Privacy Policy
1. Who we are
TomeMaester ("the Service") is run by Massimo Mercurio, Via G. Lamberti 44, 84013 Cava de' Tirreni (SA), Italy. We are the data controller under the EU General Data Protection Regulation (GDPR). Contact for any privacy question: contact@tomemaester.com.
2. What data we process and why
| Data | Why | Legal basis (GDPR art. 6) |
|---|---|---|
| Email address and password (the password is stored by our authentication provider in hashed form; we never see it) | Create and secure your account, reset your password | Contract (art. 6.1.b) |
| Display name you choose | Show your name to the game master and your table | Contract |
| Game content you create: campaigns, characters, monsters, encounters, notes, books, combat state | Provide the Service | Contract |
| Images you upload to notes | Show them to you and to the players of your campaign | Contract |
| Campaign membership data: which campaign you joined, the character you sit on, whether the game master approved you | Run the table between game master and players | Contract |
| Technical data your browser stores locally (login session, interface preferences such as font size) | Keep you logged in and remember your settings | Legitimate interest / strictly necessary (art. 6.1.f) |
| Acceptance of the Terms and of this Policy (version, date and time) | Prove you accepted them | Legal obligation / legitimate interest |
We do not use advertising, advertising trackers, analytics cookies or profiling. We do not sell your data. Our website does not set cookies and does not load content from third parties.
Payments are processed by Paddle (see section 4). We receive from Paddle only what we need to activate your plan (subscription status, plan, country). We never see your card details.
3. Who can see your data inside the Service
- Game master: sees the display names of the players in their campaign and all campaign content.
- Players of a campaign: see the content the game master shares with the table.
- Images in notes can be opened by anyone who has their direct link, even without signing in. Share links to your images only with people you trust.
- Important: do not put sensitive personal information (health, real addresses, etc.) in your notes or characters.
4. Service providers (processors)
| Provider | Role | Where |
|---|---|---|
| Google (Firebase Authentication, Realtime Database, Hosting) | Accounts, data storage, website hosting | Database in the EU (Belgium, europe-west1); authentication and hosting on Google's global infrastructure |
| Google (Firebase Storage) | Images uploaded to notes | United States |
| Paddle.com Market Ltd | Merchant of record: sells the subscription, collects VAT, handles billing | United Kingdom / EU |
Transfers outside the EU rely on the EU–US Data Privacy Framework, to which Google is certified, and on Standard Contractual Clauses.
5. How long we keep data
- Account and game content: as long as your account exists.
- When you delete your account (section 6), your account and the data listed in section 2 are deleted immediately. Content of campaigns you ran is deleted with them. The character sheet of a player stays with the game master's campaign.
- Billing records are kept by Paddle as required by tax law.
6. Your rights
You can access, correct, export or delete your data, restrict or object to processing, and lodge a complaint with your data protection authority (in Italy: Garante per la protezione dei dati personali, www.garanteprivacy.it).
- Delete your account at any time from Settings → Delete account. This removes your account and your data.
- For any other request, write to contact@tomemaester.com. We answer within 30 days.
7. Age
You must be at least 16 years old to create an account. Younger players can take part in a game only through the device and account of an adult (for example the game master's table device). We do not knowingly collect data from children. If you believe a child has created an account, write to contact@tomemaester.com and we will delete it.
8. Changes
If we change this Policy in a significant way, we will tell you by email and in the app before the change takes effect.