Privacy notice
Last updated: October 20, 2026.
DC20 Sidekick is an unofficial companion tool for DC20, operated by William in Texas, United States. It is not affiliated with or endorsed by The Dungeon Coach. William is responsible for the personal information handled by this service.
Privacy contact: adainels_10@yahoo.com. Please do not send passwords, identity documents, payment details, or sensitive personal information.
What we collect and why
- Account information: your chosen username, email address, password hash (if you set a password), account creation and login/verification timestamps, and the version and time of terms acceptance for new accounts. We use this to provide your account, authenticate you, and support account recovery. We store a password hash rather than your original password.
- Google and Discord sign-in: if you sign in with or link Google or Discord, that provider sends us your account ID there, email address, display name and profile picture link. We store these with your account, together with the OAuth tokens the provider issues (access and refresh tokens are stored encrypted), so you can sign in and manage the link in Account settings. Google and Discord process your sign-in under their own terms and privacy policies.
- Passkeys and two-factor authentication: if you add a passkey, we store its public key, the name you give it and technical details your device reports; the private key stays on your device or passkey manager. If you turn on two-factor authentication, we store the authenticator secret and your backup codes to verify sign-in codes. Removing a passkey or turning off two-factor authentication deletes those records.
- Your game content: characters, notes, homebrew, campaigns, NPCs, encounters and content you choose to save. Signed-in content is stored on our hosting service and may also be cached in your browser. Guest content is stored in your browser unless you later sign in and transfer it.
- Security information: session credentials, the IP address and browser user agent recorded with each signed-in session (you can review and sign out sessions in Account settings), temporary verification/reset links, connection tickets, and IP-address or account-based rate-limit records. Our hosting provider also processes connection information to deliver and protect the service.
- Support messages: information you choose to send to the privacy/support email, used to answer your request. Email providers process those messages as part of delivery.
Do not put real-world health, financial, government-ID or other sensitive information in game notes. Choose a username that does not expose your real name if you prefer.
Who can see your information
Other campaign members can see information you share with the party. GM-only and hidden content has separate permissions. A character sharing link makes its shared view available to anyone who obtains the link; recipients may copy it. Revoking a link stops future access through that link, but cannot retrieve copies other people already saved.
Cloudflare hosts and protects the site and account database. Signed-in character portraits are stored privately in Cloudflare R2 and delivered through the same account and campaign permissions as character records. Replaced or deleted portraits become eligible for cleanup after 24 hours; cleanup may take longer during outages or while a large backlog is processed. Browser copies remain until cleared. Resend delivers account-verification and password-reset emails. To deliver those messages, Resend processes the recipient email address, message content (including the temporary verification or reset link), and delivery information. We use those emails for account services, not marketing. Delivery records and message content may remain with the provider under its retention settings and data-processing terms. Do not forward reset links. Resend processes recipient email addresses and transactional message contents, including temporary verification and password-reset links, to deliver account emails. These messages are not marketing emails. Fonts and required libraries are served from our own site rather than loading from Google Fonts or library CDNs. Following external links or loading external resources you choose may disclose connection information to those destinations. We may access information to operate the service, respond to support requests, prevent abuse or meet legal obligations. Site administrators, who must use two-factor authentication or a passkey, can see account details (username, email address, role and suspension status), change account roles, suspend accounts with a recorded reason, and sign out an account's sessions. We do not sell personal information, use targeted advertising, or run marketing email campaigns. We collect optional usage analytics only after your explicit choice.
With your permission, PostHog processes limited usage events through its US service to help improve the app. Events may use your internal account ID, but this integration does not send your email address, username, character contents, reset or verification tokens, console logs, or session recordings. Analytics requests disclose connection information to PostHog. You can allow or withdraw optional analytics in Cookies and browser storage. Refusing analytics does not affect core features. Contact us for requests about previously collected data.
Cloudflare Turnstile checks on signup and password recovery process browser and connection information to help prevent automated abuse. Our server verifies the resulting temporary token; we do not save Turnstile tokens or use them for advertising or audience analytics.
Cookies and browser storage
We use storage for sign-in, saving your game, preferences, and security. See Cookies and browser storage for purposes, duration and ways to clear it. We do not treat reading this notice or continuing to browse as consent to optional tracking.
