Privacy notice

Draft, not yet reviewed by counsel.

Version of 2026-10-15.

DiceLedger is a multiplayer tabletop role-playing game in closed alpha. This notice says what we keep about you, why, who else handles it, how long it is kept and what deleting your account removes.

DiceLedger is run by John Oakley, who decides how this data is used.

Draft note: a contact address for privacy requests, and the legal entity that will hold the service, are open owner questions.

What we keep

Your account

You sign in by email, with a one-time code or link. Your email address, your sign-in sessions and those codes are held by Clerk, our sign-in provider, and not in our own database.

Our database keeps an account record holding a random account identifier, Clerk's identifier for you, the display name you choose, the time you confirmed that you are 18 or older, and when the record was made and last changed. Nothing else about you is kept on it.

Draft note: an account made before sign-in moved to Clerk may still hold its email address on the account record, until that column is dropped. Whether production holds any such account is an open owner question.

Your play

Each world keeps a permanent history of play: what each character did, the dice, the outcomes and the narration. Words that players write, such as a described action or a question, are stored apart from that history, which refers to them, so that they can be erased without rewriting it. A world's history is kept while the world runs.

We also keep which worlds you belong to and in what role, and a log of every action a game master or a platform admin takes in a world: who acted, in which world, which command and when. An invite link is stored only as a one-way fingerprint of its secret part.

Your character's tendencies

The game records which kinds of options your character takes, declines or ignores, per character and per world, and uses that to order the options it suggests. Tendency data describes in-game choices only. It is not used to infer anything about you, for advertising, or for sale. The alpha is to let you see your character's profile and reset it. The game master of that world can see it, and a platform admin can when acting on a report. Other players cannot.

Draft note: no screen yet shows or resets a tendency profile. This paragraph describes it as the alpha requires it, and must match what is live when published.

Records of model calls

For each call to an AI model we record the model, the prompt version, the tokens used, how long it took, its cost, the world, and a keyed one-way code made from your account identifier. This record holds no game text. It is used to measure what the game costs to run.

We also keep a running total of each account's model spending per day, to enforce spending limits.

Draft note: old daily totals are deleted by a clean-up that keeps the current day and the one before it, but nothing runs that clean-up on a schedule yet (issue #416). Until it does, this notice cannot give their retention.

Raw prompt and response logs

We keep the exact text sent to each AI model and what it sent back, for debugging and safety review. Because a model is given the whole scene, these logs can hold the names and descriptions of every character in it, not only those of the player who acted. The application writes them and cannot read them back. Only the operator can read them.

Raw logs are deleted after 30 days. A daily job deletes each log on its first run after the log is 30 days old, so a log can last up to a day longer, and longer if a run fails, until the next run that succeeds.

What the hosting provider logs

Our hosting provider records each request made to the site, including the address of the page asked for, in its own logs.

Draft note: how long those logs are kept is set by the hosting provider's plan and has not been checked.

Cookies

Clerk sets the cookies that keep you signed in. Opening an invite link sets a cookie that lasts 30 minutes, long enough to finish joining. We use no analytics or advertising cookies. What you type in the single-player demo at /play stays in your browser and is sent nowhere, and the page loads no analytics.

Draft note: Clerk's sign-in script still loads on /play, as it does on every page, so it contacts Clerk and may set Clerk's cookies there. That holds until the demo is split from the rest of the site's pages (ADR-0043).

Who handles your data

OpenAI processes game text for us. Its models interpret what players type, narrate, voice characters and may make images, and its moderation service screens text before other players or a model see it. OpenAI receives character names and game text, and, with most requests, a keyed one-way code for the account involved so that abuse can be traced to one account. It never receives your email address, your real name or payment details. We ask OpenAI not to store our text requests for later retrieval.

Draft note: the moderation screen is built (issue #93) but not yet wired into play (issue #542), and its policy is an open owner question; see the terms.

OpenAI's terms, as checked on 2026-10-15: data sent to its API is not used to train its models unless the customer opts in. It keeps abuse-monitoring logs of API use for up to 30 days, longer where the law requires it or to protect its service or others from harm. Its own table lists no such retention for moderation checks. Its current terms are on its data controls page.

Draft note: the summary above came from an automated reading of OpenAI's page. Someone must read the live page, quote it verbatim, confirm that our OpenAI organization has not opted in to sharing data, and set the date again at launch.

Clerk handles sign-in and holds your email address. Our database is hosted by Neon and the site by Vercel.

The alpha takes no payments, so no payment details are collected. We do not sell personal data or share it for advertising.

Who can see what

Other players in a world see your display name, your character's public details, and what your character says and does in their presence. The game master of a world sees every character sheet and tendency profile in it. A platform admin can act in any world, and every such action is logged.

Deleting your account

Account deletion is being built, and is not yet available in the app.

When it lands, deleting your account removes your account record, replaces your display name in past play, and erases the words you wrote, leaving a marker in their place. The history of play keeps the actions and dice, so worlds still replay. The erasure reaches summaries, caches, later exports and backups, the last within their rotation.

Draft note: what someone can do before deletion lands, such as asking the operator to delete an account or to erase the words they wrote in a world, is an open owner question. The redaction tool is not built yet (issue #147).

Draft note: the backup schedule and how long backups are kept are being set (issue #167). This notice must state that retention once it is decided.

Account erasure does not delete raw logs. Your words can sit in the logs of calls made for other players, and no record ties every such log to you, so the logs are left to the 30-day deletion above, which bounds them.

Draft note: whether that reading of the erasure requirement stands is an open owner question (Ruling 820). If the owner rules otherwise, erasure will instead delete the raw logs of every world you played in, other players' review records with them.

Draft note: account deletion has three open design points that this notice must answer once issue #110 lands: whether the keyed codes in model-call records are erased; whether the account identifier in the log of game-master and admin actions is kept, and on what basis; and when daily spending totals are deleted.