Privacy Policy

When you create an account, we store:

• Account: email address and a salted password hash (handled by Supabase Auth).
• Profile: display name and any optional fields you fill in on your profile page.
• Game content: characters, maps, battles, friend lists, and other things you create or save.
• Operational logs: error reports and server logs needed to keep the app healthy. These are short-lived.

We don't run third-party advertising trackers. We don't build a behavioral profile of you. We don't sell or rent your data to anyone.

Volvelle is built on Supabase. Your account data, game content, and authentication state are stored in a Supabase Postgres database with row-level security policies that scope every read and write to the account that owns the row.

The hosted version of Volvelle runs on Vercel. Static assets are served from Vercel's CDN. We do not run a separate application server.

Some data lives in your browser only. For example, the SRD reference catalog or your maps are cached in localStorage to keep the app fast. Clearing your browser storage clears that cache.

You can, at any time:

• Access the data we hold about you. Most of it is visible directly in the app.
• Export your characters, maps, and account data in a portable format.
• Correct anything inaccurate by editing your profile or content.
• Delete your account, which removes your data from our database.

To exercise any of these rights - including export and deletion - see the controls on your profile page, or contact us using the address below if you need help.

The small set of services Volvelle relies on, and what they do:

• Supabase - authentication, database, realtime sync.
• Vercel - hosting and CDN for the web app.
• Plausible - privacy-friendly, cookieless analytics.
• Resend - delivers our account and transactional email (sign-in links, password resets, our replies to you). Your email address and the message contents pass through Resend and can sit briefly in its delivery logs.
• ImprovMX - forwards email you send to our addresses (like support@volvelle.net) on to us. Those messages pass through ImprovMX and can sit briefly in its logs.

Each of those operates under its own privacy policy. We don't share your data with them beyond what's necessary to run Volvelle.

If we ever add new third parties: analytics, payment processing, anything, we'll list them here, with a changelog entry, before they start collecting anything.

If this policy changes in a way that affects you, we'll update the Last updated date above and post an entry on the changelog. Material changes (new data collected, new third parties, etc.) will be flagged prominently.

Volvelle is operated by Marta Strzelec, the data controller for the personal data described here.

Questions about privacy, data, or this policy? Email us at support@volvelle.net and we'll get back to you.