What leaves your machine
Desktop appAndroid appServer
There is no Open Dungeon Master service in the cloud. The project runs no accounts, receives no campaigns, and sees no play. What leaves your machine depends only on what you connected it to.
By setup
| Setup | What leaves, and to whom |
|---|---|
| Human Dungeon Master, local world, no sharing | Nothing. |
| Local model, ComfyUI, Kokoro on your own hardware | Nothing. Dice, rules, story, pictures and voice all stay home. |
| OpenAI key | Each turn's prompt to OpenAI: the narration so far (packed to the context window), the party's sheets, the scene, the secret arc, lines and veils, and the player's messages. Picture prompts if pictures are on. Dice and rules never leave; they are resolved locally and only their results are in the prompt. |
| OpenRouter or another router | The same prompt to the router and on to the model's provider. |
| An agent program | The same prompt to the agent's provider, on the agent's own account. The program is started with no access to your files or network beyond that. |
| Sharing an app-hosted world | Game traffic between your device and your friends' apps or browsers, through a tunnel. The project's broker sees the tunnel's name and your IP while you share, never the game. Mesh voice may relay audio through a TURN server when two networks cannot connect directly; the relay cannot read it. |
| A self-hosted server | Whatever the administrator connected: the same rules apply to each backend. |
Small things worth knowing
- The world registry. Browsing world packs in the admin panel fetches a JSON index and, on install, one file over HTTPS from the registry. Set it to
offto browse none. - The update check. The desktop app asks GitHub for the newest release when it opens. The Android app does not; Google Play handles it. A server asks GitHub at most every six hours whether a newer release exists, for its About dialog, with an anonymous request;
ODM_UPDATE_CHECK=offstops it. - The tunnel helper. The desktop and Android apps download cloudflared from GitHub the first time you share.
- The sound library. It ships with the server. The desktop and Android apps download it once from the server's GitHub release when an admin asks for it, and
npm run fetch-ambiencereaches public archives only when you run it. - Assistant links. A cloud assistant you connect to a shared device world through an assistant link reaches it through the project's relay, which forwards the requests and limits each world's traffic, and reads only what its grant allows.
- The invite interstitial. An
opendungeonmaster.com/jlink opens a static page that shows the destination server and asks the person to confirm. It logs nothing about the game. - Dice and rules are always local. No backend ever decides a roll or edits a sheet; the model touches game state only through validated tools the server runs.
Keys
A key is stored on the server that uses it (the one inside your app, or the one you run) and sent only to its provider. It is never sent to players, never in a campaign snapshot, and never to the project. Backups contain it.
Accounts and deletion
An account exists only on the server it was made on. Deleting it there removes it and everything it owns after the grace period; see Accounts, friends and notifications and the privacy policy.