Privacy Policy

Version 2026-10-15.1 · Aetherboard, at aetherboard.app

1. Who we are

Aetherboard is operated by Aetherboard LLC, an Arizona limited liability company. We are the party responsible for the personal information described here. Contact: [email protected].

2. What we collect

3. Traffic, and what we can see about a visit

This section used to say “no analytics”. That was too simple to be honest, so here is the whole of it.

The website sits behind Cloudflare, which is the service that puts it on the internet and keeps it standing up. Every request for a page therefore passes through Cloudflare's machines before it reaches ours, and Cloudflare records that it happened. From those records we can see, and do look at:

• How many people visited, and which pages. Counts per address, per day.
• Roughly where in the world: the country, worked out from the network address. Not a town, not a street, not a position.
• Which browser and which kind of device, in broad families: Chrome on Windows, Safari on an iPhone.
• Which site sent somebody here, when a link was followed from one.
• Whether a request failed, and how fast it was served.

The pages of aetherboard.app are served by Vercel. Vercel keeps a copy of the pages that are the same for everybody (the front page, the guides, the legal pages, the shop's catalogue) and sends them from the machine nearest to you. Anything that is yours, such as signing in, your profile, your cart or a purchase, Vercel passes straight on to our own server and does not keep a copy. Vercel sees your network address and what you asked for, as Cloudflare does, and keeps its own records of that under its own privacy policy. The game itself, at play.aetherboard.app, does not go through Vercel.

What that is for: knowing whether the download page works, whether a change broke something, and whether anybody is reading what we write. It is counts and totals. It is not joined to your account, it is not used to build a profile of you, and it is never sold or handed to an advertiser.

Your network address (IP) is part of how the internet works: a server cannot send a page back without one. Cloudflare holds them for a short period as part of running and protecting the service, under their own privacy terms. Ours does not store it. Where we need to tell one visitor from another (to stop somebody guessing passwords, or flooding a form), we use a one-way scramble of the address with a key that is thrown away and made new every time the server restarts. The address itself is never written down, and the scrambled version cannot be turned back into one.

No script on our pages reports on you. Cloudflare offers a small analytics script and it is refused: our pages are only allowed to run code from us, so if it is ever inserted your browser blocks it before it does anything. Everything else the page needs (the fonts, the styles, the code) is ours, sent either by our own server or by Vercel on our behalf.

4. What we still don't collect

• No tracking cookies and no advertising pixels. The cookies we set are the ones that make the thing work, and they are listed in section 2.
• No advertising, and nothing sold. We do not sell, rent or share personal information, and there are no advertisers to share it with.
• No profile of you. The traffic figures above are counts. Nothing joins them to your account, your characters or your games.
• No third-party fonts or scripts. Everything the page needs comes from us.
• Nothing of yours is offered to an AI. The companies that build AI assistants send crawlers to read websites. Ours are told, in robots.txt and in a machine-readable reservation at /.well-known/tdmrep.json, that they may read the pages we wrote and not the forums, profiles or anything you posted. Nothing you make here is used to train anything, by us or through us. The Terms, section 13 set this out.
• No card details. Paddle, who sells every purchase, takes the card. We never see the number and never store it.
• No location, no contacts, no device fingerprinting. Country from a network address is not a location in any sense you would recognise, and it is as close as we get.
• Nothing kept about your game. A campaign runs on the GM's own computer and is saved there. When players reach it through us, what they send passes through our service and is not stored (section 19). A game played only on the GM's own network never touches us.

5. How your password is stored

Your password is never stored, and it is not encrypted either, because encryption can be undone by whoever holds the key. It is put through scrypt, a deliberately slow one-way function, along with a random value unique to you. What's kept is the result. Signing in repeats the calculation and compares the results.

The practical meaning: if someone stole the account file tomorrow, they would not have your password, and neither do we. We cannot email it to you or read it out, because we genuinely do not have it.

Password rules follow the current NIST 800-63B guidance: a length requirement and a check against commonly used passwords, rather than forcing a symbol and a capital letter, which makes passwords worse rather than better.

6. How the rest is stored

• Accounts live in a single file on an encrypted drive, and that file is itself encrypted with AES-256-GCM.
• A copy of each account is kept in a database that Supabase runs for us. It holds the same things as the file: your username, email address, password hash (never the password), membership and settings. Supabase encrypts it on its disks (AES-256) and on its way there (TLS), but it is not encrypted with our own key the way the file is, so Supabase's systems hold it in a form they could read. Only our server can reach it, with a key kept beside the accounts; no browser ever talks to that database, and it refuses anyone who tries.
• The encryption key is kept on a different drive from the accounts, so a copy of the account file (a backup, a misplaced folder, a stolen disk) cannot be opened on its own.
• Backups of campaigns deliberately exclude the account file entirely.
• Email confirmation links and session tokens are stored as SHA-256 hashes, so the file doesn't contain anything that could be replayed.
• Everything travels over HTTPS.

