The short version
We collect the minimum we need to run Guildheim. We don't sell your data. You can request export or deletion of your account at any time.
What we collect
- Account info — your username, email address, hashed password, and (if enabled) two-factor authentication secret.
- Content you create — campaigns, maps, characters, encounter packs, NPCs, notes, and marketplace listings.
- Session data — when you start sessions, who joins them, dice rolls, and chat messages. We store this so the table can resume across multiple sittings.
- Technical data — IP address, browser, and basic usage analytics so we can keep the platform working.
How we use it
- To provide the Service — sync the table, persist your campaigns, deliver email notifications.
- To improve the Service — understand what features get used, what breaks, what's missing.
- To keep you safe — detect abuse, investigate violations of the Terms of Service, and respond to security incidents.
What we don't do
- We don't sell your personal information to third parties.
- We don't train AI models on your private campaign content.
- We don't read your private session chat for any purpose other than abuse investigation.
Third-party services
Some Guildheim features rely on third-party providers:
- Daily.co for the in-session video and voice infrastructure.
- Pusher for real-time map and session synchronization.
- OpenAI powers the GM AI Toolkit. When a Game Master uses a generator, the prompt they enter is sent to OpenAI to produce the result.
- Anthropic powers the AI support assistant. When you message the support assistant, your message is sent to Anthropic to generate a reply.
- Google Analytics for anonymous usage statistics on the marketing site.
Each of these providers has its own privacy practices. We only share the data necessary for the feature to work.
Your rights
- Access & export — request a copy of your data from your account settings.
- Correction — update your account details directly in the app.
- Deletion — close your account from settings, or email us to request full deletion.
Data retention
We keep account and content data while your account is active. After account deletion, we purge personal data within 30 days, except where we're legally required to retain it (for example, security or abuse logs related to an active investigation).
Children
Guildheim is not directed at children under 13. We don't knowingly collect data from children under 13. If you believe we have, please contact us and we'll delete it.
Changes
If we make material changes to this policy, we'll notify users by email and update the “last updated” date above.
Contact
Privacy questions or data requests: hello@guildheim.com.
