The short version. This website runs no analytics, no advertising and no tracking cookies. If you never type your email into a form here, we never learn anything about you beyond what any web server unavoidably sees.
If you do give us your email, it goes to our mailing-list provider and is used to email you about Quill & Compass. Nothing else. Ask and it is deleted, same week.
If you make an account in the app itself, your characters and campaigns live in our database so they are there when you come back. They are yours; you can have a copy, or have the lot erased.
Who we are
Quill & Compass is an independent software project run by one developer in the United Kingdom. It is not a company with a press office; when you write to us, a person reads it.
For anything in this policy — a question, a correction, a copy of your data, or a deletion — write to:
For UK data-protection purposes, Quill & Compass is the controller of the personal data described below.
What this website collects
Two things, and only if you volunteer them.
| What | When | Why, and for how long |
|---|---|---|
| Your email address | Only when you submit one of the signup forms | To email you about Quill & Compass — launch, founder access, and the occasional note about what changed. Kept until you unsubscribe or ask us to delete it. |
| Which page you signed up from | At the same moment | So we know which pages are worth writing. Stored alongside the address; deleted with it. |
The lawful basis is your consent. You give it by submitting the form; you withdraw it by clicking unsubscribe in any email, or by writing to the address above. Withdrawing is free, immediate, and does not require a reason.
We do not buy lists, we do not sell or rent addresses, and we do not pass them to anyone for their own marketing.
What this website does not collect
- No analytics. There is no Google Analytics, no Plausible, no Fathom, no pixel, and no first-party analytics of our own. Nobody here can tell you how many people read this page.
- No advertising and no tracking cookies. The site sets no cookies at all.
- No profiling and no automated decision-making.
The site does use your browser's own session storage on the homepage to remember which scene you were looking at and which class you picked, so a refresh does not throw the page away. That never leaves your device, it is not a cookie, it is not personal data to us, and closing the tab clears it.
Who else sees your data
These are the only third parties involved, and each one only gets what it needs to do its job.
| Who | What they receive | Why |
|---|---|---|
| Cloudflare | Your IP address and browser details, as part of serving any web page | They host this website and protect it from attacks. This is unavoidable for any website: a server cannot send you a page without knowing where to send it. |
| MailerLite | Your email address, and the page you signed up from | They store the mailing list and send the emails. Their own privacy policy governs what they do with it, and their unsubscribe link works from any email we send. |
| jsDelivr | Your IP address, on two pages only | An open-source code CDN. A Thousand Worlds and the tools page load a 3D graphics library from it. No other page on this site contacts it, and it sets no cookies. |
| Supabase | Only what you put into the app — see the next section | They provide the database and the sign-in system behind the Quill & Compass app. They are not involved in this website at all. |
Every font on this site is served from our own domain. We deliberately do not use Google Fonts, precisely because it would hand your IP address to a third party for the sake of a typeface.
Some of these providers, or their own suppliers, operate outside the United Kingdom. Where your data is transferred abroad it is protected by the standard contractual safeguards those providers publish — the UK International Data Transfer Addendum or the EU Standard Contractual Clauses.
What the app stores, if you make an account
The website and the app are separate things. You can read every page here without an account. If you do sign in to Quill & Compass, this is what is held in our database, so that it is still there next session:
- Your account: the email address you signed up with, and an encrypted form of your password. We never see your password.
- Your characters: names, sheets, inventories, spells, notes — everything you write on a character.
- Your campaigns: the campaign, who is in it, invite codes, and the settings for it.
- Your sessions: live session state — maps, tokens, initiative, combat — so a dropped connection does not lose the table's evening.
- Your journals and world notes: whatever you write in them.
The lawful basis here is performance of a contract — you asked us to run a campaign tracker, and it cannot do that without keeping the campaign.
Other players in a campaign you join can see the things a campaign is meant to share: your character's name, class, race, level, hit points, armour class and avatar. They cannot see your email address, your private journal entries, or any campaign you are not in.
We do not read your campaigns. Nothing you write is used to train any AI model, ours or anyone else's.
How long we keep it
- Mailing-list address: until you unsubscribe or ask for deletion.
- Account and campaign data: for as long as your account exists.
- Server logs: Cloudflare keeps these briefly for security and abuse prevention, on their own schedule, not ours.
The app does not yet have a "delete my account" button. Until it does, email us and we will delete the account and everything attached to it — within 30 days, and usually the same week. We will tell you when it is done.
Your rights
Under UK data-protection law you can ask us to:
- tell you what we hold about you, and give you a copy;
- correct anything that is wrong;
- delete it;
- hand it over in a portable format, or send it to someone else;
- stop or limit what we do with it, including objecting to marketing.
Ask at hello@thequillandcompass.com. It is free, and we will answer within one month. We will not ask you why.
If you think we have got this wrong, you can complain to the UK's Information Commissioner's Office at ico.org.uk. We would rather you told us first, but it is your right either way.
Children
Quill & Compass is not aimed at children, and accounts are for people aged 13 and over. If a younger child has made an account, write to us and we will remove it.
Security, honestly stated
Data is encrypted in transit, passwords are hashed by our sign-in provider and never stored by us in readable form, and database access is restricted per account so one player cannot read another's private data. No system is perfect. If we ever discover a breach that puts you at risk, we will tell you and the Information Commissioner's Office within the time the law allows.
Changes to this policy
If this changes, the date at the top changes with it. If a change actually affects you — a new provider, a new category of data — we will say so in an email rather than quietly editing the page.