Being straight with you about the limits: our own server is a small company’s own server, not a data centre. These measures protect your data from copies that escape the machine. They do not pretend to be a SOC-2 audited environment, and you should weigh that when deciding what to put here.

7. Who we share it with

Nobody, with five narrow exceptions:

• Paddle is the seller of every purchase and takes the payment. When you go to pay, we send Paddle your email address and a reference for your account and your order, so the payment can be matched to you. Paddle holds your card and billing details, sends your receipt, and keeps its own records under its own privacy policy.
• Google Workspace carries our outgoing email, so it handles your address when we send you a confirmation link. Google acts as our processor.
• Cloudflare carries traffic between you and the server. Being straight about what that means: the connection is encrypted from your browser to Cloudflare and again from Cloudflare to us, but Cloudflare decrypts it in the middle. So it sees your IP address and could in principle see what passes through, your messages and dice rolls included. We have no reason to think it does, and this is how most of the web works, but it is not end-to-end encryption and we won't describe it as if it were. A game hosted on your own network, without the public address, doesn't involve Cloudflare at all.
• Vercel sends the pages of aetherboard.app (section 3). What you send to the website, your password when you sign in included, passes through Vercel on its way to our server, encrypted to Vercel and again from Vercel to us, like Cloudflare. Vercel does not keep it and acts as our processor.
• Supabase holds the copy of the accounts described in section 6. It acts as our processor: it keeps the data for us, does nothing else with it, and keeps its own records under its own privacy policy.

We do not sell your data, share it with advertisers, or hand it to anyone for their own purposes. If we were ever legally compelled to disclose something, we'd tell you unless the law forbade it.

8. Marketing email

We will not send you marketing unless you ticked the box asking for it. That box is separate from accepting the terms, and it starts unticked: agreeing to the terms is not agreeing to marketing.

You can turn it off in your profile in one click, or use the unsubscribe link in any such email. Turning it off doesn't stop the messages we need to send to run your account, like a confirmation link or a receipt.

9. Your rights

Wherever you live, you can ask us to:

• See what we hold about you;
• Correct anything wrong;
• Delete your account and its data;
• Export your data in a machine-readable form;
• Object to or restrict what we do with it, or withdraw consent you've given.

Email [email protected] and we'll act within 45 days. There's no charge, and we will never treat you differently for asking: no worse service, no different price.

If you live in California (CCPA/CPRA), or in another U.S. state with a comprehensive privacy law (Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Tennessee, Texas, Utah and Virginia among a growing list), those rights are yours by law, and the list above is how we honor them. Specifically:

• We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising. We never have. There is no "Do Not Sell" link because there is nothing to opt out of.
• We do not use your information for profiling or automated decisions about you.
• We collect no "sensitive personal information" as those laws define it.
• If we refuse a request you may appeal by replying to our answer, and we will respond in writing with our reasons.

Arizona, where we are based, has no comprehensive consumer privacy statute at the time of writing. We apply everything above to everyone wherever they live, because running two standards would be more work than running one good one.

If you are in the UK or EEA: our lawful bases are contract (running the account you asked for), consent (marketing email only) and legitimate interests (keeping the service secure). You may complain to your data protection authority (in the UK, the ICO).

10. If something goes wrong

If we discover a breach affecting your personal information we will tell you, by email to the address on your account, without unreasonable delay: what happened, what was affected, and what to do about it. Arizona law (A.R.S. § 18-552) allows 45 days; we would rather it were the same day.

We would also rather hear about a problem than not. If you find a security flaw, email [email protected]; we will not pursue anyone acting in good faith to report one.

11. Deleting your account

Deleting your account removes your username, email address, password hash and preferences. Characters you created are deleted with it. Messages you sent to a table remain in that table's log, attributed to a deleted user, because removing half a conversation would make nonsense of the other players' records. Tell us if you need those removed too and we'll do it by hand.

One exception. If you sold work in the shop and money is still owed to you, we keep your email address and the record of what you are owed until it is paid or handed over as abandoned property, so we can write to you about it. The Terms, section 18, say how that works.

Purchase records are another exception. They stay for the rest of their seven years, with no name or email address on them (section 17).

Work you sent to sell that never went on sale is deleted with your account. Work that is on sale stays (section 18).

Our log of what admins did on the site, and of payments arriving, can still name your account until newer entries push the old ones out, which takes about a year. Only admins can read it.

Deleting your account deletes its copy in Supabase as well. Deleted data is gone from backups within 30 days, as old backup snapshots age out; Supabase's own backups keep it for up to 7 days.

12. Children

Aetherboard is not directed to children under 13 and we do not knowingly collect personal information from them, as required by the U.S. Children's Online Privacy Protection Act (COPPA). If you believe a child under 13 has created an account, email [email protected] and we will delete the account and their information promptly.

