Your table, your data

Developer and contact

• App: Open Dungeon Master (Android package com.opendungeonmaster.app; desktop apps of the same name)
• Developer: lebbi, publishing as Open Dungeon Master. An independent open source project, MIT licensed.
• Website: opendungeonmaster.com
• Privacy contact: [email protected]
• Source and issue tracker: github.com/Lebbitheplow/open-dungeon-master

Write to the privacy address with any question, request or complaint about your data. We answer within 30 days.

In short

• There is no Open Dungeon Master account and no service the developer runs your game on. Your data lives on your own device, or on the server you chose to join.
• The apps contain no advertising, analytics, crash reporting, or tracking identifiers, and never read your location or contacts.
• The developer cannot see, and does not collect, sell, or share, anything you do in the app.
• The single exception is the sharing tunnel, which sees the IP address that asks for a temporary address and keeps it only as a salted hash for up to 24 hours. Details under Data sharing.

Data we collect

"Collect" here means data the software stores at all. Almost all of it is stored by your copy of the app, on your device or on the server you play on, and never reaches the developer.

Stored on your device, or on the server you play on

• Account credentials for each world: a username you choose and a salted hash of your password. Never the password itself. If a server operator has enabled Discord sign-in and you use it, your Discord username, ID and avatar are stored on that server.
• Game content you create: campaigns, characters, chat and narration, dice history, notes, and any images, audio or files you upload or generate.
• Voice during voice chat is streamed between players and never recorded. Push-to-talk audio is sent to the server you are on for transcription and discarded once the text is produced.
• An AI provider key, only if you or the operator enter one, stored in that world's database.
• App preferences: the servers you have added, session tokens for them, and your local profile, in the app's private storage.
• Reports and blocks you make, stored on the server you made them on.

Received by infrastructure the developer runs

• When you tap Share: the port number your world listens on, and the IP address the request arrives from, stored only as a salted hash for rate limiting. Nothing else, and only while sharing.

The developer receives nothing at any other time. There is no telemetry, no usage analytics, no crash reports, no advertising identifier.

How data is used

• Credentials sign you in to a world. Session tokens keep you signed in on your own device.
• Game content is the game: it is shown to the other players at your table and, in AI-run campaigns, sent to the model that narrates.
• Voice and push-to-talk audio provide voice chat and speech to text at the table.
• The hashed IP address limits how many temporary sharing addresses one network can request per day, to prevent abuse.
• Reports let the admins of a server moderate it. Blocks hide a player from you.

No data is used for advertising, profiling, or sold to anyone.

Data sharing and third parties

The developer shares no data with anyone. The software does send data to the following parties, in each case because you or your server operator chose the feature:

• Other players. What you write and say at a table reaches the players at that table.
• The operator of a server you join. Everything you do on that server is stored there and is under that operator's control and their own rules. Scanning a friend's invite joins their server.
• Cloudflare, Inc. When you share a world from your device, the tunnel that lets friends reach it runs over Cloudflare's network. Traffic between your friends and your device transits Cloudflare, encrypted in transit, under Cloudflare's privacy policy. The temporary address broker the developer operates also runs on Cloudflare, and one DNS lookup confirms your new address works. Stop sharing and all of this ends.
• AI model providers. By default the AI Dungeon Master runs on the hosting machine and nothing leaves it. If a world's owner enters a key for a hosted provider, such as OpenAI or any OpenAI-compatible service, prompts and game content go to that provider under its own privacy policy.
• Discord, Inc. Only if a server operator enables Discord sign-in and you use it.
• Pixels smart dice. Pairing is over Bluetooth directly between your phone and the dice. Nothing goes to Pixels.

There are no advertising networks, analytics providers, or data brokers.

Device permissions

Each permission is requested only when you first use the feature that needs it, and every other feature works without it.

• Microphone. Voice chat with your party, and push-to-talk speech to text. Nothing is recorded or kept.
• Camera. Scanning a QR invite card. Frames are decoded on the device and never stored or sent anywhere.
• Bluetooth. Pairing Pixels smart dice so physical rolls reach the game. The app never reads your location. On Android 8 to 11 the system requires a location grant to scan for Bluetooth devices at all; from Android 12 on, no location permission is requested.
• Notifications. Turn alerts, session reminders, and the persistent notice that your device is hosting a shared world.
• Network. Reaching servers and, when you share, the tunnel. The app checks whether you are on Wi-Fi so it can offer a local address to friends on the same network.

Security

• Passwords are stored only as salted hashes. Session tokens are stored hashed on the server side.
• A world hosted on your device keeps its database in the app's private storage, encrypted at rest with a key generated on the device. On Android that data is excluded from cloud backup and device-to-device transfer.
• Connections to shared worlds and to servers reached over the internet use HTTPS. Connections to a server on your own local network may use plain HTTP, because such servers commonly have no certificate; the app tries HTTPS first.
• The temporary sharing address broker never stores a raw IP address, only a salted hash that expires within 24 hours.
• The software is open source. Anyone can read how it handles data, and security reports are welcome through the issue tracker or the privacy address.

If you run a server for others, you are responsible for keeping it updated and protected. Anyone with access to a server's database has access to the data on it.

Retention and deletion

• Game data and accounts are kept until you delete them. There is no automatic expiry, because there is no service to expire them from.
• Sharing sessions: the temporary address and the hashed rate-limit counter expire within 24 hours of the session ending.
• Voice and push-to-talk audio are never stored.

To delete your account on a server: open Account settings in the app and choose Delete account. It is signed out everywhere at once and erased, with everything it owns, after that server's grace period (default 14 days, undoable until then; an admin can erase it immediately). To delete a world hosted on your own device, uninstall the app or clear its storage. Full steps are on the account deletion page. You can also write to the privacy address for help.

Reports and blocks

From the table you can report a Dungeon Master passage, a player's message, or a player, and block a player so their messages are hidden from you and neither of you can contact the other. Reports are stored on the server you are on, with a copy of the reported text, and go to that server's admins, who are its moderators. Generated narration is only as good as the model behind it, and this is how an operator learns when it crosses a line.

Age

Open Dungeon Master is intended for players aged 13 and over, and the Play Store listing targets that age group. The app is not directed at children under 13 and we do not knowingly collect data from anyone under 13; a server operator who learns of such an account should delete it.

Changes

This policy is part of the open source project and changes only when the code does; every version is in the repository's history, and the effective date at the top moves with it. Material changes are noted in the release notes of the version that makes them.