We do not track you across unrelated sites for advertising. A Do Not Track or Global Privacy Control signal does not activate a different advertising mode: we do not sell or share data for cross-context behavioral advertising in either case.
How long information stays
- Account and saved game content remains while you use the account, until you delete supported content or request account deletion. Inactive accounts are not currently deleted on a fixed schedule. Accounts started with Google or Discord sign-in that never finish choosing a username and accepting the terms are deleted after 24 hours.
- Expired login, verification, reset and connection records are cleaned up hourly; used reset tokens are also removed. IP/account rate-limit events older than 24 hours are removed by that job. Runs may be delayed by an outage. Expiry is enforced even before records are cleaned up.
- Browser copies can remain until you clear them, even after signing out or requesting server deletion. They are not encrypted by the app. People with access to your browser/device may be able to read them.
- Cloudflare database recovery history can retain deleted data for up to 30 days, depending on the hosting plan. Provider security logs follow the provider's applicable retention settings and obligations. Deletion from the live database does not instantly erase backup history.
- Support/privacy correspondence is retained to handle the request and document the response, then reviewed for deletion. A limited record may be retained where needed for legal obligations or disputes.
Your choices and requests
You can use guest mode without creating an account, edit your characters, and revoke sharing links. Your account page offers a password-confirmed download of your account records and campaign notes and encounters you can currently view. If you sign in only with Google or Discord, set a password in Account settings first. Historical or restricted shared records need operator review to protect other people. To request a fuller copy, correction, fuller deletion, restriction, objection, or another applicable privacy right, email the privacy contact above. If possible, write from your account email and include your username and the request type. We will verify your identity proportionately; never email your password. If you cannot access your account email, explain that without sending identity documents.
We aim to respond within one calendar month. If applicable law permits more time, we will explain the reason and timing. Some information may need to be retained for legal obligations or other people's rights; we will explain any limitation. A request will not result in discriminatory treatment. You can contact us again to appeal a decision and may complain to the relevant privacy regulator.
You can delete your account yourself from Account settings. Password accounts confirm with their password; accounts that sign in only with Google or Discord must have signed in within the last 24 hours. If you run a campaign, delete those campaigns first. Deletion removes your account, characters, personal homebrew, sign-in methods and campaign memberships; notes addressed only to you become private to the GM. Notes other people wrote, free text in shared campaigns, copies saved in your browser, up to 30 days of database recovery history and provider logs are not removed by this button; email the privacy contact above for a fuller erasure. Other players' accounts and their independently saved copies are not deleted.
Published homebrew. Entries you publish are kept after you unpublish them or delete your account, credited to “Former member” and no longer linked to your account; your username is not kept with them. Users who added an entry to their library keep it. If you report an entry, we store your account id with the report until it is resolved and remove the link when your account is deleted.
International users and legal bases
The operator is in the United States and hosting/providers may process data in the United States and other countries. Where required, processing and transfers must be covered by appropriate safeguards, such as applicable provider data-processing terms and standard contractual clauses. Contact us for information about safeguards relevant to your data.
Where GDPR applies, our purposes include providing the service you request (contractual necessity), protecting the service and responding to support (legitimate interests, balanced against your rights), and meeting legal obligations. Any processing that requires consent must have a separate choice, and that consent can be withdrawn. We do not require consent to marketing to use the app.
Children and teens
This service is intended for adults and teens aged 13 and older, not children under 13. Teens should involve a parent or guardian and avoid sharing identifying details. This is not a parental-consent service. If you believe a child under 13 has provided personal information, contact us so we can investigate and remove it as appropriate. Additional protections may apply to teens depending on location. Signup checks an age group before account details; we do not save that age group or collect a birthdate. An under-13 answer prevents signup in that tab using temporary browser storage. With Google or Discord sign-in, the account is created before the age question; the age group is still checked on the next step and is not stored, and an under-13 answer deletes the just-created account and its sign-in details.
Service terms
The Terms of service explain account responsibilities, shared content and service limitations. Reading this privacy notice is not consent to optional data use.
Changes
We will update this notice when practices change and provide additional notice or obtain consent where required. The date above identifies this version. Contact details may change; the current address will always be shown here.