13. Where your data is

Our server is in Arizona, U.S.A. The copy of the accounts that Supabase keeps is in the United States. Our email provider (Google), network providers (Cloudflare and Vercel) and payment provider (Paddle) operate globally and may handle data in other countries. If you are outside the United States, using the Service means your information is processed in the United States, which may have different privacy laws than your own.

14. Changes

If this policy changes in a way that matters, we tell you in the app while you are signed in, and a new account always starts on the latest version. The version and date are at the top of this page.

15. Contact

Questions about any of this: [email protected]. For UK and EU data protection law we are the data controller; under U.S. state privacy laws we are the "business" or "controller" as those laws define it.

16. Shop requests

If you send a shop request we email a copy to our support mailbox: the name, kind, link, your words, your username and your membership, never your email address. We keep the record of your agreement with the request. If you delete your account, the request stays on the board without your name, and the record keeps the Terms version and the time but no longer points at you.

17. Payments, receipts and purchase history

Paddle sends your receipt. We do not keep a copy of it. What we keep is our own record of each purchase: what it was, the price, the date, how it ended (paid, refunded or failed), and Paddle's reference for it. For a membership we also keep the plan, its dates and your answer about automatic renewal, with the words you were shown when you gave it.

We keep it to give you what you paid for, to answer a question about a payment, for our own accounts, and to be able to show what you agreed to. Only our admins can see it, to help with a payment. It is never sold and never used for advertising.

Each record is kept for seven years from the payment and then deleted. Your answer about automatic renewal is kept as long as the membership it belongs to is still renewing, and seven years at least. If you delete your account, the record stays for the rest of that time without your name or email address on it.

Your profile shows your own purchases from the last 365 days: the date, what it was, the amount and how it ended. The download of your data (section 9) has every purchase record and every renewal answer we hold for you, not only the last year.

18. Selling your own work

If you send work to sell, we keep its files (the PDF, the pictures and any game system), its title, words and price, the record of what you agreed to, and what we decided about it with any note we wrote to you. The files are encrypted, with the same key as the accounts.

The PDF itself is opened only by an admin looking at the work, and each opening is written in the admin log. Buyers see its pages in the app, never the file. When we decide about your work we email you the decision and its note. The email does not name who decided. On sale, the work is shown under your username while you have an account, and as "a former member" after you delete it.

A draft, or work we turned down, is kept until you remove it or delete your account. Work that went on sale is kept for as long as it is on sale or somebody who bought it still has it, and that includes after you delete your account. The Terms, section 18, say what happens to it and to what it earned.

The download of your data (section 9) has what you sent to sell: the words, what you agreed to and the notes on our decisions. It does not have the files, which you already hold, or the name of anybody who looked at it.

If you buy a creator's book, we do not record which pages you read. Where you left off is kept in your own browser.

19. Games hosted on a GM's own computer

A GM hosts a game on their own computer, and the game is saved there. Players on the same network reach it directly. Everybody else reaches it through our service, which passes messages between each player and the GM's computer.

What passes through us. Everything a player and the GM's computer send each other: chat, dice rolls, the character sheets sent to your seat, map pictures and music. It is encrypted on its way to us and on its way from us, but not from end to end, so our service handles it and could in principle read it. We do not read it, store it or log it. The saved game never leaves the GM's computer.

What we count. For each GM's account, each month: how much data passed, how many messages, and how many times a game was shared. No names, no network addresses, no game names and no codes. We keep those counts for thirteen months, and only our admins can read them.

What is public. When a GM hosts from the app while signed in, each game they have not marked Private is shown in the public list of games. The list shows the game's name, the name the GM plays under, the game system, whether it has a password (never the password), how many seats it has and how many people are connected, and the date it was last saved. It does not show players' names, anybody's network address, or the game's code. The list is held in memory only and a game leaves it when the GM's app disconnects.

The code. Every shared game has a code. It is the GM's to give to the people they want at the table. We do not list it, and we do not put it in any link we show or send. When you type a code in, it is sent to us once, over an encrypted connection, and swapped for a pass. We keep nothing of the code, and it is in no address, log or page. The pass is 32 random characters we make. It is held in memory only, never logged, and lasts at most 12 hours or until the GM's app disconnects. The pass is in your own page's address and in the addresses your page fetches that game's pictures and music from, so it is in your browser history, and our network provider sees it as part of the address. Anybody you give that address to can use it until it expires. A game opened from the public list uses a different address we make for it, with no code in it, which stops working when the game leaves the list.

The table password. A GM can put a password on a game. Somebody who joins from the public list is asked for it. Somebody who joins with the GM's code is the GM's guest and is not asked. So the password keeps out strangers from the list, not the people the GM gave the code to.

What a GM controls. Marking a game Private keeps it out of the list, so only people with the code can reach it. Stop sharing, in the app, takes the game off our service until the GM shares it again. A GM who is not signed in is never on our service at all.

Nothing new is collected about a player who joins this way.

Last updated 2026-10-15.1.