Privacy policy

Who we are

BYTEWORKS DIGITAL SERVICES S.L. (NIF B56375082) runs Dungeon Minion and is the controller of your personal data. Email info [at] dungeonminion.com. Full company details are in the legal notice. This is our privacy notice under the GDPR and Spanish Organic Law 3/2018.

What we collect

• Without an account: nothing you make. The editors run in your browser and keep your map there.
• Your email, to send a one-time sign-in link and mail about your account. Links work once and expire in 20 minutes, and we keep only a hash of them.
• Your username and crest: the name you pick after signing up and the seed your crest is drawn from. Both show on your account, and on the pages of maps you share; you can change them on your account page. Whether you share maps to the community is remembered too.
• What you save: maps, worlds, tokens, campaigns, their names and notes, their thumbnails, and any pictures you upload or fetch from a link you paste. When you paste a link, our server fetches that picture for you.
• Tables you play at: the name you give, a colour, who's at the table right now, and what you can see and move there. A guest's name and a cookie are all we hold about them.
• Invites: if a game master invites you, they give us your email and we use it only to send that invite and let you join.
• Connected tabletops: which ones you've connected, and a hash of each one's access key.
• Server logs: IP address, time and browser, kept for a short time for security.
• Statistics: cookieless traffic counts, and, only if you accept, the analytics in the cookie policy. Our own count works from a same-day code made on our server from your IP address (cut to its network) and your browser's name, or your account if you're signed in, mixed with a secret: we never store the address, the browser or the account with it, and the code is deleted within two days. With it we count pages seen, the site or tagged link a visit came from, and a few steps like making or saving a map. If your browser sends Global Privacy Control, we don't count you unless you're signed in.

We don't sell your data, and we don't use what you make or upload to train AI models.

Why we use it

• To run your account and your tables (contract).
• To keep the service secure, and to count visits without cookies (legitimate interest). You may object at any time.
• Optional analytics and ad measurement (consent). Withdraw it whenever you like: Cookie settings.
• To answer you and meet legal duties, such as handling a report about content (legal obligation, legitimate interest).

Who else sees it

• Your table. The game master sees the names of their players and which screen each has open. Players see one another, and what the game master reveals to them.
• Maps you share. Only if you share a map: anyone with its link sees its page (its picture, name, key and facts, your username and crest, never your email) and can open a copy of it. Shared to the community, it's also listed in our gallery and search engines may find it. Make it private again and its page goes.
• Your maps' pictures. The small pictures of your saved maps that lists show are stored at long, unguessable public addresses, so they load quickly; anyone holding an address can open it, and we never show it to anyone but you.
• Tabletops you connect. Your maps reach them only when you send them. The pictures you send are stored at long, unguessable public addresses, because those tabletops have to load them; anyone holding an address can open it.
• Our processors: DigitalOcean (hosting and file storage), MongoDB (database), Resend (email), and for statistics Ahrefs Pte. Ltd. and, with your consent, Google LLC, PostHog Inc. and Meta Platforms Ireland Limited.

Some of this happens outside the EEA, including in the United Kingdom and the United States. We rely on adequacy decisions, the EU–US Data Privacy Framework or Standard Contractual Clauses.

How long we keep it

Account data and everything saved in it stay until you delete them or the account (on your account page, or by asking us), unless the law requires us to keep something longer. Sessions end after 30 days and guest cookies after a year. The same-day codes we count visits with are deleted within two days, and the counts kept from them say nothing about anyone. Analytics cookies last as set out in the cookie policy.

Your rights

You may ask for access, correction, deletion, restriction or portability, or object to processing based on legitimate interest, by writing to info [at] dungeonminion.com. You can delete your account yourself on your account page: everything you saved goes with it at once. You may complain to the Spanish data protection authority (AEPD) or your local EU authority.

You need to be 18 to make an account. People of 14 or over may join a table as a guest with a parent or guardian's permission. The service isn't meant for children under 14.