Privacy notice

Who we are

Ordiria is run by "Francesco Peragine" ("Bari, Italy"), the data controller for the personal data described here. Contact: ordiria@francescoperagine.com.

What we collect

Waitlist: your email address, the optional campaign tag of the link you followed, the date you signed up and confirmed, and a salted one-way hash of your IP address used only to block abuse.

Account: your email address and your password, which is stored only as a one-way hash, plus the sign-in records our database provider keeps for security (time, IP address, browser).

Alpha access and game codes: whether your account has alpha access, as a tester or as the maintainer, and since when; and, for each game code you redeem, the code, the game it unlocks and when you redeemed it.

Campaigns and characters: what you and your group create and post, such as character sheets, campaign names, rolls, messages, turn order and roll requests, plus which campaigns you belong to, when you last opened each one, and the layout and view settings you chose in each.

Feedback: if you write to us, your email address and your message.

Website: anonymous, cookieless usage statistics. We set no cookies and build no profile of you.

On your device: your browser's local storage keeps your session while you are signed in (a sign-in token and your account's email address), so you stay signed in; your theme choice; your character drafts, and which of them you chose not to save to your account; whether you asked not to see the builder's completion notice again; an invitation or game code link you opened, until it is checked while you are signed in; and, for each campaign you open, the message you are writing with its recipient and the rolls you staged with it, your messages not yet confirmed as sent, your layout and view settings, which characters you roll with real dice, the point up to which you cleared the roll log and the chat, and whether each of them shows hidden entries. Your browser sends the session with each request so we know it is you; the rest reaches us only when you act: a draft when you save a character to your account, a message or roll when you send it, and your layout and view settings, which are also saved to your account. Clearing your browser's data for this site removes all of it.

Why, and on what legal basis

We use your waitlist email only to confirm your signup, to invite you to the Ordiria alpha and, if you leave the waitlist, to confirm your removal. The legal basis is your consent (Art. 6(1)(a) GDPR), given when you submit the form and confirm through the link we email you.

We use your account, campaign and character data, your alpha access and the game codes you redeem only to run the service you signed up for: signing you in, opening to your account the features and games it has access to, saving your characters and campaigns, and showing your group what you post. The legal basis is our contract with you (Art. 6(1)(b) GDPR).

We read feedback to answer you and to improve Ordiria, on the basis of our legitimate interest (Art. 6(1)(f) GDPR).

The IP hash and the anonymous statistics rely on our legitimate interest in keeping the service secure and understanding how it is used (Art. 6(1)(f) GDPR). We never sell your data or use it for advertising.

Who can see what you post

The members of a campaign see what is in it: its characters, rolls, turn order and the messages sent to everyone. A private message is seen only by its sender and its recipient. We see which account, by its email address, redeemed each game code we issued. We publish nothing from your account or your campaigns.

How long we keep it

Unconfirmed signups are deleted after 7 days. The IP hash is deleted after 24 hours. Confirmed addresses are kept until you unsubscribe, accept your alpha invitation (your account then takes the waitlist entry's place), or we close the waitlist, and never longer than 24 months after signup.

Your account, characters and campaigns, your alpha access and your redeemed game codes are kept until you ask us to delete your account; we may end your alpha access or revoke a game code earlier. We then delete, within one month, your account, your alpha access, your redeemed game codes, your characters, the campaigns you run with everything in them, and your rolls and messages in other campaigns.

Feedback emails are kept only as long as we need them to answer and act on them, and never longer than 24 months.

Who processes it for us

Supabase (accounts, database and server functions, hosted in the EU, Ireland); Resend (email delivery, including account emails, sent from the EU; Resend is a US company and any transfer is covered by Standard Contractual Clauses); Cloudflare (website hosting and delivery, and forwarding of email sent to our feedback address); PostHog (anonymous statistics, EU hosting). Each acts only on our instructions under a data processing agreement.

Your rights

You can access, correct or delete your data, restrict or object to its processing, and receive it in a portable format. To delete your account, write to ordiria@francescoperagine.com. You can withdraw your waitlist consent at any time with the removal link in any waitlist email we send, or by writing to ordiria@francescoperagine.com. Withdrawal does not affect processing done before it.

You can also lodge a complaint with a supervisory authority: Garante per la protezione dei dati personali (garanteprivacy.it).

Changes

If this notice changes, we update the date above. If the change affects how we use your email or your account, we will tell you before it applies.