daggerheartsrd.com

Privacy Policy

Effective date: October 27, 2026

daggerheartsrd.com is operated by Magnus & Sons LLC ("we", "us"), which is responsible for the data described here. You can use the tools and reference with no account. This page explains what stays in your browser, what a Supporter account stores, who else handles that data, and how long we keep it. Account data is processed in the United States. Price, renewal, cancellation, and refunds are in the Terms.

What stays in your browser

Without an account, characters, encounters, and preferences (such as theme and list layout) stay in your browser. We do not receive them unless you subscribe and sync. A signed-in browser also keeps a local copy of your email, subscription status, and sync bookkeeping. There are no passwords. Clearing site data in your browser removes all of it.

The site itself sets these cookies: dh_session (sign-in), dh_checkout (finish Checkout on the success page), and dh_discord (OAuth state while linking Discord). Google Analytics may set its own.

Supporter accounts

An account starts when you verify your email (a one-time link from Subscribe or sign-in). Syncing characters and encounters requires an active paid subscription. We store:

  • Your email address, and when the account was created
  • Your Stripe customer id, subscription id, and subscription status. Card and billing details go to Stripe, not to our servers
  • Checkout session records (session id, a hash of the checkout cookie, and which account started Checkout) for a short time, so we can finish activation and reject payments that were not started while signed in
  • The characters and encounters you sync, including their names and sheet contents
  • A hash of the sign-in session. Sign-in links are single-use and expire quickly. We email the link, and you confirm it on the Account page. That mail is not marketing
  • Whether you opted in to marketing email, and when you opted in
  • Your Discord user id, if you link Discord. We use it only to grant or remove the Supporter role, and delete it when you unlink or delete the account
  • Your IP address and email, briefly, to limit abuse.

Who processes data

  • Cloudflare — hosts the website, the account API and database
  • Stripe (Link) — merchant of record for purchases: payment processing, tax where they cover it, receipts, and payment records
  • Resend — sends sign-in and other account email
  • Google Analytics — measures how the site is used, and may set cookies
  • Discord — receives your user id if you link Discord, so we can grant or remove the Supporter role

How long we keep it

  • Sessions: 14 days, sliding while you keep using the site signed in
  • Sign-in links: 15 minutes, single use
  • Abuse-prevention records: about a day
  • After the subscription ends: server saves and sessions are kept for 30 days, then deleted. The account row stays — email, Stripe customer id, and marketing opt-in — until you ask us to delete it
  • Delete account (from Account settings, or by emailing us): erases the account, sessions, and saves on our server right away. Copies in your browser are not touched. Deleted data can remain in database backups for up to 30 days. Stripe keeps its own payment and tax records

Marketing email

Optional and off by default. You can opt in on your account page. Every marketing message includes a one-click unsubscribe. Opt-in is separate from the subscription and can remain if a subscription lapses, until you unsubscribe, delete the account, or email us. Sign-in mail is not marketing.

Advertising

This site does not show ads. If that changes, this section will describe the advertising partners involved and your choices before any ads appear.

Your rights and contact

You can export your cloud saves from your account page, manage billing in Stripe's portal or through Link, opt out of marketing, or delete your account. For privacy questions or requests, contact Magnus & Sons LLC at apellusmagnus@gmail.com.

Children

This site is not directed at children under 13, and we do not knowingly create Supporter accounts for them. If you believe a child has provided personal information, contact us and we will delete the account.

Changes

If this policy changes in a meaningful way, we will update this page and the effective date above.

See also the Terms and Account.