About & Policies

Privacy Policy

Last updated: October 11, 2026

1. Who We Are

Red Autumn Software AS, a Norwegian company, is the Data Controller for personal data processed through the DungeonRig application and website.

Contact for all matters — general inquiries, privacy / GDPR / CCPA requests, and abuse reports / DMCA notices: contact@red-autumn.com (please indicate the topic in your subject line).

2. Local-First by Default

DungeonRig is designed to run on your machine. The core engine — your campaigns, worlds, characters, maps, fog of war, dice rolls, narration scripts, and in-game decisions — stays on your computer. We have no servers involved in your local play and we collect no data about it.

The exceptions are documented below: account / license verification, the optional Remote Play feature, and basic website usage.

3. What We Collect

3.1 Account & License Information

• Email address provided at purchase
• For a free Registered account created in the app or on our website: your email, verification time, and the age, Terms and Privacy acknowledgements you provide.
• Your optional marketing choice, its timestamp, source, wording version and consent history. Marketing is off by default and is not required to register. You can change it in the app or verify your email again on the download page; the confirmation also provides an unsubscribe link. Necessary account and purchase emails are separate.
• Website verification requests expire after 10 minutes and are removed by our scheduled cleanup. Codes are stored as keyed hashes, not readable codes. We keep the verified account and consent evidence after the temporary request is removed.
• License key issued and validated by Red Autumn Software AS
• Order, tax, refund, and payment-status records needed for fulfilment and accounting
• IP address at license activation (for fraud prevention)

3.2 Remote Play Session Data (only when you use Remote Play)

When you host or join a Remote Play session, the following data passes through or is stored briefly by our infrastructure (operated on Cloudflare):

• Connection metadata: IP address, connection timestamp, WebSocket session ID
• Room codes and host authentication secrets (encrypted at rest using SHA-256 hashing)
• Player display names (whatever the player types when joining)
• Heartbeat / keepalive signals (every 15–20 seconds, to detect dropped connections)
• Game state messages (token positions, dice rolls, narration progression — held transiently in active session memory; not persisted to disk)
• Character claims (which character a player picked — held in active room memory until the session resets)
• Uploaded assets: maps, token portraits, video clips, and other images you upload during a session are stored in our Cloudflare R2 bucket for up to 16 days (sized for weekly-play cadence), then automatically deleted
• Relay allowance ledger: license ID, room code, month, upload/download byte totals, object counts, room counts, blocked-transfer counts, and any operator-set quota override. This is used to show the Game Master usage, enforce the included allowance, prevent abuse, and support billing/fair-use disputes. It does not contain file contents.
• Aggregate service metrics (non-identifying, not persisted): to monitor the health of the Remote Play service, our infrastructure may compute real-time totals such as the number of currently active sessions and connected players. These are aggregate counts only — they contain no identity, room code, IP address, or session content, and are not stored.

3.3 Website Usage

• Standard web server logs (IP, user agent, request paths, timestamps) maintained by Cloudflare
• Essential cookies for navigation and security (see Section 8)
• Google Analytics 4 (Google Ireland Limited) on this website, only after you accept optional analytics cookies, to measure visitor numbers, which pages are read, and which referrer or advertising campaign brought someone here. Google Analytics 4 does not store your IP address — it is used to derive an approximate location and then discarded. You can change your choice at any time through the cookie preferences button or our Cookies & Analytics page.
• With Accept all, Google Analytics shares ad-click identifiers and related website activity with Google Ads to measure and improve our campaigns. Analytics only leaves advertising storage and data consent off. We do not enable personalised ads or remarketing, or use data brokers. The DungeonRig desktop application contains no analytics of this kind — website measurement stops at the website (the app's separate anonymous check-in is described in §3.7).

3.4 Former Launch-Interest List

The former launch-interest waiting list has closed. It no longer accepts signups or sends emails. Historical signup records remain stored in Cloudflare D1; contact contact@red-autumn.com to request removal. This is separate from your DungeonRig account and its email preferences.

3.5 AI Features (Bring-Your-Own-Key)

DungeonRig's AI features (token labeling, voice generation via ElevenLabs, narration assistance) operate via API keys you provide. Your API keys stay on your machine. Your AI requests go directly from your computer to the provider you chose (OpenAI, Anthropic, Google, Grok, ElevenLabs, etc.). We do not see, log, or proxy these requests. Refer to your chosen provider's privacy policy for how they handle your prompts.

