1. Who is responsible for your data

Adventure Satchel is a non-commercial hobby project run by Stavros Kanellopoulos, a private individual based in Greece. It is not operated by a company. Stavros Kanellopoulos is the “data controller” for the personal data described here.

Contact for anything about your data or this policy: stakatwork@gmail.com

2. What we collect

• Account data: your email address and password. Passwords are stored only in hashed form by our authentication provider; we never see them.
• Content you create: prompts you write, images generated for you (tokens and maps), images you upload, creature statblocks you save, and custom spells with their images.
• Plan and usage: your plan, and a record of each generation (type, credits used, AI model, number of AI tokens processed, date and time). This is how monthly credits are counted.
• Technical data: your IP address and basic request information, which our hosting and database providers process when you use the site, including in security logs.

We don’t use advertising, analytics or tracking cookies, and we don’t sell or share your data for marketing.

3. Why we use it, and on what legal basis

• To provide the service you signed up for (GDPR Art. 6(1)(b), performance of a contract): your account, generating and storing your images, saving your creatures and spells, and tracking your credits.
• To keep the service secure and prevent abuse (Art. 6(1)(f), legitimate interests): usage limits, security logs and investigating misuse.
• To send account emails (Art. 6(1)(b)): sign-up confirmation and password-reset emails. We don’t send newsletters.

4. Who receives your data

We use these service providers (“processors”) to run Adventure Satchel. They only process data to provide their service to us:

• Supabase, Inc.: database, user accounts, file storage, and account emails. Your account data, content and files are stored in the EU (Ireland).
• Google LLC (Gemini API): the text of your prompts is sent to Google to generate images. Google may keep prompts for a limited time to detect abuse, under its own terms.
• Vercel Inc.: hosts the website and processes requests, including your IP address.

The token page’s creature library (loaded when you open the page, which shows a random creature by default) comes directly from the public D&D 5e API (dnd5eapi.co): your browser loads its data and images from there, so that service receives your IP address.

Some of these providers are based in the United States, so some data (such as your prompts sent to Google, and request data handled by our hosting provider) may be processed outside the European Economic Area. These transfers rely on the EU–US Data Privacy Framework or the European Commission’s Standard Contractual Clauses, as provided in each provider’s data processing terms.

5. Image links

Images you generate or upload, and your custom spell images, are stored at long, random web addresses. Anyone who has one of those exact links can open the image, but the links aren’t listed or searchable anywhere. Don’t upload images you need to keep strictly private.

6. How long we keep it

We keep your data for as long as you have an account. When you delete your account, your account, content, files and usage records are deleted immediately. Copies may remain in our providers’ backups and logs for a limited period before being overwritten.

7. Data stored in your browser

We don’t use cookies. Adventure Satchel keeps a few things in your browser’s local storage:

• Your sign-in session, so you stay signed in.
• Your recent images, if you use the token tools without an account. They’re kept only in your browser.
• Display preferences: the spell card artwork and colors you chose, and the last creature you viewed, so they’re there when you come back.

None of this is used to track you or shared with anyone. It’s only there to provide the features you use, so no consent banner is needed. You can remove it at any time by clearing this site’s data in your browser settings; signing out removes your session.

8. Your rights

Under the GDPR you have the right to:

• access the personal data we hold about you and get a copy of it (including in a portable format);
• have inaccurate data corrected;
• have your data deleted;
• restrict or object to certain processing;
• complain to a data protection authority. In Greece this is the Hellenic Data Protection Authority (dpa.gr), or you can contact the authority in your own EU country.

You can change your password and delete your account yourself on your Profile page. For anything else, email stakatwork@gmail.com. We’ll reply within one month.

9. Age

Adventure Satchel is only for adults. You must be at least 18 years old to create an account or use it, as also required by the terms of the AI provider we use. We don’t knowingly collect data from anyone under 18; if you believe a minor has an account, email us and we’ll delete it.

10. Changes to this policy

If we change this policy, we’ll update the date at the top. For significant changes, we’ll also let account holders know by email or on the site.