Privacy policy

Last updated 26 October 2026

The Warded Atlas is a tool for running tabletop roleplaying games, made by Brayden (“we”, “us”) in Australia. This policy explains what information the app handles, where it goes, and the choices you have. We have tried to keep it short and plain.

The short version

• Without an account, everything you make stays on your own device. We never see it.
• With an account, the worlds you choose to sync are stored in our cloud database so they can reach your other devices and your players.
• We don’t sell your information, show ads, or use tracking or analytics.
• You can delete your account and cloud data at any time.

What we collect

Account details. If you make an account we store your email address and a securely hashed password. If you sign in with Google or Facebook, we receive your name, email address and profile picture link from them. We don’t receive your Google or Facebook password, contacts or posts.

Content you sync. When you turn on sync for a world, its pages, maps, images, sessions, notes and settings are stored in the cloud. If you join someone else’s world as a player, your display name, the characters you claim, the notes, questions and party items you write, and your answers to session scheduling polls are stored with that world. When someone uses the X-card safety tool, we only record that it was tapped and when, not who tapped it.

Session recordings and transcripts. Recordings capture the voices of everyone at the table, so game masters must ask everyone before recording (see our terms). Recordings are kept on the device that made them. Transcripts and recap drafts are only visible to the game masters of that world, and sync with the world if sync is turned on. (Recordings made before 26 October 2026 in a synced world may also be in the cloud; deleting them in the app removes them.)

Information about real people in your notes. If you write about real people in your world (for example players’ names or how to reach them), you’re responsible for having their OK, and you can delete it at any time.

Basic technical records. Our hosting providers keep standard logs (such as IP address, browser type and time of request) for security and to keep the service running. We don’t use these to profile you.

Things that stay on your device. Worlds you don’t sync, session recordings, and any API keys, tokens or webhook links you enter (for AssemblyAI, Anthropic, Syrinscape or Discord) are kept only in your browser or desktop app. Keys are never uploaded or included in backups. Anyone who uses your device and browser profile can see what’s stored there, so use a device only you use, or sign out and clear the site’s data on a shared one.

How we use it

Only to run the app: signing you in, syncing your worlds between your devices, showing players what the game master has chosen to share with them, sending account emails (like confirming your address or resetting your password), and keeping the service secure. We don’t send marketing emails.

Who can see your content

Your synced worlds are private to you and anyone you invite. Co-GMs you invite can see and edit the whole world. Players you invite only see what you reveal to them. Anyone with a share link you create can see what you’ve revealed through that link, until you turn it off.

Services we rely on

• Supabase stores accounts and synced data (servers in Sydney, Australia).
• GitHub Pages serves the website.
• Google and Facebook, only if you choose to sign in with them.
• Our email provider, to send account emails.
• Discord, only if a game master adds a Discord webhook and chooses to post something (like a recap) to their own server.
• AssemblyAI and Anthropic, only if you add your own API key and choose to send a recording for transcription or a transcript for a recap. That data goes directly from your device to them under their own privacy policies, using your own account with them.

Your account and synced worlds are stored in Australia. GitHub, Google, Facebook, Discord, AssemblyAI, Anthropic and our email provider are based in the United States and may process the data they handle there or in other countries. We choose providers with strong security practices, but overseas laws may give different protections from Australian law.

How we keep it safe

• Everything sent between the app and our servers is encrypted (HTTPS), and our database and file storage are encrypted at rest by Supabase.
• Passwords are stored only as secure hashes. We never see them.
• Database rules check every request, so people can only reach worlds they own or were invited to, and players only ever receive what the game master has revealed to them. Game master notes and secret passages are removed on our server before anything is sent to players.
• Uploaded files are private, and are only handed out after a check that the person asking is allowed to see them.
• Only Brayden has administrator access to the database, and we don’t look at your worlds unless you ask us to help with a problem.

If something goes wrong

If we learn of a data breach that could seriously harm you, we’ll tell you by email as soon as we can, explain what happened and what to do, and notify the Office of the Australian Information Commissioner (OAIC) where the law requires it.

How long we keep it

We keep your account and synced worlds until you delete them. Deleting a cloud copy of a world removes it from our database. Deleting your account removes your account, the worlds you own and their files, and your notes, questions and characters in other people’s worlds. Group notes you helped write in someone else’s world stay with that world. Backups held by our providers are cleared on their normal schedule.

Your choices and rights

You can use the app without an account, turn sync off for any world, delete cloud copies, and export your data as a backup file at any time. You can delete your account yourself in the app (☁️ your account → Delete my account), or ask us for a copy of your information, to correct it, or to delete it. We’ll reply within 30 days. See how to delete your data. If you’re in Australia, the EU or the UK you have rights under the Privacy Act 1988 (Cth) or the GDPR, and you may complain to the OAIC or your local regulator.

Children

The Warded Atlas isn’t meant for children under 13, and we don’t knowingly collect their information. If you think a child has made an account, contact us and we’ll delete it.

Changes

If we change this policy we’ll update the date above, and for big changes we’ll let account holders know.

Contact

Questions or requests: brayden.m.32@gmail.com