Privacy Policy

This Privacy Policy explains what data SagaBard ("the Service") handles, what stays on your device, and what is shared with third parties.

1. Local-first by design

The Service is local-first. Your campaigns, sessions, heroes, missions, events, notes, and recap text are stored locally on your device, and the Service works fully without an account. An account is optional: it lets you keep a copy of your data in the cloud and use it on more than one device, as described in section 2. Without an account, this data is not stored on our servers. Apart from an account's cloud copy, the only content that leaves your device is content you deliberately choose to send: a request to the optional AI recap feature, or a message you write in the feedback form. Both are described below.

2. Optional account and cloud copy

Creating an account. You can create an account with an email address and a password. We use your email address to sign you in and to send you the emails that confirm your address and let you reset your password. Your account holds your email address, the identifiers that connect your sign-in to your account, a record of the devices that sync with it, and, once you link a device, a copy of that device's campaign data.

Linking a device. Signing in uploads nothing by itself. Your data is added to your account only when you link a device, and only after you confirm a screen that lists what will be added. Linking adds the device's entire local record: your current campaigns, heroes, sessions, and missions, together with their events, recaps, and local history, including the history of items you have deleted. After linking, the changes you make on that device are added to your account's copy and reach your other linked devices. Each change carries a randomly generated identifier of the device that made it and the time it was made.

Your devices. For each device that syncs with your account, we keep that device's randomly generated identifier, a short description of its browser and operating system (for example, "Safari on iOS", with no version or model), when it first and last synced, and whether it was paused or removed from your account. We use this only to show you your account's devices and to stop a paused or removed device from syncing. From one device you can pause another device, resume it, or remove it from your account. A paused or removed device keeps its local data; changes made on it reach your account only after it is resumed, or after it is linked again from that device. Pausing or removing a device stops it from syncing; it does not sign it out or erase it.

Data created without an account. Data created without an account belongs to no account. The first account linked on a device adds that device's local data to itself, so on a shared device, check what the confirmation screen lists before you link. Linking makes a copy: it never reads, changes, or removes data in anyone else's account. Anyone who holds a copy of data from a device that was not yet linked, such as an export file or a restored device backup, can add that copy to their own account.

Signing out. Signing out does not remove your data from the device: it stays visible on that device, and the device stays linked to your account. Another account cannot use a device linked to yours or receive its data.

How long we keep it. We keep your account's cloud copy, including the history of changes and of items you have deleted, until you delete your account. Deleting an item in the Service does not remove its history from your account's cloud copy.

Deleting your account. You can delete your account from a linked device. Deletion removes your account, the sign-in identities linked to it, the record of its devices, and its cloud copy. On the device you delete it from, your local data is erased as well, after a confirmation that names what will be lost; export a backup first if you want to keep it. Deletion removes only your account's copy: your other devices keep their own local copies and stop syncing, and any other account holding a copy of the same data is not affected. A device left linked to a deleted account can be unlinked from it: the data it currently shows stays on the device, its history and deleted items are not kept, and the device can then be linked to another account.

After deletion. So that a sign-in already in progress cannot recreate a deleted account, we keep a minimal record that its sign-in identities were deleted: the identifier of the sign-in service, the identifier that service gave you, and when the deletion happened. This record contains no email address and no campaign data, and we currently keep it with no set expiry.

Backups. Copies of deleted data may remain in our infrastructure provider's backups for a limited time, and are removed on that provider's schedule.

3. Usage analytics

The Service uses third-party analytics providers to understand how the product is used and to help improve it:

• Each browser or app installation is counted by a randomly generated identifier stored on your device. It is not linked to your real-world identity.
• If you have an account, then while you are signed in on a device linked to it, analytics events from the app also carry your account's internal identifier — a random value, not your email address — so that use across your devices can be counted as one account. Activity on a device from before it was linked, and while you are signed out, is not linked to your account. Your email address is never sent to analytics. (Your account, described in section 2, and the feedback form, described in section 5, are the only places you may choose to give us an email address.)
• Your IP address is not used to identify you in analytics, and our product analytics provider is set not to store it.
• If you delete your account, analytics events already recorded keep the identifier they carried; it no longer corresponds to any account we hold.
• Analytics is limited to product-usage signals (for example, which features are opened) and standard aggregate website metrics (such as device type, general region, and referring page). It does not include the content of your campaigns, sessions, heroes, missions, notes, or recaps.
• Analytics does not use tracking cookies. Any local identifier is stored on your device rather than in a cookie.

4. Optional AI recap feature

Separately from analytics, the Service offers an optional feature that generates an AI-enhanced narrative recap of a session. It is only used when you explicitly request it, and it is not part of analytics.

When you request an AI-enhanced recap, the session and campaign content needed for that specific recap (for example, event descriptions and notes from that session) is sent to a third-party AI service provider to generate the text. That content is used only to fulfill your request. If you do not use this feature, that content is not sent anywhere – the Service also offers a fully local, non-AI recap option.

5. Feedback form

The Service offers a feedback form, used only when you choose to open it and send a message. The form is provided and hosted by a third-party form service, and what you type is submitted to that service and forwarded to us.

The form asks for three things: a category, your message, and – optionally – an email address, which exists only so we can reply to you. Nothing else is attached. The Service does not add your campaigns, sessions, heroes, missions, notes, recaps, audio, or any other locally stored content to a feedback submission, and it does not attach your analytics identifier. Anything beyond the category is what you have written yourself, so please avoid including personal details you would rather not share.

No account is required to send feedback. Because the form is hosted externally, opening and submitting it requires a network connection; the rest of the Service keeps working offline.

6. Other third parties

If you use an account, your account and its cloud copy are stored by a third-party infrastructure provider that hosts our database and sign-in service, and the emails that confirm your address or reset your password are sent through a third-party email delivery provider. These providers process this data only to operate the Service, including technical request data such as your IP address when you sign in or sync. They may keep technical logs of sign-ins and email delivery, which may include your IP address and, for the emails we send, your email address, in accordance with their own retention practices.

The website is delivered by a third-party hosting provider, which, as a standard part of serving any website, may process technical request data such as your IP address. This is operational and is not used to build a profile of you.

The homepage embeds a product video hosted by a third-party video service, using its privacy-enhanced mode. The player is loaded only when you choose to play the video; your browser then connects to that service, which may process technical request data such as your IP address, and playback is governed by that service's own privacy policy.

7. Your data, your control

Campaign data on your device stays under your control: you can export a full backup at any time, and clearing the Service's locally stored data removes it from that device, including any local analytics identifier. If you have an account, clearing a device does not delete your account's cloud copy; deleting your account does, as described in section 2.

8. Children's privacy

The Service is not directed at children under 13, and we do not knowingly collect personal information from children.

9. Changes to this policy

We may update this policy as the Service evolves. Material changes will be reflected by updating the "Last updated" date above.