Cookie Policy

Cookie banners exist so sites can collect consent for tracking: advertising cookies, cross-site identifiers, analytics that follow you around the web. Volvelle does none of that, so there is nothing to consent to and no reason to interrupt you.

In fact, Volvelle sets no cookies of its own. The little it does keep lives in your browser's local storage, it is first-party (only this site can read it), and it exists to make the app work for you: keeping you signed in, remembering your settings, and holding onto your maps. That kind of strictly-necessary, non-tracking storage does not require a consent banner under GDPR or the ePrivacy rules.

Almost everything below lives in your browser's `localStorage`, not in cookies. It stays on your device, and clearing your browser storage wipes it.

• Your sign-in session. When you log in, Supabase Auth keeps your session in local storage so the app knows it is still you between page loads, and renews it so you are not asked to sign in every few minutes. Signing out clears it. Without this you cannot use your account.
• Your preferences. Light or dark theme, accessibility settings (larger text, reduced motion, readable font), and small UI choices like which character-sheet tab you had open. Convenience only, never shared.
• Your maps and game state. The login-free battle maps you build, your turn order, your private GM notes, and your per-map view role are saved locally so your work survives a reload. Private notes stay on your device and are never broadcast.
• The rules catalog cache. The open-licensed D&D content (spells, monsters, items, conditions) is cached locally so the app loads fast and works offline.

Volvelle does not set first-party cookies, and it does not allow third-party tracking cookies: no advertising networks, no social-media pixels, no cross-site identifiers, no "analytics" cookies that follow you across the web.

If you sign in through an external provider, that provider may set its own cookies as part of its sign-in flow. Those are governed by the provider's policy, not ours.

We measure aggregate, anonymous usage with Plausible, a privacy-friendly analytics tool that sets no cookies and collects no personal data. It is served from our own domain and counts page views in aggregate; it cannot follow you to other sites. We also use Vercel's performance monitoring (Web Vitals), which is likewise cookieless.

You stay in control: Volvelle honors your browser's Do Not Track setting, and you can opt out of analytics entirely in your account settings. Your opt-out is remembered locally, so the tracker is never even loaded.

Most of what is described here never leaves your device. The exception is your sign-in session, which authenticates you to our database so your characters and campaigns stay yours. For the full picture of what we collect, why, and who helps us process it, see the Privacy Policy.

It is worth saying plainly: Volvelle does not run advertising trackers, behavioral profiling, cross-site cookies, or any of the surveillance-capitalism machinery you would find on a typical web app. This is part of the Creator Pledge: not a marketing line, a commitment.

Every major browser lets you view and clear cookies and site data; search "clear site data" for yours. Clearing Volvelle's storage will sign you out and wipe your local caches and any login-free maps kept only on that device. The app rebuilds what it needs on the next load.