Cookie Policy

There is one honest exception and it is not ours. When Volvelle temporarily switches on the Cloudflare security check that protects account email, the check runs inside Cloudflare's own frame and may store what it needs there, under Cloudflare's policy rather than Volvelle's. It stays off in ordinary operation. If an outside sign-in provider is ever added, its own sign-in screens would work the same way, under their own policy.

Everything Volvelle needs to remember is kept in your own browser's storage on your own device, not in a cookie sent back and forth with a server. It comes in three kinds.

Staying signed in. Supabase Auth keeps your access and refresh tokens in browser storage after you sign in, and they are used only to prove who you are to Volvelle's Supabase services. Signing out clears them. Closing the browser without signing out leaves them until they expire. Sessions end after 90 days without activity or 180 days in total, whichever happens first, and Supabase checks those limits when the session refreshes. If you block this storage, the signed-in parts of Volvelle cannot work.

Your settings. Theme, accessibility choices, the sheet tab you had open last, and a cache of open-licensed game reference data so pages load quickly and still work offline.

Your work and your short journeys. Maps you build without an account and their private notes, War Table counters, roll macros, sheet preferences, your optional analytics choice, and a few short-lived handoffs that carry an invitation or a return address across the new tab a confirmation email opens.

If more than one person signs in on the same browser, each account's browser-only data is kept under its own key, so one person's maps, notes, counters, macros and preferences are never shown to the next. Records left by older versions of Volvelle that were not separated this way stay quarantined: they are not opened and not folded into whoever is signed in now, and the data panel gives you a delete-only control for them. From the data controls in your profile you can export or clear the signed-in account's browser-only records at any time, and your browser can always clear all site data for itself. Clearing removes these records and any browser-only content along with them.

Volvelle does not set or allow advertising cookies, social-media tracking pixels, behavioral profiles, or cross-site analytics cookies.

If you affirmatively allow optional analytics, one Volvelle choice enables cookieless Plausible usage counts and Vercel Speed Insights performance measurements. Neither provider loads while the choice is missing, undecided, or declined, and neither sets a cookie. You can withdraw the choice in your profile, which stops new events immediately. Do Not Track and Global Privacy Control always prevent optional telemetry. Core features work after a decline.

Optional events use general route templates instead of browser addresses. Query strings, invitation and campaign codes, and resource identifiers are removed before sending.

Cloudflare Turnstile is separate from optional analytics. It remains unloaded in ordinary operation and may be enabled only when measured automated traffic threatens signup or password-recovery availability. It applies to signup, sign-in, code resend, passwordless, and password-recovery forms. When active, it can use a short-lived challenge token and provider-side network, browser, and device signals without creating Volvelle advertising or product-analytics cookies. Those protected forms fail closed if the security check cannot complete.

Volvelle does not run advertising trackers, cross-site cookies, or data-broker profiling. This is part of the Creator Pledge.

Nothing above is a summary of something hidden. Here is every record Volvelle keeps in your browser, all of it in localStorage or sessionStorage and none of it in cookies.

• Sign-in session: the Supabase Auth access and refresh tokens described above.
• Reference cache: open-licensed game reference data cached locally for speed and offline use.
• Appearance and interface settings: choices such as theme, accessibility settings, and the last open sheet tab.
• Browser-only maps: map state and private notes under separate anonymous and per-account keys (volvelle:map:v2:anonymous:* and volvelle:map:v2:account:<account>:*), plus volvelle:player-id so an anonymous map can tell one browser from another. Older unscoped volvelle:map:v1:* records stay quarantined and are not opened or exported to the signed-in account; the data panel offers a separate clear control.
• War Table counters: GM-authored counter labels and values under per-account, per-campaign keys, so one account's counters are not shown to the next account on a shared browser. The data panel exports or clears only the signed-in account's records; older unscoped records stay quarantined with a delete-only control.
• Roll-macro cache: a separate key for each signed-in account, plus a separate anonymous cache, so one account's macros are not shown to the next. Signed-in labels and formulas also sync to your account profile for use across devices.
• Character-sheet preferences: last-open tab and category choices under per-account, per-character keys; the data panel exports or clears only the signed-in account's records, and older unscoped records stay quarantined with a delete-only control.
• Analytics choice: volvelle-analytics-consent records allow, decline, or undecided. Missing and undecided both mean no optional analytics. The compatibility key volvelle-analytics-optout is retained only so an earlier refusal remains a refusal; it never grants permission. plausible_ignore makes an already loaded Plausible client honor a refusal.
• Signup return journey: volvelle:auth:pending uses the current tab's sessionStorage for the email being confirmed, a named journey, an allowlisted app destination, and timing fields. It contains no password or confirmation code and expires after success or 15 minutes.
• Friend invitation handoff: volvelle:auth:invite-token uses this site's localStorage so a confirmation email may open a new tab without losing the invitation. It is a separate short-lived handoff, valid for at most 30 minutes, and removed after use or the next expiry check.
• Campaign join handoff: volvelle:auth:campaign-join-code similarly carries only a validated eight-character campaign join code. The login destination remains /campaigns; arbitrary query strings are not preserved. It expires after at most 30 minutes and is removed after use or the next expiry check.
• Map-save handoff: volvelle:auth:map-save-return keeps the private room return on this site for at most 30 minutes when you ask to save a browser-only map. The confirmation email receives only the ordinary /map screen, never the map room key. The handoff is removed after successful authentication or the next expiry check.
• Diagnostic preview: volvelle:operational-diagnostics:v1 keeps at most 12 recent critical outcomes in the current tab for two hours or until the tab closes. It contains no email, account ID, IP address, complete URL, game content, or typed text. You can preview, download, and clear it. Opening the panel sends nothing. Attaching diagnostics to a contact message is a separate, off-by-default choice. A resolvable record may send its live support code; local-only fields stay in this tab and are not emailed.

The three handoffs are never included in analytics.