Privacy Policy
Last updated: 24 September 2026
OpenFray is a free, open-source combat console for tabletop games. This policy explains what data we collect, why, who processes it, and the rights you have. We keep this short on purpose: OpenFray is built to hold as little of your data as possible.
1. Who we are
“OpenFray”, “we”, and “us” refer to the operator of the OpenFray service at openfray.app (the “Service”). For any privacy question, contact us at info@openfray.app.
2. Using OpenFray without an account
You can use OpenFray fully anonymously. In this mode your encounter is stored only in your own browser (using sessionStorage), along with your theme choice and app settings in localStorage. Nothing about your gameplay is sent to or stored on our servers, and we set no advertising or analytics cookies. Clearing your browser storage removes this data.
The one exception is the player view, which you turn on yourself. While you are sharing, the part of the fight your players see — the turn order and the game log — passes through our hosting provider’s realtime service so it can reach their devices. It is relayed, not stored: nothing is written to a database, and there is nothing to read back once you stop sharing or close the tab. Anyone holding the link can watch while you share, so give it to your table rather than posting it publicly.
Publishing needs an account, so nothing is published from this mode.
3. Data we collect when you sign in
Sign-in is optional and handled entirely through an identity provider (Google or Discord). We do not offer or store passwords.
| Category | What it is | Why |
|---|---|---|
| Account identity | Your email address and a unique user identifier supplied by Google or Discord when you choose to sign in. | To create your account and let you sign back in. |
| Your content | The encounters, custom creatures, custom spells, campaigns, characters and notes you create. | To save your work and sync it across your devices. |
| What you publish | The cast or stat block, any note, any byline you type, the license you state, and your account as its owner. | To open the link for whoever you give it to, to list your links back to you, and to let you take one down. |
| What your account may do | The roles it holds, and any permission withdrawn from it together with the reason and who withdrew it. | To decide what the Service lets the account do, and to keep a record of a decision that restricts somebody. |
| Technical data | Standard server and request logs (e.g. IP address, timestamps, error data) generated by our hosting and database providers. | To run the Service securely and diagnose problems. |
If we remove a page you published, we write to the address on your account to tell you, and we keep the code of the removed page and the date so the link can say it is gone. That record holds no part of what you published and nothing identifying you. Your address is used for that one message and is not kept for it afterwards.
We use privacy-friendly, cookieless analytics (Fathom Analytics) to see aggregate traffic — it stores no cookies, collects no personal data, and never tracks you across sites. We run no advertising, and we never sell your data.
A shared link and a player view are counted as /s/ and /p/, without the code that follows. The code is the whole of an unlisted link's privacy, and it is not something to hand to an analytics provider.
4. Cookies and local storage
OpenFray sets no cookies of its own — no advertising, analytics, or cross-site tracking cookies. The only data kept on your device is strictly necessary for the features you use, stored in your browser:
- Theme preference — light or dark, in
localStorage. - App settings — which content libraries you have turned on, how the compendium is sorted, and what your player view reveals, in
localStorage. - Player view link — without an account, the name of your share link, in
localStorage, so the link stays the same each session. - Anonymous session state — your in-progress encounter, in
sessionStorage. - Authentication token — when signed in, your session is kept in
localStorageby our authentication provider so you stay logged in; cleared when you sign out.
Our analytics (Fathom Analytics) and hosting (Cloudflare) providers produce aggregate, cookieless traffic statistics; Cloudflare may also set a strictly-necessary security cookie to protect the Service from abuse. None of this stores a tracking identifier or follows you across sites — so no cookie-consent banner is needed.
5. Who processes your data
We rely on a small set of service providers (“processors”) to run OpenFray:
| Provider | Role |
|---|---|
| Supabase | Authentication and database hosting (your account and saved content). |
| Cloudflare | Website hosting, content delivery, DNS, email routing, and aggregate (cookieless) traffic analytics. |
| Resend | Sending the few emails the service sends: an answer to a report you filed, and a notice to you if a page you published is removed. |
| Fathom Analytics | Privacy-friendly, cookieless website analytics — aggregate traffic only, no personal data or cross-site tracking. |
| Google / Discord | Identity providers — only involved when you choose to sign in with them. |
These providers may process data on servers outside your country (including the United States) under appropriate safeguards. Each has its own privacy policy.
6. Legal bases (EEA/UK users)
Where the GDPR applies, we process the data necessary to create and authenticate your account and save your content to perform our contract with you. Signing in is optional; when you choose it, this processing is necessary to provide the account features you request. We also process technical data on the basis of our legitimate interests in operating and securing the Service.
Agreeing to the Terms of Service is agreement to a contract, not consent to all personal-data processing. This Privacy Policy explains that processing; you do not need to accept it as a separate agreement.
7. Retention and deletion
We keep your account and content until you delete them. You can permanently delete your account and all associated data at any time from within the app (Account → Delete account); this erases your encounters, custom creatures, custom spells, campaigns, characters, every page you published, and your sign-in record. Anonymous data lives only in your browser, and the only thing that ever leaves it is the player view you choose to share, which is relayed to your players and never stored.
An encounter or creature you published stays up until you unpublish it or we remove it, and nothing expires on its own. Deleting your account removes everything you published with it.
When you report a published page we keep the reason, whatever you wrote, and the address you gave us if you chose to give one, so we can look into it and answer you; nobody has to say who they are to report something. When a page is removed we keep its code and the date, which holds nothing of what was published and nothing about who published it.
8. Your rights
Depending on where you live, you may have the right to access, correct, export, or delete your personal data, and to object to or restrict certain processing. You can delete everything yourself in-app; for any other request, email info@openfray.app. You may also lodge a complaint with your local data-protection authority.
9. Children
OpenFray is not directed to children under 13 (or under the minimum digital-consent age in your country, where higher). We do not knowingly collect data from children below that age.
10. Security
Data is transmitted over HTTPS, accounts are protected by your identity provider, and each user’s stored content is isolated at the database level so it is accessible only to that account. No system is perfectly secure, so we cannot guarantee absolute security.
11. Changes
We may update this policy as the Service evolves. Material changes will be reflected by the “Last updated” date above; significant changes may be highlighted in the app.
12. Contact
Questions or requests: info@openfray.app.
Reports about a published page: reports@openfray.app.