Privacy Policy
Realmkit (realmkit.app) is a campaign workspace for tabletop game masters. It is run by its independent developer ("we", "us"). This policy explains what we collect, why, and what you can do about it. If you have a question, write to support@realmkit.app.
What we collect
- Your account. Your nickname, your email address, your password (stored only as a one-way hash, so nobody can read it) and the date you confirmed your email.
- Your content. Your campaigns and everything in them: pages, notes, session plans, maps, images and other files you upload.
- Files for an import. The files you upload to import notes are kept only until that import is finished or cancelled, and then deleted. The notes and pages made from them stay in your campaign until you delete them.
- Sign-in sessions. A record for each device you are signed in on, so you stay signed in.
- Players at your table. A player who joins a battle through your link types a nickname. It is kept with that battle.
- Technical data. Our servers process IP addresses to run the service and to protect it from abuse, for example to limit repeated sign-in attempts. Server logs may contain them for a limited time.
- Visits to our public pages. We count visits with Cloudflare Web Analytics, which uses no cookies and does not track you across sites.
- Messages to us. When you write through the contact form, we get an email with your name, email address and message, the topic you picked and the page of our site you came from, and we send you one email back to say it arrived. It is kept in our support mailbox so we can answer you; the site itself keeps no copy.
How we use it
We use your data to run Realmkit for you, to send the emails your account needs (confirming your address, resetting your password, telling you your email changed), to keep the service secure, to answer your messages and to understand, in aggregate, how the site is used.
We do not sell your data. We do not show ads. We do not use your content to train AI models, and we do not let anyone else do so.
Services we rely on
- Hosting. Your account and campaigns are stored on a server in the European Union.
- OpenAI. When you import notes or ask for a review of a session plan, the text involved is sent to OpenAI's API to be read and organised. OpenAI does not use data sent through its API to train its models, and keeps it for up to 30 days only to detect abuse. See How Realmkit uses AI.
- Resend sends our emails.
- Cloudflare counts visits to our public pages (Cloudflare Web Analytics) and runs the human check, Cloudflare Turnstile, on sign-up, password reset, repeated failed sign-ins and the contact form. To tell a person from a bot, Turnstile reads signals from your browser and your connection; Cloudflare uses them only for that, not to identify, profile or target you. See the Turnstile Privacy Addendum.
- Featurebase runs our Help & Feedback portal. When you use it, its own privacy policy applies.
Some of these services may process data outside the European Union, under their own safeguards for such transfers.
Cookies and your browser
The app uses two cookies to keep you signed in. It also keeps a few preferences in your browser's local storage, such as which pages you had open. We use no tracking or advertising cookies.
How long we keep it
We keep your account and content while your account exists. When you ask us to delete your account, we delete it and everything in it. Our backups are kept for a short time and then deleted, so a deleted account also disappears from them.
Your data, in your hands
You can download a copy of any campaign yourself, at any time: open Campaign Settings and choose Export → Download a copy. You get every page as a Markdown file you can open in any editor, your images, and a copy Realmkit can restore into a new campaign. Any single page can be printed or downloaded as Markdown from its menu.
Your rights
You can ask us for a copy of the rest of your data, to correct it, or to delete your account. Write to support@realmkit.app from the email address on your account. If you live in the European Union or the United Kingdom, you can also complain to your local data protection authority.
Security
Passwords are stored as one-way hashes, every connection is encrypted, and access to the servers is limited to us.
Children
Realmkit is not meant for anyone under 13. If we learn that someone under 13 has an account, we delete it.
Changes
When this policy changes, we update this page and its date. If a change matters for how we use your data, we tell you in the app or by email first.