Privacy Policy
Effective date: October 3, 2026
Quest Deeds ("we", "us") runs questdeeds.com and app.questdeeds.com, a platform for organized tabletop roleplaying play: table sign-ups, leagues, and player logs. This policy explains what we collect, why, and what you can do about it. Questions: [email protected].
What we collect
Account. If you sign in with a one-time email link: your email address. If you sign in with Discord: your Discord user ID, your display name and, if Discord has verified it, your email address. We do not receive your Discord password, messages, friends or server list, and we do not keep Discord access tokens.
Profile. Your display name, your city or region and time zone if you set them, your language, and your role (player, DM, organizer). Your display name starts as your Discord name or, if you sign in by email, a neutral placeholder such as "Player #1234"; you can change it in your profile at any time.
Play data. Games you sign up for or run, attendance, leagues you join, characters you create (name, portrait, class and other details you enter, level, home location, description), adventure log entries (adventure, date, DM name, venue, level, gold, items, rewards, notes), ratings and feedback you leave, and anything you write in campaign journals.
Imported logs. When you import a log from another site (CSV files you downloaded there), we read the files to create your log entries, including DM names recorded in them, and do not keep the files themselves.
Waitlist. If you join the questdeeds.com waitlist: your email, role, the games you play, and optionally city/state and store or club name, plus the time you agreed to hear from us.
Files. Images you upload, such as character portraits.
Technical. A session cookie that keeps you signed in for up to 30 days. With each session we keep your IP address and browser type; we also keep the country you signed up from, as reported by our network provider. We record how the app is used (screens opened and actions taken, linked to your account) and error reports (the error, the page address and browser type), so we can see what works and fix what doesn't. Our hosting provider keeps server logs for up to 30 days.
Our network provider, Cloudflare, also measures page views and loading speed with Cloudflare Web Analytics, a script that works without cookies and does not track you across sites. We do not use advertising trackers or advertising cookies.
Why we use it
- To run the service: sign you in, show your games, keep your log and characters.
- To send you service email: sign-in links, game changes, cancellations, reminders. These are part of the service and have no unsubscribe link.
- To send launch and product news, only if you opted in on the waitlist or at sign-in. Every such email has an unsubscribe link.
- To keep the service safe and working: rate limits, abuse prevention, debugging.
We do not sell your personal information, and we do not share it for advertising.
What other people can see
- Game pages. A published game's page can be opened by anyone with the link, including people who are not signed in. It shows the DM's display name and the players signed up: display name, character name, class, level and portrait.
- Shared logs. When you press "Share log", anyone with that link can see that character's card and adventure log, including your notes and the names of the DMs you played with. Your own display name is not shown. We ask search engines not to index these pages. You can revoke the link at any time from the log screen: the old link stops working immediately, and sharing again creates a new one.
- Leagues and activity. Your display name and characters are visible to other participants of games and leagues you join, on league leaderboards, and in activity feeds.
- Discord announcements. A DM or organizer can connect a Discord server so that Quest Deeds posts game announcements to a channel there. An announcement shows the game details and the DM's display name. For a connected server we keep the server and channel names and IDs and who connected it. Our bot only posts, edits and deletes its own messages; it does not read messages or member lists.
- Uploaded images are served from addresses that are hard to guess but not protected by sign-in.
Who processes data for us
| Provider | Purpose | Location |
|---|---|---|
| Railway | Application hosting and database | Netherlands (EU) |
| Cloudflare | DNS, network protection and caching, page-view and performance statistics, email forwarding for our addresses | Global |
| Resend | Sending email (sign-in links, notifications, news) | Japan |
| Discord | Sign-in, if you choose Discord; game announcements in connected servers | USA |
We also keep periodic backup copies of the database in private storage outside our main hosting. These providers process data on our instructions. We may disclose information if required by law or to protect users and the service.
How long we keep it
- Account and play data: while your account exists.
- Sign-in links: 15 minutes, and they work once. Sessions: 30 days.
- Waitlist and news subscriptions: until you unsubscribe or ask us to remove them.
- Records of how the app is used (screens opened and actions taken) and error reports: up to 120 days.
- Server logs: up to 30 days.
- Database backups: up to 30 days.
Deleting your account
You can delete your account yourself in Settings, or ask us at [email protected]. Deleting it removes your profile, characters, log entries, game sign-ups, the ratings and feedback you left, and signs you out everywhere.
Some things stay, without a link to your account: games you ran and the log entries other players earned in them (your name is no longer attached), images you uploaded, messages you sent to support, and copies in backups for up to 30 days. A news subscription for your email stays until you unsubscribe. Write to us if you want any of these removed as well.
Your choices and rights
You can view and edit your profile, characters and log in the app, and download a character's log as CSV or PDF. You can ask us to access, correct, export or delete your data by writing to [email protected]; we will answer within 30 days. We will not treat you differently for using these rights.
Children
Quest Deeds is not for children under 13, and we do not knowingly collect their personal information. If you believe a child under 13 has given us information, contact us and we will delete it.
Security
All traffic uses HTTPS. Sign-in links work once and expire quickly, and we never ask for or store passwords. No system is perfectly secure. If a breach affects you, we will notify you as the law requires.
Changes
We will post changes here and update the effective date. If a change materially affects how we use your data, we will email you before it applies.