Privacy Notice

D&D ShopGen V2 is operated by the D&D ShopGen project owner. The project owner is the controller for personal data processed through this service.

For privacy requests, account data requests, deletion requests, or legal notices, contact support@dndshopgen.com.

If you use the app without signing in, generated shops and local saves stay in your browser storage unless you choose to copy or share them.

If you sign in with Google, Supabase Auth provides account identifiers such as your user id, email address, and provider information.

If you connect Patreon, the app may store Patreon account identifiers, member identifiers, campaign/member status, entitled tier ids or tier names, sync timestamps, and the resulting app entitlement and monthly credit allowance.

Cloud saves may include full DM shop documents, private DM notes, player notes, visibility settings, and account-owned custom items.

Public player links expose only player-safe projections. They do not intentionally expose FullShopDocument data, DM notes, or hidden fields.

Live player links may process table nicknames, player display names, visible player-safe shop content, item interest signals, and temporary live-session state.

Community Library features may process published item or shop snapshots, public handles, likes, reports, report comments, moderation status, copy/import records, and owner unpublish state.

AI features may process prompts, selected options, generated text responses, image prompts, generated image assets, AI credit usage, provider usage, and approximate cost metadata.

Support and operations features may process support form messages, reply email addresses when provided, issue categories, request metadata, and operational alert text.

When aggregate traffic counting is enabled, server-side request handling increments only a safe page category and daily total for full browser page loads. It does not create a separate analytics request in the browser.

The traffic counter does not read or store an IP address, User-Agent, referrer, country, device class, full URL, query parameters, share token, email address, account user id, visitor identifier, or session identifier. It cannot identify unique or returning visitors.

If you choose to exclude a browser from traffic totals, the app stores an HttpOnly first-party preference named dsg_traffic_opt_out containing only the value 1. It is not an analytics identifier and is used only to skip counting requests from that browser.

Service providers may process technical data such as IP address, request metadata, authentication events, error logs, and security logs.

Basic deterministic generation can be used without signing in, but local saves, drafts, and imported player codes require browser storage on the device.

Google account data is required for authenticated cloud saves, account custom items, public links, Library account actions, Patreon connection, and credit-gated AI features.

Patreon connection data is required only if you choose to connect Patreon for app benefits. If you do not connect Patreon or if sync fails, Patreon-based benefits may not be available.

AI prompts and selected options are required only when you choose to use AI features. If you do not provide them, the app cannot generate AI shop plans or item art.

Support messages require enough contact and issue information to respond. Deletion, access, or moderation requests may require enough information to verify the account, content, or request involved.

Google sign-in is used only to authenticate your account and connect your cloud saves, custom items, and public links to that account.

The app uses Google account data received through Supabase Auth, such as your Google-linked user id, email address, and provider profile information.

Google user data is not sold, not used for advertising, and not shared except with service providers needed to run authentication, storage, security, and support.

The production app is hosted on Vercel. Authentication and database storage use Supabase. Google provides the OAuth sign-in provider. Patreon provides optional membership connection, membership status, and tier entitlement data.

OpenAI may process prompts, generated text, image requests, generated image outputs, and provider usage data when you use AI features. Telegram may receive support and operational notification text used by the project owner to monitor and respond to the service.

When aggregate traffic counting is enabled, Vercel performs the server-side route count, Supabase stores daily route totals, and Telegram receives only the resulting aggregate report. Telegram does not receive request metadata or request-level records.

These providers may process technical data such as IP address, request metadata, logs, and authentication events as needed to run and secure the service.

These providers may process data in the United States, the European Union, the United Kingdom, or other locations where they or their subprocessors operate, subject to their security, privacy, and data processing terms.

Where cross-border transfers require safeguards, the project owner relies on the provider terms, data processing terms, transfer safeguards, and subprocessors used by those providers, such as standard contractual clauses where applicable.

AI prompts and outputs are sent only when you choose to use AI features. Do not include sensitive personal data, confidential campaign material, payment data, passwords, or private addresses in AI prompts.

OpenAI currently states that API inputs and outputs are not used to train OpenAI models by default unless the API customer opts in, but provider handling may change according to provider terms, settings, and law.

AI provider systems may retain limited request, response, usage, or abuse-monitoring data according to provider terms and operational policies.

Public player links are visible to anyone who has the tokenized link until revoked or disabled. They are designed to show only player-safe projections.

Community Library entries are public app content while published. Other users may copy or import available Library entries, and those independent copies may remain after the original entry is unpublished.

Do not publish or share private table notes, personal data, confidential campaign material, or content you do not have permission to share.

D&D ShopGen V2 does not sell personal data, does not run advertising, and does not use analytics cookies, a client-side analytics tracker, or persistent analytics identifiers in browser storage. The optional traffic opt-out cookie is a user-requested privacy preference, not an analytics identifier.

The server-side counter honors Do Not Track (DNT: 1), Global Privacy Control, and the browser traffic opt-out preference. Any future expansion to client-side tracking, unique-visitor measurement, advertising, fingerprinting, or non-essential browser storage requires a separate privacy review and consent controls where required.

Local browser data can be cleared from your browser. Cloud saves and custom items remain until you delete them in the app or request deletion.

Public links should be revoked when no longer needed. Revoking a link disables the old player URL.

Community Library entries remain while published or while needed for moderation, abuse prevention, support, audit, or dispute handling. Copied or imported Library content becomes an independent user copy.

AI usage and credit records may be kept while needed for account balances, abuse prevention, cost accounting, troubleshooting, and support. Generated item-art assets remain tied to the cloud shop or account content they were created for until deleted or no longer retained by the feature.

Support messages and operational notification records may be kept while needed to respond, debug issues, prevent abuse, or maintain an operational audit trail.

Patreon connection and entitlement records are kept while connected or while needed to provide membership benefits, resolve billing/support issues, prevent abuse, or keep an operational audit trail.

Account identifiers are kept while your account is active or while needed to provide cloud features, respond to requests, prevent abuse, or meet legal obligations.

Technical logs are kept for limited operational, security, and debugging periods set by the service providers and project operations.

Daily per-route request totals are kept for 7 days. Completed aggregate daily reports are kept for 3 months. No visitor or session identifier exists in this traffic-counting data.

The optional dsg_traffic_opt_out preference is kept for up to one year unless you include the browser again or clear site cookies sooner.

Deleted data may remain in backups or logs for a limited period before routine deletion.

For account data, cloud save deletion, or privacy requests, contact support@dndshopgen.com.

Depending on your location, you may have rights to access, correct, delete, restrict processing, object to processing, request portability, or withdraw consent where processing is based on consent.

Some rights depend on the legal basis for processing, the account or content involved, applicable law, and whether data must be retained for security, abuse prevention, support, accounting, legal compliance, or dispute handling.

You may also have the right to lodge a complaint with your local data protection authority or other privacy regulator.

Use support@dndshopgen.com for privacy requests. We may need enough information to verify the account or data involved.

The service uses managed authentication, provider access controls, and encrypted connections where supported by the platform.

No online service can guarantee perfect security. Do not store passwords, financial information, private addresses, medical data, or other sensitive personal data inside shop notes or custom items.

The service is not directed to children under 13, and users under 13 should not create accounts, publish content, submit support messages, use AI features, or provide personal data through the service.

The project owner does not knowingly collect personal data from children under 13. If such data is discovered, it should be deleted or the account/content should be restricted where appropriate.

If you believe a child provided personal data without appropriate permission, contact support@dndshopgen.com.

The service does not make automated decisions with legal or similarly significant effects about users.

Generated shop outputs are game aids and do not profile users for advertising, credit, employment, insurance, or legal decisions.