Privacy

You can use the app without signing in. Your characters then stay in this browser only and nothing about you is sent to us, apart from the ordinary requests that load the app.

• Your account: email address, name, and the profile picture link Google or Discord provides, if you sign in with them.
• Linked sign-ins: for Google or Discord, your id there and the tokens they issue when you sign in.
• Sessions: a random token per signed-in device, kept for 30 days and renewed while you use the app. We don't record your IP address or browser with it.
• Email sign-in links: only a scrambled (hashed) copy of the link, which expires after 5 minutes.
• Your characters and portraits, so they sync between your devices.
• Abuse protection: to limit repeated sign-in attempts, a counter keyed by IP address is kept for a few minutes and then deleted.

• One sign-in cookie, needed to keep you signed in. No other cookies.
• Your characters and portraits, so the app works offline, and your theme choice.
• The app's own files, cached so it opens without a connection.

• Vercel hosts the app and handles every request, including your IP address, as any web host does.
• MongoDB Atlas stores the data above, in an EU region.
• Brevo sends the sign-in and account emails, so it sees your email address and the link.
• Google or Discord, only if you choose to sign in with them.

Some of these companies are based in the US. Your data isn't sold or shared with anyone else.

Storing your account and characters is how the service you sign up for works. The short-lived sign-in counters protect the service and its users from abuse.

Choose Delete account in the account menu. After you confirm through the emailed link, your account, sign-ins, sessions, characters and portraits are deleted. We keep only the account's random id, with no email or name, so your other devices know to clear their copy.

You can ask for a copy of your data, have it corrected or deleted, or object to how it's used. Write to privacy@orderofthenuts.club. You can also complain to your local data protection authority.