Privacy Policy
Last updated: 14 August 2026
OpenFray is a free, open-source combat console for tabletop games. This policy explains what data we collect, why, who processes it, and the rights you have. We keep this short on purpose: OpenFray is built to hold as little of your data as possible.
1. Who we are
“OpenFray”, “we”, and “us” refer to the operator of the OpenFray service at openfray.app (the “Service”). For any privacy question, contact us at info@openfray.app.
2. Using OpenFray without an account
You can use OpenFray fully anonymously. In this mode your encounter is stored only in your own browser (using sessionStorage), along with your theme choice and app settings in localStorage. Nothing about your gameplay is sent to or stored on our servers, and we set no advertising or analytics cookies. Clearing your browser storage removes this data.
The one exception is the player view, which you turn on yourself. While you are sharing, the part of the fight your players see — the turn order and the game log — passes through our hosting provider’s realtime service so it can reach their devices. It is relayed, not stored: nothing is written to a database, and there is nothing to read back once you stop sharing or close the tab. Anyone holding the link can watch while you share, so give it to your table rather than posting it publicly.
3. Data we collect when you sign in
Sign-in is optional and handled entirely through an identity provider (Google or Discord). We do not offer or store passwords.
| Category | What it is | Why |
|---|---|---|
| Account identity | Your email address and a unique user identifier supplied by Google or Discord when you choose to sign in. | To create your account and let you sign back in. |
| Your content | The encounters, custom creatures, custom spells, campaigns, characters and notes you create. | To save your work and sync it across your devices. |
| Technical data | Standard server and request logs (e.g. IP address, timestamps, error data) generated by our hosting and database providers. | To run the Service securely and diagnose problems. |
We use privacy-friendly, cookieless analytics (Fathom Analytics) to see aggregate traffic — it stores no cookies, collects no personal data, and never tracks you across sites. We run no advertising, and we never sell your data.
4. Cookies and local storage
OpenFray sets no cookies of its own — no advertising, analytics, or cross-site tracking cookies. The only data kept on your device is strictly necessary for the features you use, stored in your browser:
- Theme preference — light or dark, in
localStorage. - App settings — which content libraries you have turned on, how the compendium is sorted, and what your player view reveals, in
localStorage. - Player view link — without an account, the name of your share link, in
localStorage, so the link stays the same each session. - Anonymous session state — your in-progress encounter, in
sessionStorage. - Authentication token — when signed in, your session is kept in
localStorageby our authentication provider so you stay logged in; cleared when you sign out.
Our analytics (Fathom Analytics) and hosting (Cloudflare) providers produce aggregate, cookieless traffic statistics; Cloudflare may also set a strictly-necessary security cookie to protect the Service from abuse. None of this stores a tracking identifier or follows you across sites — so no cookie-consent banner is needed.
5. Who processes your data
We rely on a small set of service providers (“processors”) to run OpenFray:
| Provider | Role |
|---|---|
| Supabase | Authentication and database hosting (your account and saved content). |
| Cloudflare | Website hosting, content delivery, DNS, email routing, and aggregate (cookieless) traffic analytics. |
| Fathom Analytics | Privacy-friendly, cookieless website analytics — aggregate traffic only, no personal data or cross-site tracking. |
| Google / Discord | Identity providers — only involved when you choose to sign in with them. |
These providers may process data on servers outside your country (including the United States) under appropriate safeguards. Each has its own privacy policy.
6. Legal bases (EEA/UK users)
Where the GDPR applies, we process data to perform our contract with you (providing your account and saving your content), on the basis of our legitimate interests (operating and securing the Service), and — for optional sign-in — on your consent.
7. Retention and deletion
We keep your account and content until you delete them. You can permanently delete your account and all associated data at any time from within the app (Account → Delete account); this erases your encounters, custom creatures, custom spells, campaigns and characters, and your sign-in record. Anonymous data lives only in your browser, and the only thing that ever leaves it is the player view you choose to share, which is relayed to your players and never stored.
8. Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can delete everything yourself in-app; for any other request, email info@openfray.app. You may also lodge a complaint with your local data-protection authority.
9. Children
OpenFray is not directed to children under 13 (or under the minimum digital-consent age in your country, where higher). We do not knowingly collect data from children below that age.
10. Security
Data is transmitted over HTTPS, accounts are protected by your identity provider, and each user’s stored content is isolated at the database level so it is accessible only to that account. No system is perfectly secure, so we cannot guarantee absolute security.
11. Changes
We may update this policy as the Service evolves. Material changes will be reflected by the “Last updated” date above; significant changes may be highlighted in the app.
12. Contact
Questions or requests: info@openfray.app.