Privacy notice

Last updated: October 27, 2026

This notice describes how personal data is processed when you use Lazy Dragon, register an account and use its character, campaign and shared-play features. It also covers Sign in with Google when available and selected by you.

Controller and contact

The data controller is Gabriele Treglia. For information about your data, privacy assistance or rights requests, contact lazydragonded@gmail.com.

Data and sources

Account data includes your email address, technical identifier, credentials managed by the authentication system, username, optional display name and avatar, language, preferences, role and session information. We receive these data from you, the authentication service and Google if you choose that sign-in option.

We store content you enter or import: characters, game statistics, inventories, notes, personal creations, campaigns, image URLs, friend requests, blocks and invitations. Free-text fields may contain personal data: provide only relevant information that you are entitled to use.

Requests to the site and technical services may generate IP addresses, browser and device information, dates, requests, errors and security data. Abuse prevention also uses counters and derived identifiers. The registration form does not collect payment data.

Sign in with Google

If you choose Google, the authentication flow requests the openid, email and profile scopes. The system may receive a Google identifier, email address and verification status, name, profile image and other authentication metadata provided by Google. We do not receive your Google password, and this feature does not request access to Gmail, Drive, contacts or your calendar.

These data are used to verify identity and manage your account and sessions. Provider metadata may be stored in Supabase Auth; your Google name and photo are not automatically copied into the profile visible to other players. You can choose your username and display name through the app. You may revoke the connection in Google's security settings; revocation does not delete data already held by Lazy Dragon.

Purposes, legal bases and required data

Registration, authentication, saving, synchronisation, sharing you choose and necessary support provide the service you request: GDPR Article 6(1)(b). Account and sign-in data are required for restricted features; we cannot provide those features without them. Display name, avatar, content and social features are optional according to the feature selected.

Abuse prevention, security, incident handling and error diagnostics rely on the legitimate interest in keeping the service reliable and protecting users and data: Article 6(1)(f). You may object where the law provides. Compliance with legal obligations and binding requests from authorities relies on Article 6(1)(c).

The current implementation does not use app data for behavioural advertising or marketing campaigns. Game-rule calculations do not make automated decisions with legal or similarly significant effects on you.

Visibility depends on the features you use. People involved in friendships and invitations may see your username, display name and avatar; those features do not publish your email address. Linking a character to a campaign allows its Master to access data provided by the campaign features. Participants and shared tabletop views see information shared through their respective features. Authorised personnel may access data needed for administration and support.

We use Vercel to host and distribute the app; Supabase for authentication, the database, shared features and historical files; Google if you choose its sign-in; and Sentry, when configured, for error diagnostics. The authentication service and any technical email providers handle account communications. Encrypted backups may be stored through GitHub. Each service receives data needed for its function and may use its own technical suppliers.

New portraits, covers and map backgrounds may use external HTTPS URLs: your browser contacts the image host, which may receive technical request data. Previously uploaded avatars and covers may be accessible through public URLs; historical Storage maps have restricted access. Links to Discord, PayPal and other websites open services with their own terms and privacy notices.

Location and international services

The main production Supabase database is in AWS region eu-west-1, Ireland. This does not mean that every operation of the services used takes place in the European Economic Area: site distribution, authentication, support, diagnostics or backups may involve other countries.

For Supabase, the Data Processing Addendum incorporates European Commission standard contractual clauses for transfers requiring them, alongside the additional contractual measures. The database region does not exclude support access or other international processing. Other providers' terms describe their respective roles and transfers; for information about destinations and safeguards applicable to your data, or a copy where provided for, contact lazydragonded@gmail.com.

Cookies and device storage

Authentication cookies maintain and renew your session. Renewal handled by the app sets a 7-day lifetime, which may be updated during use. The technical ded.locale cookie stores your language for one year. Authentication services may also use items with their own expiry periods needed to complete and secure sign-in.

LocalStorage and sessionStorage retain preferences, filters, drafts and operation recovery. If you download a character sheet for offline use, its document and necessary identifiers are stored in IndexedDB on your device; a service worker retains public assets needed for offline operation. Signing out or changing accounts revokes access to the offline copy and starts its removal; it does not delete every browser preference or draft.

These tools support requested features, not advertising profiling in the current implementation. You can remove offline copies through the app and clear cookies and storage in your browser settings; some features or drafts will no longer be available and you may need to sign in again.

Retention and deletion

Account data and saved content are retained during the service relationship until an account-closure or erasure request is handled, subject to the exceptions below. You can edit or delete individual content through the available functions; campaign and relationship data also follow their lifecycle and actions by their respective owners. Accounts are not currently deleted automatically solely because they are inactive.

To request account or personal-data deletion, contact lazydragonded@gmail.com. Requests are assessed considering your identity, shared content, others' rights and any obligations to retain data or defend legal claims. Administrative deactivation stops access and revokes sessions but does not itself permanently delete the account and its content.

The IP-based sign-in limit uses 15-minute windows. Expired temporary counters and username-lookup windows become eligible for periodic cleanup after one hour; removal happens in maintenance batches rather than instantly. Technical logs and diagnostic events follow the configured services' retention windows, separately from application counters and any data retained to handle an incident or legal obligation.

The free Sentry Developer plan retains error events for 30 days; lifetime issue counts may remain longer and do not mean that individual events are still stored. The free Vercel Hobby plan provides a one-hour Runtime Logs viewing window; Supabase Free provides a one-day API/database log window. These windows do not guarantee deletion of every other type of provider telemetry or operational record, which remains subject to the providers' terms and notices.

The ordinary encrypted-backup rotation selects one daily copy for the last 30 days, one weekly copy for the last 8 weeks and one monthly copy for the last 12 months, while retaining at least the latest 3 copies. Earlier copies are removed after a new verified backup; if a backup or cleanup fails, existing copies may remain longer to preserve recoverability. Deletion from the service does not mean immediate removal from every backup.

Your rights and requests

Where the GDPR provides, you may request access, rectification, erasure, restriction and portability, and object to processing based on legitimate interests. Contact lazydragonded@gmail.com; we may request proportionate information to verify identity. In-app game exports do not replace a complete personal-data access request.

You may lodge a complaint with the Italian data protection authority, Garante per la protezione dei dati personali, or your competent supervisory authority. Where processing relies on consent, you may withdraw it without affecting the lawfulness of earlier processing. We do not make decisions about you based solely on automated processing with the effects described in GDPR Article 22.

Updates

The date on this page identifies this notice's version. For material changes to processing, we will provide the necessary information before using data for new purposes, through the app or available contact details.