address.

You also have the right to complain to a data protection authority. In the Netherlands this is the Autoriteit Persoonsgegevens (https://autoriteitpersoonsgegevens.nl); you can also contact the authority of the EU country you live in.

10. If you live outside the EU

The app is offered from the Netherlands, and your data is stored and processed in the EU (section 5) under the GDPR, wherever you live. This policy and the rights in section 9 apply to everyone who uses the app. If the law of the country you live in gives you more rights, you have those too; email info@dananddragons.com to use them.

Brazil. If you live in Brazil, the Lei Geral de Proteção de Dados (LGPD) gives you the right to: confirmation that we process your data; access to it; correction of incomplete, inaccurate or outdated data; anonymisation, blocking or deletion of data that is unnecessary, excessive or processed against the LGPD; portability; deletion of data processed with your consent; information about whom we share your data with (section 4); information about the possibility of not giving consent and its consequences; and withdrawal of consent. Your data is stored in the EU and protected there under the GDPR (sections 5 and 6). Email info@dananddragons.com to use these rights. You can also complain to the Autoridade Nacional de Proteção de Dados (ANPD): https://www.gov.br/anpd.

11. Age

The app is only for people aged 16 and over. If you believe someone younger has created an account, let us know and we will delete it.

12. Security

All communication between the app and our services is encrypted. Security rules on the server make sure each user can only read and change what they are allowed to (section 3.2), and App Check lets our services check that requests come from the real app. Passwords are handled by Firebase Authentication and never stored or seen by us in readable form.

13. Changes to this policy

When we change this policy, we publish the new text here with a new version number and, for important changes, tell you in the app.