Privacy Policy
Effective September 23, 2026.
Torchbound is a site for a tabletop roleplaying game: its books, the characters players make and the campaigns they play. This page says what we keep about you, why, who else handles it, and how to have it removed. The site is in testing, and this policy will change as the site does. We will update the date above when it does.
What we collect
| Your account | Your name, your email address and when you signed up. If you use a password, we keep only a salted scrypt hash of it, never the password itself. If you sign in with Google, we keep the ID Google gives your account so we can recognise you again. |
|---|---|
| What you make | Characters, campaigns, battle maps, messages sent in a campaign’s chat, and any pictures, audio or video you upload. |
| Sign-in attempts | To slow down password guessing, we count failed sign-ins by email address and by the network address they came from. These counts are held in memory only, and they are gone within an hour. |
| Server logs | Our host records requests to the site, which can include your network address, for running and debugging the service. |
We do not use advertising, analytics or tracking scripts, and we do not sell or rent your information to anyone.
Signing in with Google
If you choose “Sign in with Google”, Google tells us your name, your email address, whether that address is verified, and your Google account ID. We ask for nothing else. We do not see your Google password, contacts, files or other Google data, and we use what Google sends only to sign you in and run your account.
Cookies and browser storage
We set only the cookies the site needs to work:
- Session: keeps you signed in for up to 30 days.
- Campaign: remembers which campaign you have open.
- Google sign-in: a short-lived check, lasting at most 10 minutes, that protects the sign-in from forgery.
Your browser also stores display preferences on your own device, such as whether the sidebar is folded. These never leave your browser.
Who can see what
The people in a campaign see what is shared in it: characters, maps and chat. The site’s administrator can see the list of accounts, with names and email addresses, in order to approve new accounts and run the site.
Services that handle data for us
- Railway hosts the site and stores its databases and uploads.
- Google provides the optional sign-in. It also serves the site’s fonts, so your browser contacts Google’s font servers when pages load.
- Resend delivers the site’s emails, such as the note that your account has been approved. It receives your email address and the message.
Keeping and deleting your data
We keep your account and what you make for as long as your account exists. To have your account and your data deleted, or to get a copy of it, write to privacy@torchbound-game.com from the address on your account. We will act on it within 30 days. If we turn away an account request, that account is deleted at once.
Children
The site is not meant for children under 13, and we do not knowingly keep accounts for them. If you believe a child has made an account, write to us and we will remove it.
Security
The site is served over HTTPS. Passwords are stored only as hashes, sign-in attempts are rate limited, and new accounts need approval before they can sign in. No system is perfectly secure, so use a password here that you do not use anywhere else.
Contact
Questions about this policy go to privacy@torchbound-game.com.