3.6 What We Do Not Collect

• Your campaigns, worlds, characters, or in-game decisions during local play
• Your dice rolls, spell choices, or narrative content (other than the brief transit through the Remote Play relay during active sessions, which is not persisted)
• Audio or voice chat — DungeonRig does not handle voice chat (use Discord or similar)
• Files on your hard drive outside your active campaigns
• Behavioral profiling of which in-app features you use, or any of your in-game content (we collect only the anonymous usage metrics described in §3.7)

3.7 Anonymous Usage Analytics

To understand how many people use DungeonRig — especially the free demo — and to improve it, the app sends a small anonymous check-in to our server when it launches, and again while it runs (after a few minutes, then about every 15 minutes). This contains: a random install identifier (not linked to your name or email), the app version, your operating system and processor architecture, your licence tier (demo / registered / licensed), a launch counter, approximate active time, and your country (derived at our network edge — we do not store your IP address or any precise location). It does not contain your campaigns, content, names, dice rolls, or which features you use. It is anonymous and you can switch it off at any time in the app's Settings ("Send Anonymous Usage Data").

3.8 Crash Reports (only if you choose to send one)

If DungeonRig closes unexpectedly, the next time you start it we may ask whether you want to send a crash report. Nothing is sent unless you click "Send report". A crash report contains only technical information about the failure: the app version, your operating system, the error message and a technical stack trace, and a short trail of your recent in-app actions (page and feature names only, such as "opened the Map Forge" or "started a session"). It does not contain your campaigns, maps, notes, characters, the contents of any file, or your personal file paths (the OS account name and home-folder paths are removed before the report is shown to you). You may add an optional note and email if you'd like a reply. Reports go to our private operator dashboard and are used solely to diagnose and fix the problem.

3.9 Paid-Content Protection Receipts (only when we enable them)

Images in our paid packs and paid adventures carry a small tag tied to the licence they were bought with, and the text of a paid adventure is locked to that licence (see Section 9). If we enable this optional feature and DungeonRig refuses an image or an adventure because it carries a paid DungeonRig tag tied to a different licence, an app signed in to a DungeonRig account may send us a minimal receipt so we can investigate repeated reports of a possible leak of our paid content. The receipt contains only the opaque tag, a random event number and the kind of content (an image). It does not contain the image or its bytes, file names, paths or hashes, your text, your email address, your IP address or a device identifier. We store the receiving account only as a keyed pseudonym, which we do not use to identify or contact anyone. We match the tag to the licence it was issued for, whose record includes the purchase email address, so that a person on our team can review that licence. Receipts are kept for no more than 90 days. A count of receipts is a lead for human review, not proof that anyone shared content, and it never triggers an automatic restriction, suspension, key action or message to anyone.

3.10 Locked Paid Adventure Notice (support)

If you open a paid adventure that is locked to a different DungeonRig licence (for example, one you bought with an earlier licence key) while a paid licence is active on your computer, DungeonRig tells our support team so we can help you move it to your current licence. The app tells you when this notice has been sent. The notice contains your licence record as signed by our licensing server (including your licence and activation IDs and the hashed device reference used for licence checks), the adventure's opaque tag, how many locked adventures carry that tag, and the app version. It does not contain the adventure's text, its name, file names or paths, or any of your own content. As with licence checks, our server keeps your IP address only as a keyed hash. We compare the tag only with the other licences registered to your own account or email address. If it matches one of them, a person on our team may email you a code that moves the adventure, with your edits and campaign progress, to your current licence. If it does not match, a person on our team may look up the licence the tag was issued for, to help you or to review a possible leak (§3.9). A notice never triggers an automatic restriction, suspension, key action or message. We keep at most one notice per licence and tag each week, and delete notices with other licence event records after 13 months.

4. Why We Collect (Lawful Basis Under GDPR)

Each category of data is processed under one of these GDPR Article 6 lawful bases:

• Contract performance (Art. 6(1)(b)): license keys, purchase records, Remote Play infrastructure — you cannot use the relevant features without these
• Legitimate interest (Art. 6(1)(f)): fraud prevention, security logs, abuse detection, the anonymous usage analytics described in §3.7 (which you may switch off in Settings), protecting our paid content through the optional receipts described in §3.9, and the locked-adventure notices described in §3.10, which let us help paying customers keep access to adventures they bought (you may object to this processing; see Section 10)
• Legal obligation (Art. 6(1)(c)): responding to abuse reports and preserving and reporting confirmed CSAM to the authorities under U.S. federal law (18 U.S.C. § 2258A), the EU Digital Services Act, and equivalent obligations
• Consent (Art. 6(1)(a)): optional Google Analytics 4 website measurement and Google Ads campaign measurement (§3.3), crash reports (§3.8 — sent only when you click "Send report"), and any future feature that would link analytics to data identifying you personally (e.g. your email) — opt-in only

