Privacy Policy

1. Who we are

Critsmith is the data controller for the personal data described here. It is currently operated by its founder ahead of formal incorporation as [Critsmith Ltd — details to follow]. For privacy questions, contact [privacy/support email to be added].

2. What we collect

• Account data— your email address, a hashed password (or your Google sign-in identifier if you use Google to sign in), and an optional display name.
• Age-assurance data — the birth month and year you give us at signup, and which age threshold (13+ or 16+) applied to you based on the country your signup appeared to come from. We do not ask for or store a full date of birth.
• Campaign data— everything you create in the app: campaigns, NPCs, plot threads, combat encounters, session notes, character sheets and similar.
• Community submissions — any content you submit to the shared community library, and your public handle.
• Technical data— standard server logs (IP address, timestamps) kept briefly for security and abuse prevention.

3. What we don't currently collect

We run no analytics and no third-party tracking today. The only cookie we set is the session cookie that keeps you signed in.

4. Why we process it

To provide the service you've signed up for; to check you're old enough to use Critsmith and meet our legal obligations around under-13s; to keep the service secure; and, with your consent where required, to show advertising on certain free-tier pages in future (see below).

5. Advertising (free tier)

We intend to fund part of the free tier through Google AdSense, shown only on certain pages inside the signed-in product. Our public pages, including this one, carry no advertising and no third-party tags. If and when advertising is switched on:

• it will never be shown to anyone under 18;
• under-18 users will only ever see Google's "limited ads," which use no personalisation and no local identifier;
• adult users in the UK/EEA will be asked for consent through Google's certified consent platform before any personalised advertising is shown, and can withdraw that consent at any time from account settings.

6. Who we share data with

Supabase, our database and hosting provider (UK/EU region), to store your data. Stripe, once you subscribe to a paid tier, to process payment — we don't store your card details ourselves. Google, for advertising, only as described above and only once enabled. We don't sell your data, and we don't share your campaign content with anyone except where you choose to — for example inviting a player into a campaign, submitting to the community library, or sharing a combat encounter.

7. International transfers

Our hosting is in the UK/EU. Where a provider we use (such as Stripe or Google) processes data outside the UK/EEA, they do so under an approved transfer mechanism, such as the UK's International Data Transfer Addendum or an equivalent safeguard.

8. How long we keep it

We keep account and campaign data for as long as your account is active, plus a short period afterward in backups. If a signup is refused because you're under 13, that account and the data supplied is deleted promptly. Server logs are kept briefly for security purposes, then deleted.

9. Your rights

Under UK GDPR you can ask us to: give you access to the personal data we hold about you; correct it if it's wrong; delete it; restrict or object to some processing; or give you a copy in a portable format. To exercise any of these, contact us at [privacy/support email to be added]. You can also complain to the UK Information Commissioner's Office (ico.org.uk) if you think we've got something wrong.

10. Children's data

Critsmith is not intended for anyone under 13 (or under 16 if you're in the EEA or California) — see our Terms of Service for how we check this at signup. We don't knowingly collect data from anyone below the applicable age, and we don't target children with advertising or profile them.

11. Changes to this policy

We'll update this page if what we collect or do with it changes, and flag material changes in the product.

12. Contact

Privacy questions: [privacy/support email to be added].