RollQuest — Privacy Policy

1. What We Collect

We collect:

• Account Data: email, username, and password (encrypted). If you sign in with Google or Discord, we receive basic profile information from that provider to create and secure your account.
• Payment Data: handled securely by Stripe (we never store your full card details).
• Content You Create: maps, tokens, images, audio, character sheets, campaign notes, and other material you upload or create in the Service.
• Playtester Program Data: if you apply to the Playtester Program, the information you provide in your application, such as the game system you run, your group size, and your experience level.
• Feedback and Support Data: messages, bug reports, feature requests, and survey responses you send us.
• Newsletter Data: your email address, if you subscribe to our newsletter.
• Usage Data: IP address, device info, browser type, and session logs.
• Cookies: see our Cookie Policy (accessible from the footer).

2. How We Use Your Data

We use data to:

• Provide and maintain the RollQuest Service;
• Manage billing and subscriptions;
• Run the Playtester Program, including reviewing applications and managing access;
• Improve the platform, including using feedback, bug reports, and survey responses you send us;
• Send newsletters and updates, if you have opted in (see Marketing Communications below);
• Comply with legal and accounting obligations.

3. Legal Basis under GDPR

We process data on these grounds:

• Contractual necessity (to provide your account, billing, and the Playtester Program);
• Legitimate interest (security, analytics, service improvement, and acting on feedback);
• Consent (marketing and cookies);
• Legal obligation (record-keeping, compliance).

4. Marketing Communications

If you sign up for our newsletter, we send occasional emails about new features, release notes, and tips. We add you to the list only after you confirm your subscription (double opt-in). You can opt out at any time by clicking the unsubscribe link at the bottom of any marketing email, or by visiting our unsubscribe page at rollquest.io/unsubscribe. Opting out of marketing does not affect essential account emails, such as sign-in, billing, and Playtester Program status.

5. Data Sharing

We share limited data with trusted third-party processors:

• Stripe – payment processing
• Mailchimp – newsletter and email delivery
• Google Analytics – traffic and usage insights
• Vercel, Railway, and Amazon Web Services (AWS) – hosting and platform operation
• Google and Discord – account sign-in, if you choose those options

All partners are bound to process data only as instructed and in line with the GDPR.

6. International Transfers

Some of our processors, including our hosting and email providers, may process data outside the European Economic Area. Where they do, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

7. Your Rights

You have the right to:

• Access, correct, or delete your data;
• Withdraw consent to marketing;
• Request a copy (data portability);
• Lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon).

To exercise your rights, email contact@rollquest.io.

8. Data Retention and Security

We keep your data only as long as needed for its purpose or as required by law. When you delete your account, we delete or anonymise your personal data and the content you created within 90 days, except for records we are required to keep for legal or accounting reasons, such as transaction records. Playtester application data is kept for the duration of your participation in the program. We use appropriate technical and organisational measures to protect your data.

9. Children's Privacy

RollQuest is not directed to children under 16. We do not knowingly collect their data.

10. Updates

We may update this Privacy Policy periodically. The current version will always be available on our website.