Privacy Policy

Scryboard is a live-session companion for tabletop RPGs, made by Aperform. This policy explains what information Scryboard collects, why, who it is shared with, and the choices you have. It applies to scryboard.vercel.app and the Scryboard App Runner. The Terms and Conditions cover how the service itself works.

• Account details: your email address, a password (stored only as a secure hash by our authentication provider), the name you show in campaigns, and your settings, including your data-sharing choice.
• Campaign content: the notes and files you upload, what Scryboard extracts from them, session transcripts, session summaries, encounter and combat records, messages sent in a session, and character data players add or import.
• Session audio: while a Dungeon Master is recording, table audio is streamed to our speech-to-text provider to produce the transcript. Scryboard does not keep the audio itself; only the text transcript is stored.
• Purchases: what you bought, when, and the amount. Card details are collected and held by Stripe; Scryboard never sees or stores them.
• Your own AI key, if you add one: stored encrypted and used only to run your own sessions.
• Technical records: the logs our hosting and database providers keep to run and secure the service (for example IP addresses and request times), and records of AI and transcription use so we can enforce session limits and understand costs.

• To run the service: sign you in, store your campaigns, transcribe and analyse sessions, show content to the players you invite, and run the apps you install.
• To take payments and keep track of the sessions you have bought and used.
• To keep the service secure and working, prevent abuse, and fix problems.
• To contact you about your account, a purchase, or a change to these policies.
• To improve how accurately Scryboard tags and extracts campaign content, only if your data-sharing setting allows it (see section 6).

We do not sell your personal information, and we do not use it for advertising.

We use these service providers to run Scryboard. Each receives only what it needs for its part:

• Supabase: database, sign-in and file storage.
• Vercel: website hosting.
• Deepgram: speech-to-text for live sessions. Deepgram may retain audio it processes and use it to improve its own services, under its own policies; the Terms explain this in section 5.
• Anthropic: the AI that extracts content from your notes and analyses sessions. If you run a session on your own AI key, that session's AI requests go to the provider you chose (Anthropic, OpenAI or OpenRouter) under your own account with them.
• Stripe: payments and receipts.

We may also disclose information if the law requires it, to protect people's safety, or as part of a sale or reorganisation of the business, in which case this policy would continue to apply.

Marketplace apps are made by third parties and run on your own device or in your browser, not on Scryboard's servers. When you install an app, it receives an access key that lets it read the campaign data its listing declares, and nothing more. What an app does with that data, including sending it to outside services it lists (for example a voice or image service billed to you), is the app developer's responsibility. Check an app's listing before installing it; you can remove an app at any time, which stops its access.

Every account has a data-sharing setting, chosen at sign-up and changeable at any time in Settings. When it is on, your campaigns' session data (transcripts, extracted content and corrections) may be used to improve Scryboard's tagging and extraction. When it is off, it isn't. A change applies from then on. A campaign's setting is controlled by its Dungeon Master and applies to everyone in that campaign; players are asked to agree before joining.

The Dungeon Master who owns a campaign can see its content, including what players add. Players see what the DM shares with the table, plus their own character and messages; they cannot see the DM's private notes, transcripts or prep. A DM can remove a player from a campaign.

Scryboard uses only the cookies needed to keep you signed in. It does not use analytics, advertising or tracking cookies. Your browser's local storage holds small conveniences, such as how you have arranged your dashboard and which tutorial episodes you have listened to.

We keep your account and campaign content for as long as your account exists, so your campaigns are there when you come back. If you delete a campaign, its content is removed from Scryboard (uploaded files can take longer to be cleared from storage). If you ask us to delete your account, we delete your account and the campaigns you own, except records we must keep for legal, tax or accounting reasons (such as purchase records), and copies in routine backups, which expire on their own schedule.

You can see and edit most of your information inside Scryboard, change your data-sharing setting in Settings, and remove apps or campaigns at any time. To get a copy of your data, correct something you can't edit yourself, or delete your account, email support@scryboard.net. Depending on where you live, you may have further rights under data-protection law; we will honour them.

Data is sent over encrypted connections, access to campaign data is restricted to the people and apps allowed to see it, and keys you give us are stored encrypted. No system is perfectly secure; if something goes wrong that affects your information, we will tell you.

Scryboard is not intended for children under 13, and we do not knowingly collect information from them. If you believe a child has created an account, contact us and we will delete it.

Our providers may store and process information in the United States and other countries. By using Scryboard you understand that your information may be processed outside the country where you live.

We will update this page as Scryboard changes, and tell you about significant changes by email or in the app.

Questions about privacy can go to support@scryboard.net or through the Contact page.