Back to TableHero
// LEGAL

Privacy Policy

EFFECTIVE: To be set on launch day

The short version

We collect the data you give us (account info, character sheets, campaign notes), the data needed to run the service (subscription status, basic technical info), and very little else. We do not sell your data. We do not show you ads. We share data only with the service providers listed below, and only as needed to run the service.

If something here is unclear, email info@tablehero.games.

Who we are

TableHero is a tabletop role-playing game campaign management app, operated as an individual sole proprietorship based in California, USA. References to “we,” “us,” or “TableHero” in this policy refer to that operation.

Contact:

TableHero
642 Thunder Glen
Escondido, CA 92027
USA
info@tablehero.games

Information we collect

Account information

When you create an account, we collect your email address and (if you set one) a password. If you sign in with Apple or Google, we receive your email address and (where you allow it) your name from the provider. We never see or store your provider password.

Subscription and payment information

Our subscription provider, RevenueCat, manages your subscription state across platforms. Payment card details are handled by Apple, Google, or our web payment processor (Stripe), depending on how you subscribe. We never see or store your full card number. We receive subscription status (active, canceled, expired), the platform you subscribed through, and the renewal date.

Content you create

We store the content you create in TableHero, including campaign notes, character sheets, NPCs, encounters, items, and any other in-app data you save. This is stored on our backend (Supabase, hosted in Ohio, USA) so it can sync across your devices.

Newsletter

If you join our pre-launch email list (operated by Kit), we collect your email address and any preferences you provide. We use this only to send updates you opted into. You can unsubscribe at any time using the link in any email.

Communications with us

When you email us for support or other reasons, we keep that correspondence so we have a record of the conversation.

Automatically collected information

When you use the app, our systems log basic technical information needed to operate the service:

  • IP address
  • App version
  • Device type and operating system version
  • Timestamps of activity
  • Information about errors or crashes (if any), to help us debug

We do not currently use product analytics services such as Mixpanel, Amplitude, or Google Analytics. If we add a crash reporting service such as Sentry to help diagnose technical issues, we will update this section before doing so.

How we use this data

We use the data we collect to:

  • Provide the app and sync your data across your devices
  • Process your subscription and send required billing notices
  • Provide customer support
  • Detect and prevent abuse, fraud, and security issues
  • Send you updates you opted into
  • Comply with legal obligations

We do not use your campaign content, characters, notes, or any of your in-app content to train AI models, for advertising, or for any purpose beyond providing the service to you.

Under GDPR and equivalent laws, we process your data on the following legal bases:

  • Contract: To provide the service you signed up for
  • Consent: For optional things like our newsletter (you can withdraw consent at any time)
  • Legitimate interest: For security, fraud prevention, and improving the service in non-intrusive ways
  • Legal obligation: For tax, accounting, and other legal requirements

Guest accounts

A paid Gamemaster can invite players to their campaign as free guests. When a player accepts a guest invitation, we create a limited account for them tied to that campaign. The character sheet and other guest-created content within that campaign belongs to the Gamemaster’s account while the player is a guest.

If the player creates their own paid TableHero account, the Gamemaster can transfer ownership of the character to the player’s account, at which point the data belongs to the player. Free accounts cannot own characters.

If the Gamemaster cancels their subscription, guest players in that campaign will lose access to the Gamemaster’s campaign data, including any characters they used as guests, unless ownership has been transferred to a paid account before cancellation. We will notify guest players in advance where reasonably practical.

Service providers

To run the service, we use the following providers. Each has access only to the specific data needed to perform their function.

  • Supabase (United States, Ohio): Database hosting and authentication. Stores your account info, subscription status, and the content you create in the app.
  • RevenueCat (United States): Cross-platform subscription management. Receives your subscription identifier and platform but not your payment card details.
  • Stripe (United States): Web subscription payment processing. Receives your card details directly from you and provides us with a transaction reference.
  • Apple Inc. (United States): App Store payments and Sign in with Apple. Receives the data needed for those services under Apple’s own privacy policy.
  • Google LLC (United States): Google Play payments and Google Sign-In. Receives the data needed for those services under Google’s own privacy policy.
  • Kit (United States, formerly ConvertKit): Email newsletter. Receives the email address and preferences of newsletter subscribers.