5. Sub-Processors and Third Parties

We use the following providers to operate DungeonRig:

• Stripe — payment processing, fraud prevention, refunds, disputes, and checkout. Red Autumn Software AS remains the seller and does not receive full card details.
• Cloudflare, Inc. (San Francisco, California, USA) — Web hosting, historical launch-interest records (D1), Remote Play relay (Workers and Durable Objects), asset storage (R2), CDN, and DDoS protection.
• Resend — Transactional email delivery. Receives your email address in order to send licence keys, purchase confirmations, account verification codes, and account emails according to your preferences.
• Google Fonts (Google Ireland Limited) — Serves the typeface used on this website. Loading any page on dungeonrig.com sends your IP address and browser details to Google as part of that request. This applies to the website only; the DungeonRig desktop application does not load anything from Google.
• Google Analytics 4 and Google Ads (Google Ireland Limited) — Optional website and advertising measurement used only after consent: visits, page views, referrers, campaign attribution, download-button clicks and confirmed purchases. Purchase events contain currency, value, tax, product and an opaque transaction reference, never email, licence keys, payment details or checkout access tokens. Applies to the website only; the desktop application does not use it. Google is certified under the EU–U.S. Data Privacy Framework. Change your choice through the cookie preferences button or our Cookies & Analytics page.
• National Center for Missing & Exploited Children (NCMEC) (Alexandria, Virginia, USA) — Recipient of legally required reports of confirmed CSAM detections under U.S. law.
• KRIPOS Tipsmottak (Oslo, Norway) — Norwegian National Criminal Investigation Service. Recipient of legally required reports of confirmed CSAM detections under Norwegian law.

We do not sell your personal data. We do not enable personalised ads or remarketing, or send your name, email, licence keys or payment details to Google Analytics or Google Ads. If you choose Accept all, Google Analytics shares advertising measurement with Google Ads, including ad-click identifiers and the website visits, download clicks or purchases linked to them. Analytics only keeps this advertising consent off. In-game purchase windows do not run website measurement.

6. International Data Transfers

Cloudflare operates a global edge network, meaning your data may be processed in any country where Cloudflare operates. Cloudflare is certified under the EU–U.S. Data Privacy Framework and offers Standard Contractual Clauses (SCCs) that meet GDPR Chapter V requirements for international transfers.

Stripe may process payment data internationally under its published privacy and transfer safeguards.

For specific information about where your data is processed, contact contact@red-autumn.com.

7. Data Retention

• License records: for the lifetime of your license / account
• Purchase and accounting records: retained as required by Norwegian and applicable tax law
• Remote Play uploaded assets (R2): up to 16 days (14 days for weekly-play cadence + 2-day grace); automatically deleted by daily cleanup once the session is no longer active
• Remote Play relay allowance ledger: up to 24 months for quota enforcement, fraud/abuse prevention, support, and accounting; contains byte totals and service metadata, not file contents
• Active session state (room data, character claims, in-memory game state): until the DM disconnects or the session ends
• Historical launch-interest records: the list is closed; contact us to request removal
• Connection / server logs: 30 days (Cloudflare default)
• CSAM-related records: 90 days from detection (legally required under U.S. law)
• Paid-content protection receipts: no more than 90 days (§3.9); deleted earlier when the receiving account is deleted
• Locked-adventure notices and other licence event records: up to 13 months (§3.10), then deleted automatically

8. Cookies

We use essential cookies needed for the website and Remote Play to function. If you accept optional analytics, we also use analytics cookies for audience measurement. Accept all also permits advertising measurement cookies; Analytics only does not. Personalised ads and remarketing stay disabled. Specifically:

• Session cookies for navigation continuity within the website
• Cloudflare security cookies (such as __cf_bm) for bot mitigation and DDoS protection
• Optional Google Analytics 4 cookies (_ga and _ga_*, retained 2 years) for the website audience measurement described in §3.3; these are not set unless you accept. Accept all also allows Google tag advertising measurement cookies (_gcl_*, typically 90 days)

The full table — every cookie, who sets it, what it is for, and how long it lasts — is on our Cookies & Analytics page, where you can accept or reject optional analytics at any time. You can also disable cookies in your browser settings, though some site or service functions may not work correctly.

