Privacy policy

This policy explains what personal data Rollcall collects, why, who it is shared with, and the rights you have under UK data protection law (the UK GDPR and the Data Protection Act 2018).

Who we are

Rollcall (“we”, “us”) is the data controller for the personal data described here. For anything about your data, email support@rollcallrpg.com.

What we collect

If you create an account

• Your email address, and your name and profile picture if you sign in with Google.
• The display name you choose.
• Your plan, usage (rounds and pictures used), and subscription status.

If you join as a guest

• The name you type in. Guest sign-in creates an anonymous account with no email address.

When you play

• Everything you write in the game: character names, descriptions and appearance, the actions you type, and any custom world you describe.
• The story the AI Game Master writes, your character sheets, and the scene pictures it generates.

Please don't put real personal details about yourself or anyone else into the game. Other players in your room can read what you write.

When you pay

Payments are handled by Stripe. We never see or store your card details. We keep your Stripe customer ID and your subscription status so we know which plan you're on.

Technical data

Our hosting and database providers log basic technical data such as IP addresses and browser type to keep the service running and secure. We also count requests per account to stop abuse.

Why we use it, and our lawful basis

• To run the game and your account (signing you in, saving your adventures, generating the story and pictures): because it's necessary to provide the service you asked for (contract).
• To take payments and keep financial records: contract, and legal obligation for tax records.
• To keep the service secure (bot checks, rate limits, fixing faults): our legitimate interest in protecting the service and our users.
• To understand how the site is used (Google Analytics): only with your consent, which you can withdraw at any time.
• To email you about your account (sign-in links, receipts, important changes): contract. We don't send marketing emails.

Who we share it with

We use these providers to run Rollcall. Each only gets the data it needs for its job:

• Supabase: our database, sign-in, and picture storage. Holds your account and game data.
• Google (Gemini API): writes the story. Receives your room's setting, characters, actions, and story so far, but not your email address.
• OpenAI: paints the scene pictures. Receives a description of the scene and the characters' appearance, but not your email address.
• Stripe: takes payments. Receives your email address and payment details.
• Google Analytics: counts visits, only if you allow analytics cookies. It sees which pages you visit, but never your story or room codes.
• Cloudflare Turnstile: the check that you're human when you sign up or join as a guest.
• Our hosting provider: serves the website.

We don't sell your data. We would only share it otherwise if the law requires us to.

International transfers

Some of these providers process data in the United States or elsewhere outside the UK. Where they do, the transfer is protected by the UK's adequacy regulations (including the UK-US data bridge) or by the UK International Data Transfer Addendum to the providers' standard contractual clauses.

Cookies and similar storage

• Sign-in cookies (strictly necessary): keep you signed in. The site can't work without them, so they don't need consent.
• Your cookie choice (strictly necessary): stored in your browser so we don't ask again.
• Google Analytics cookies (optional): only set if you choose “Allow analytics”. They last up to two years.
• Cloudflare Turnstile (strictly necessary for sign-up): may store data to tell people from bots.

You can change your analytics choice at any time: Cookie settings.

How long we keep it

• Your account and adventures: until you delete your account (or ask us to).
• Payment records: six years after the payment, because UK tax law requires it. Stripe keeps its own records under its own policy.
• Rate-limit counters: about a day.
• Analytics data: 2 months in Google Analytics.

Your rights

Under UK data protection law you can ask us to:

• give you a copy of your personal data;
• correct data that's wrong;
• delete your data;
• restrict or object to how we use it;
• give you your data in a portable format;
• and withdraw consent (for analytics) at any time.

You can download a copy of your data or delete your account yourself, any time, from Account → Your data. For anything else, email support@rollcallrpg.com from the address on your account and we'll respond within one month. If you're unhappy with how we handle your data, you can complain to the Information Commissioner's Office at ico.org.uk.

Children

Rollcall is for people aged 13 and over. If you're under 13, please don't use it. If we learn that a child under 13 has created an account, we'll delete it.

Security

Data is encrypted in transit, access to game data is limited to the players in each room, and payment details never touch our servers. No system is perfectly secure, but we'll tell you and the ICO without undue delay if a breach puts your data at risk.

Changes

If we change this policy, we'll update the date at the top and, for significant changes, tell account holders by email. See also our terms.