Privacy Policy

Last updated: 2026-06-16

This Privacy Policy explains how Isometra ("we", "us", "the service") collects, uses, and protects your data when you use the platform. By using Isometra you agree to the practices described below.

1. Who we are

Isometra is a 5E-compatible virtual tabletop for in-person and online tabletop roleplaying. The service is operated by an individual developer; the operator is the data controller for the purposes of GDPR/UK GDPR. See the Contact section at the bottom for how to reach us.

2. What we collect

We collect only what's needed to run the service.

Account data

• Email address (used as your sign-in identifier)
• An authentication identifier issued by our auth provider (Supabase)
• Display name and profile picture, if you set them

Game content you create

• Characters (name, race, class, ability scores, equipment, spells, backstory, portraits)
• Campaigns (name, setting, NPCs, locations, quests, sessions, handouts, maps)
• Notes, homebrew content, and any text you write inside the app
• Fork relationships (which campaign you forked from, who forked your campaign)

Chat content (AI features)

• Messages you send to the in-app AI personas (Loremaster for DMs, Lyra for players)
• The structured context the app sends with each message — your active character, campaign, recent events — so the AI can respond meaningfully
• The AI's responses

Billing and subscription data (if you subscribe or buy AI credits)

• Your subscription tier, status, and current billing period
• Identifiers from Stripe (a customer ID and subscription ID) that link your account to your billing records
• AI credit balances and a usage ledger — which AI feature you used, the model, and our cost — used to meter paid AI usage
• Usage counters (e.g. how many AI chats, portraits, or maps you generated this period) and your storage usage, used to enforce plan limits
• We never receive or store your card number. Card details are entered directly on Stripe's hosted checkout; Stripe processes the payment and returns only a reference and status.

Diagnostic and operational data

• Server logs (which routes were called, how long they took, error stack traces)
• Browser-side error reports via Sentry (only if Sentry is enabled in your environment)
• Vercel analytics page-view counts (no personal identifiers; aggregated)
• In-app feature-usage events — which features you open (e.g. a campaign tab, a player screen), recorded as metadata only (the feature name, never the contents of what you typed or created). We use these aggregate counts to understand which features are useful and which to improve. They are not shared with other users (your DM cannot see them, and they are not shown in the app).

Cookies and similar

• A session cookie issued by Supabase auth so you stay signed in
• A consent cookie (if/when we add an explicit consent banner)
• Local storage entries for UI preferences (theme, sidebar state, last-active campaign)

We do not intentionally collect: precise geolocation, device fingerprints beyond what your browser auto-sends, full payment card numbers (card data is entered and processed entirely by Stripe — see below), or social-graph data from other platforms.

Audio feature

The in-app audio library plays entirely client-side in your browser (and out to whatever speaker your device is connected to). Playing a clip does not collect any new personal data — we don't record what you played, when, or for how long. As with every other feature, opening the audio panel may be counted by our existing anonymous feature-usage analytics (the feature_events metadata described in the "Diagnostic and operational data" bullet above): the feature name only, never audio content, listening behavior, or any personal identifier.

3. How we use your data

• Run the service. Render your characters, persist your campaigns, route AI chat, deliver pages.
• Improve reliability. Read logs and error reports to find and fix bugs.
• Communicate with you. Send transactional emails (password reset, account verification). We don't send marketing emails.
• Process payments and manage subscriptions. Create, renew, and cancel subscriptions, apply purchased credits, and enforce plan limits — through our payment processor, Stripe.
• Comply with legal obligations. Respond to lawful requests; preserve data where required by law.

We do not sell your data, share it with advertisers, or use it for advertising profiling.

4. Who processes your data on our behalf

Isometra uses third-party sub-processors for infrastructure. Each sub-processor receives only what they need to perform their function.

5. AI processing disclosure

When you chat with an Isometra AI persona (Loremaster or Lyra) or use AI helpers like NPC suggestions, character portraits, or session summaries:

• Your messages and the structured context the app prepares are sent to Anthropic via the Vercel AI Gateway. Image generation requests are sent to Google via the Vercel AI Gateway.
• We use the AI provider's standard API; we do not opt-in to any provider training program. Provider-side handling is governed by Anthropic's privacy policy and the Vercel AI Gateway terms.
• AI responses are generated probabilistically and may contain inaccuracies. Treat AI-generated content as a draft, not a source of truth — especially for rules adjudication.
• The AI does not have access to your account credentials, payment information, or other users' private campaigns.

6. Data retention

• Active accounts: we retain your data while your account is active.
• Account deletion: when you delete your account from Settings, we soft-delete your characters, campaigns, and chat history. Hard-deletion (irreversible) happens within 90 days, except where law requires longer retention.
• Backups: routine database backups may retain copies for up to 35 days after deletion before they roll off.
• Logs and analytics: server logs and Vercel analytics events are retained per the provider's default retention (typically 30–90 days).
• Forked content: if another user forked one of your published campaigns before you deleted it, their fork is independent and survives your deletion. The attribution to your original work remains, but your name is replaced with "(deleted user)" if you've deleted your account.

7. Your rights

Depending on where you live, you have rights under GDPR, UK GDPR, CCPA/CPRA, or other privacy laws. We honor these rights regardless of jurisdiction:

• Access: request a copy of the data we hold about you.
• Correction: ask us to correct inaccurate data.
• Deletion: delete your account, which deletes your data subject to the retention rules above.
• Portability: request an export of your data in a structured, machine-readable format.
• Restrict / object: ask us to limit certain processing.
• Withdraw consent: where processing is based on consent (e.g. analytics), you can withdraw it at any time without affecting prior lawful processing.
• Lodge a complaint: with your local data protection authority.

To exercise any of these rights, see Contact.

8. Security

We use industry-standard practices: TLS in transit, Supabase Row-Level Security to scope every database query to the calling user, environment-level secret management, and sub-processors with their own security posture. No system is perfectly secure; if we discover a breach affecting your data, we will notify you in line with applicable law.

9. Children

Isometra is intended for users 13 and older. We do not knowingly collect data from children under 13. If you believe a child under 13 has provided us with personal data, please contact us — we will delete it.

10. Changes to this policy

When we change this policy materially, we will update the "Last updated" date and surface a notice in the app. Continued use after the effective date constitutes acceptance of the updated policy.

11. Contact

For privacy questions, requests, or to exercise the rights above:

• Email: zwchristie@gmail.com
• Subject line: "Isometra Privacy" so it routes correctly

We aim to respond within 30 days for substantive requests.

---

See also: Terms of Service — Licensing & Attribution.