Privacy Policy

Who is responsible for your data

The Service is built and operated by an individual in Denmark. For the purposes of the EU General Data Protection Regulation (GDPR), that operator is the data controller. You can reach us using the contact details at the end of this policy.

What we collect

• Account details — your first name, last name and email address, plus a securely hashed version of your password (we never store the password itself).
• Content you create — the pods you make or join, player names, game results and history, commander details, Game Nights you plan or are invited to (with the answers given, and the place and note they carry), and any avatar you choose.
• Technical data — a single login session cookie, and standard server logs (such as IP address and timestamps) that our host records to keep the Service running and secure.
• Security & audit records — a log of key account and pod actions (for example member and admin changes) that we keep to protect the Service and investigate abuse.

Some content you enter is about other people — the names of players in your pod. Please only record what you have a reasonable basis to record, and see “Data about other players” below.

Why we use it, and our legal basis

• To provide the Service — creating your account, saving your pods and games, showing your stats. Legal basis: performance of our agreement with you.
• To send essential emails — email verification, password resets, pod invitations you ask us to send, and confirmation when an account is deleted. Legal basis: performance of our agreement with you.
• To send Game Night emails — invitations, confirmations and changes for Game Nights in your pods. You can turn these off on your profile at any time. Legal basis: performance of our agreement with you.
• To keep the Service secure and working — abuse prevention, debugging, backups. Legal basis: our legitimate interest in operating a safe, reliable service.

We do not use your data for advertising or profiling, and we do not sell or rent it to anyone.

Cookies

We use exactly one cookie: a strictly-necessary session cookie that keeps you logged in. It is not used for tracking or advertising, and because it is essential to a service you asked for, it does not require a consent banner. We use no analytics, advertising or third-party tracking cookies of any kind.

Who we share it with

To run the Service we rely on a small number of processors, who handle data only on our instructions:

• Railway — our hosting provider. Runs the application servers and the database where your account and game data live, and keeps the server logs described above.
• Resend — our email provider. Delivers the essential emails listed above. It processes your name and email address for that purpose only.
• Ko-fi — our tips provider, and only if you choose to tip. Tips are handled entirely on their platform; we never see your card or payment details.

Some of these providers process data outside the EU/EEA, including in the United States. Where that happens, transfers are covered by appropriate safeguards such as the European Commission’s Standard Contractual Clauses.

How long we keep it

We keep your account and content for as long as your account exists. If you delete your account, or ask us to delete it, we remove your personal data from the live Service. Note that games you took part in remain in your pod’s shared history so those records stay intact — your name may still appear there, but it is no longer linked to any account. Encrypted backups are retained for 30 days and then automatically deleted, so residual copies in backups are purged within that window. Security and audit-log records are kept for up to 1 year and then automatically removed. To stay within our email provider’s limits we count the emails we send — the kind of email and the pod, never your address — and delete that count after 31 days. We may retain minimal records where the law requires it.

Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you;
• have inaccurate data corrected;
• have your data erased;
• receive your data in a portable format;
• object to, or ask us to restrict, certain processing;
• withdraw consent where we rely on it.

Several of these you can exercise yourself, without asking us: your profile page changes your name, email address and password, and deletes your account outright. If you own a pod, Manage pod downloads that pod’s complete game history as a CSV file at any time.

For everything else — including a copy of your own data when it sits in a pod you don’t own — email us using the details below and we will put it together for you by hand; there is no self-service button for it. We reply within one month, as the GDPR requires. You also have the right to complain to your local data protection authority — in Denmark, that is Datatilsynet (datatilsynet.dk).

Data about other players

When you add players to a pod, you may enter names of people who don’t have their own account. You are responsible for having a legitimate reason to record that information. If someone asks to be removed from a pod’s records, the pod owner can edit or delete them, or you can contact us for help.

Children

The Service is not directed to children under 13, and we do not knowingly collect data from them. If you believe a child has given us personal data, please contact us and we will remove it.

Changes to this policy

We may update this policy as the Service evolves. When we make material changes we will update the date at the top, and where appropriate we’ll let you know in the app or by email.

How to reach us

Questions about your data, or want to exercise a right above? Email hello@commandery.gg and we’ll help.

Fan content notice. Commandery is unofficial Fan Content permitted under the Wizards of the Coast Fan Content Policy. Not approved or endorsed by Wizards. Portions of the materials used are property of Wizards of the Coast. ©Wizards of the Coast LLC. See our Terms of Use for details.