We will update this list if we add or change providers.

How we share your data

We do not sell your personal information. We do not share it for advertising purposes.

We share data only:

  • With the service providers listed above, as needed to run the service
  • When required by law, court order, or to protect our rights or the rights of others
  • In the event of a business transfer (such as a sale or merger), in which case the new owner would be bound by this policy or notify you of any changes before applying a new one

International users

Our backend is hosted in the United States. If you are outside the US, your data will be transferred to and processed in the US.

For users in the EEA, UK, and Switzerland, we rely on Standard Contractual Clauses or equivalent approved transfer mechanisms with our service providers to safeguard your data during international transfers.

Data retention

Active accounts: We keep your data while your account is active.

After cancellation: If you cancel your subscription, we retain your account data for one year so you can resume where you left off if you resubscribe. After one year, we delete your account data unless retention is required by law (for example, transaction records may be retained up to seven years for US tax compliance).

Account deletion: If you delete your account in-app, we delete your personal data within 30 days, except where retention is required by law.

Backups: Deleted data may persist in encrypted backups for up to 90 days before being purged.

Your rights

You can:

  • Access the data we hold about you, using the in-app export feature or by emailing us
  • Correct your account info in-app, or by emailing us
  • Delete your account in-app, or by emailing us
  • Cancel your subscription in-app, in your store account, or by emailing us

California residents (CCPA / CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act:

  • The right to know what personal information we collect, use, and share
  • The right to delete your personal information
  • The right to correct inaccurate personal information
  • The right to opt out of the sale or sharing of personal information (we do not sell or share personal information for advertising)
  • The right to limit use of sensitive personal information (we do not collect sensitive personal information for purposes that would trigger this right)
  • The right to non-discrimination for exercising your privacy rights

EEA, UK, and Swiss residents (GDPR)

If you are in the EEA, UK, or Switzerland, you have additional rights under the GDPR and equivalent laws:

  • Access, correction, and deletion of your data
  • Restriction of or objection to certain processing
  • Data portability
  • The right to withdraw consent for processing based on consent
  • The right to lodge a complaint with your local data protection authority

To exercise any of these rights, email info@tablehero.games. We respond within 30 days.

Children

TableHero is not intended for children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have collected personal information from a child under 13 without verified parental consent, we will delete that information.

For users in the EEA and UK, the minimum age may be higher (16 in some jurisdictions, depending on local law). If you are between 13 and 16 in such a jurisdiction, you must have parental or guardian consent to use TableHero.

If you believe a child under the applicable age is using TableHero, please contact info@tablehero.games.

Security

We use industry-standard security practices, including encryption in transit (TLS), encryption at rest, access controls, and regular security reviews. No internet service is perfectly secure, but we do our best to protect your data.

If we ever experience a data breach affecting your personal information, we will notify you and the appropriate authorities as required by law.

Cookies and tracking

Our website uses minimal cookies, primarily to remember your dark or light mode preference. We do not use advertising cookies or third-party analytics tracking. Our newsletter signup form (operated by Kit) may set its own cookies; see Kit’s privacy policy for details.

First-party website analytics. We collect anonymous, first-party usage analytics on our website (including our free combat tracker) to understand how our tools are used and which channels bring visitors. This is stored on our own infrastructure (Supabase) and involves no cookies and no third-party analytics or advertising scripts. It contains no personal information — no names, no email addresses. We store a randomly generated anonymous identifier in your browser’s local storage, together with basic non-identifying information such as how long a tool was used and which campaign, search engine, or website referred you (for example, from a link or an ad we ran), so we can measure how well our marketing works. We do not track you across other websites, and this data is never sold or shared. You can opt out at any time by clearing your browser’s local storage for our site.

We do not currently respond to “Do Not Track” browser signals because there is no widely accepted standard for how to interpret them. Either way, we do not track you across websites for advertising purposes.

Changes to this policy

We may update this policy from time to time. If we make material changes, we will notify you by email (if you have an account) or by posting a notice in the app or on the website. The “Effective” date at the top of this policy reflects the most recent update.

Contact us

Questions, concerns, or requests:

info@tablehero.games

Or by mail:

TableHero
642 Thunder Glen
Escondido, CA 92027
USA