9. Content Moderation

The optional Remote Play feature lets a Game Master upload images (maps and tokens) and share them with players they personally invite into a private, code-protected session. We do not proactively scan, pre-screen, or monitor the content of your private sessions. Instead, we operate a reactive notice-and-takedown model:

• Reporting: players and Game Masters can report content directly in the app using the "Report content" control during Remote Play, or by emailing contact@red-autumn.com (subject "Abuse Report") — see Section 6 of the Terms of Service.
• Removal: on a valid report we can remove the offending asset from our servers, after which it immediately stops being served to anyone, and we may suspend, revoke, or terminate the uploader's license.
• Ephemerality: uploaded assets exist only to deliver them to an active session, live in private rooms (never a public gallery), and are automatically deleted within ~16 days (Section 7).
• CSAM and serious illegal content: where we become aware of confirmed Child Sexual Abuse Material (CSAM), we preserve the material as required by law, block it from being served, report it to the National Center for Missing & Exploited Children (NCMEC) and KRIPOS (Norway) as described in Section 6.7 of the Terms of Service, and refer the matter to law enforcement, consistent with 18 U.S.C. § 2258A and equivalent obligations.

We may introduce automated scanning in the future. If we do, we will update this policy to describe it accurately before it takes effect.

Local content tag (not content scanning). Paid pack assets may contain a hidden identifier linked to the licence used to download them. If the content is redistributed, the identifier can help us identify the source licence. The licence record includes the purchase email address. The tag is checked on your own device to protect our own paid art, and the check also works offline. It is not a form of content scanning or fingerprinting of your material: it is never applied to your own maps, art, or homebrew images, and it does not inspect, read, or profile your content. A tag reaches us only in the optional receipt described in §3.9 and the locked-adventure notice described in §3.10; neither contains the image or the adventure's content. The text of a paid adventure is stored encrypted and opens only for the licence it was installed under; if you move to a different licence, we can send you a code that moves it (§3.10). Any decision to suspend or revoke a licence is made only after review and is not based solely on the presence of a tag.

10. Your Rights Under GDPR (EU/EEA/UK Users)

If you are in the European Union, European Economic Area, or United Kingdom, you have the right to:

• Access the personal data we hold about you (Art. 15)
• Correct inaccurate data (Art. 16)
• Request deletion of your data — "right to be forgotten" (Art. 17)
• Restrict processing (Art. 18)
• Data portability — machine-readable export (Art. 20)
• Object to processing based on legitimate interest (Art. 21)
• Lodge a complaint with your supervisory authority (in Norway: Datatilsynet, datatilsynet.no)

To exercise any of these rights, contact contact@red-autumn.com. We will respond within 30 days. There is no fee, and we will not retaliate or limit your service for making a request.

11. Your Rights Under California Law (CCPA / CPRA)

If you are a California resident, you have the right to:

• Know what personal information we collect, use, and disclose
• Delete personal information we have collected
• Correct inaccurate personal information
• Limit use of sensitive personal information
• Opt out of the sale of personal information (not applicable — we do not sell personal data)
• Opt out of cross-context behavioral advertising (we do not enable personalised ads or remarketing); you can also withdraw optional advertising measurement consent on the Cookies & Analytics page
• Non-discrimination for exercising any of these rights

To exercise these rights, contact contact@red-autumn.com. We will verify your request and respond within 45 days.

12. Children's Privacy

DungeonRig is intended for users aged 13+ (United States) or 16+ (European Union), or younger with verifiable parental or guardian consent, in line with COPPA and GDPR Article 8. We do not knowingly collect personal data from children below these ages without consent. If you believe a child has provided personal data without parental consent, contact contact@red-autumn.com and we will delete it.

13. Security

We protect your data through:

• Encryption in transit — all traffic uses TLS (HTTPS / WSS)
• Encryption at rest — host authentication secrets are SHA-256 hashed; payment credentials are handled by Stripe
• Cloudflare DDoS protection and rate limiting on the Remote Play relay
• Restricted access to production systems
• Regular security audits

No system is perfectly secure. If we discover a data breach affecting your personal data, we will notify you and the relevant supervisory authority within 72 hours of becoming aware, as required by GDPR Article 33.

14. Changes to This Policy

We may update this Privacy Policy as the product evolves or as the law changes. The "Last updated" date at the top will reflect any change. For material changes (new categories of data collection, new sub-processors, changes to your rights, etc.), we will provide reasonable notice — typically by email or in-app notice 30 days before the change takes effect.

15. Contact

For all matters — general questions, privacy / GDPR / CCPA requests, abuse reports, and DMCA notices — contact: contact@red-autumn.com. Please indicate the topic in your subject line so we can route appropriately.