Privacy Policy

Account data: your email address, password (stored only as a salted hash, never in plain text), and an optional display name and avatar image.

Campaign content: the campaigns, scenes/maps, tokens, and character sheets you create. In-session chat is not persisted — it’s a live transcript only, gone on reload.

Payment data: handled by WayForPay (see below) — we store the resulting subscription status and a recurring-billing token, not your card number.

Technical data: your IP address (used to prevent abuse and enforce rate limits) and authentication cookies (see Cookies below).

• to create and secure your account, and keep you signed in;
• to operate core features — campaigns, live scenes, chat, dice and combat resolution;
• to process subscription payments and enforce Free/Pro tier limits;
• to prevent abuse and enforce rate limits;
• to communicate with you about your account, when necessary.

We don’t sell your personal data, and we don’t use it for advertising.

We use two strictly necessary, httpOnly cookies — an access token and a refresh token — to keep you signed in. They aren’t readable by page scripts and aren’t used for tracking or advertising. We don’t currently use any analytics or advertising cookies or trackers.

We share the minimum data necessary with a small number of providers that help us run the Service:

• WayForPay — payment processing for Pro subscriptions.
• Cloudinary — hosting for uploaded images (avatars, campaign assets).
• Amazon Web Services (AWS) — hosts the application and database.

Each processes data only as needed to provide their service to us, under their own privacy and security terms.

Card payments are handled entirely by WayForPay. We never receive or store your full card number. WayForPay’s callback to us includes a masked card reference used only to verify the transaction’s authenticity, plus a recurring-billing token we use to process your next monthly charge — the masked reference itself isn’t retained.

We keep your data for as long as your account is active. To request deletion of your account and associated personal data, email volodumur113@gmail.com — we’ll process the request within a reasonable time. Note that deleting a campaign you DM also removes the scenes, tokens, and membership records tied to it.

Depending on where you live, you may have rights to access, correct, or delete your personal data, or to object to certain uses of it. Contact us at the email above to exercise any of these rights.

Passwords are hashed, not stored in plain text. Access to the Service requires cryptographically signed tokens, and we rate-limit authentication attempts. No system is perfectly secure, but we take reasonable measures to protect your data.

CampaignHub isn’t directed at children, and you must be at least 16 years old to create an account. We don’t knowingly collect personal data from anyone younger.

Our hosting and service providers may process data outside your own country. By using the Service, you understand your data may be transferred to and processed in other countries, including Ukraine and the United States.

We may update this Privacy Policy from time to time. If we make material changes, we’ll update the effective date above.

Questions about this Policy or your data? Reach us at volodumur113@gmail.com.