Privacy Policy

Last updated: August 20, 2026

This policy lays out what Mycena Studios LLC (“we” or “us”) collects when you use The DM Screen (the “Service”), what we do with it, and how we look after it. Using the Service means you’re okay with what’s described here.

1. What We Collect

Here is everything we collect, and nothing we don’t:

  • Account information. Your email address, your password (kept as a one-way hash, never as plaintext), and whatever display name you pick. This comes straight from you when you sign up.
  • Campaign content. The campaigns, characters, NPCs, encounters, maps, journal entries, dice history, and anything else you create or upload while using the Service.
  • Player presence. When you join or run a live session, we pass presence signals to the other people you’ve invited: who is connected, who is typing, who just rolled what. These are live-only. We don’t keep them once the session ends, apart from the dice roll history that shows up in your own log.
  • Billing information. Stripe handles your payment card and stores it under its own compliance program. What reaches us is the transaction metadata (the amount, whether it went through, which tier) and a Stripe customer ID. We never see or store your full card number, expiration date, or CVV. Purchases made inside the Android app go through Google Play instead of Stripe, and the same thing is true there: Google takes the payment, and what reaches us is which plan you bought and whether it is still active.
  • Usage data. The standard server logs our hosting picks up: IP address, user agent, request path, timestamps. We use these for security monitoring, catching abuse, and debugging when something breaks.
  • Crash reports. When a screen fails to draw, we record what threw: the error name and message, a stack trace, a short tag naming the surface it happened on, and the time. A copy stays in your browser so you can read it back, and a copy is sent to our own server so a crash on somebody else’s phone can be fixed without asking them to open developer tools. A crash report carries no campaign content and no account details. It does carry two things about your visit, and here is exactly how much of each: the page address, reduced to the shape of the route rather than the address itself, so a crash on an invite link is filed as “/invite/[token]” with the token dropped; and a coarse description of your browser, meaning its family, its major version, and whether you are on Android, iOS, macOS, Windows or Linux. We do not store your IP address, or a hash of your IP address, on a crash report.

2. How We Use It

Here is what we do with all of that:

  • Run the Service: account access, storing your content, keeping everyone in a session in sync.
  • Process subscriptions and lifetime purchases: through Stripe on the web, and through Google Play for purchases made inside the Android app.
  • Reach you about service updates, billing problems, security issues, and major product changes.
  • Look into suspected abuse, break-in attempts, or violations of our Terms of Service.
  • Track down and fix bugs and performance problems.

We don’t sell your personal information. We don’t use your campaigns, character data, or chat messages to train machine-learning models. And there is no third-party advertising anywhere in the Service.

3. Who We Share It With

The only outside companies that touch your data are the ones we need to run the Service:

  • Supabase holds the database and runs authentication. Your login details and campaign content live in Supabase’s infrastructure, under their security and compliance program.
  • Vercel hosts the app and serves requests. The standard server logs (IP, request path) are visible to Vercel as a normal part of that.
  • Stripe processes card transactions made on the web. Stripe gets the card details, your billing address if you give one, and the amount. We pass Stripe your email and user ID so the subscription it creates can be tied back to your account.
  • Google processes purchases made inside the Android app. Google Play’s billing rules require it: a subscription bought in the app is bought from Google, not from us. Google gets whatever payment details you have on your Google account, which we never see. What comes back to us is which plan you bought, whether it is still active, and an anonymous purchase identifier.
  • RevenueCat is the service that carries that message. It sits between the app stores and us, receives the store purchase, and tells our server which account it belongs to. We pass it your user ID for exactly that reason, and it holds the purchase history for your account. It never receives your payment details, because the store never gives them out.

We’ll also hand over information if the law makes us (a subpoena, a court order, that sort of thing), if it’s needed to protect people’s rights and safety, or as part of a merger, acquisition, or sale of the business, where whoever is acquiring it agrees to keep up the protections in this policy.

4. How Long We Keep It

We keep your account information and campaign content for as long as your account is open. Close your account and we delete your personal information and campaign content within 30 days, with one exception: billing records we are legally required to hold onto for tax or accounting reasons, which is usually up to 7 years of transaction history. Those retained records carry the amount, the plan and the payment processor’s own reference, and no name, email or user ID.

You do not have to ask us to close your account. There is a Delete my account control in your account menu and in Settings, and it is the whole process: confirm it, and we schedule the deletion for 14 days later and sign you out everywhere. During those 14 days you can sign back in and cancel it, and nothing has been touched yet. After that the deletion runs on its own and is irreversible. Any subscription is cancelled at the same time. The full route, including how to ask if you cannot get into your account, is on our account deletion page.

Server logs stick around for 30 to 90 days, unless one is tied up in an active security investigation. Crash reports are kept on the same footing, and the copy held in your own browser keeps only the ten most recent, oldest dropped first.

5. Your Rights

You are entitled to:

  • See the personal information we hold on you.
  • Fix it if it is wrong.
  • Have your personal information and campaign content deleted (the “right to be forgotten” under GDPR and similar laws). You can do this one yourself, in the app, without asking us.
  • Export your campaign content in a portable format.
  • Opt out of non-essential email. By default we only send service-critical messages anyway, and there is no marketing list to leave.

Deletion is self-service: use Delete my account in your account menu or in Settings, and see our account deletion page for what goes, what is kept, and how long it takes. For the rest, email us at support@mycenastudios.com from the address on your account, and we’ll get back to you within 30 days. If you live in California, the CCPA gives you a few more rights, including knowing what personal information we’ve collected and not being treated differently for exercising them.

6. How We Protect It

We protect your information with the usual measures: TLS encryption for everything in transit, row-level security in Supabase so only authorized users can read a given row, hashed passwords, and least-privilege credentials on our internal systems. No system is ever perfectly secure, though, and we can’t promise that something sent to the Service will never be intercepted or reached by someone who shouldn’t.

If we find a breach that affects your data, we’ll tell you, and we’ll notify regulators wherever the law requires it.

7. Cookies and Tracking

We do not run analytics or behavioral tracking. There is no analytics provider, no advertising network, no third-party tracker, and no profiling of what you do inside the Service. We do not sell or share your personal information.

That leaves the cookies the Service cannot work without, and this is all of them:

  • Supabase authentication (names beginning “sb-”). Keeps you signed in. Without it every page would ask for your password again.
  • dms-guest and dms-guest-system. Remember that you chose to try the Service without an account, and which game system you picked. They last 60 days; clearing them ends the guest session.
  • dms-gb-home. Records which version of the front page you were shown, so it stays the same on your next visit instead of changing under you.
  • NEXT_LOCALE. Remembers the language you chose.
  • dms-debug. Present only if you switched on the in-app debug banner yourself.

We also keep things in your browser’s own storage rather than in a cookie: your interface preferences, an unfinished character draft, and the crash log described in section 1. Those stay on your device.

Because none of this tracks you from one site to the next, the “Do Not Track” browser signal has nothing to switch off, and there is no consent banner to click through.

8. Children

The DM Screen isn’t aimed at children under 13, and we don’t knowingly collect personal information from anyone under 13. If you think a child has given us their information, email us at support@mycenastudios.com and we’ll delete the account and its data promptly.

9. International Users

We run the Service from the United States. If you’re using it from somewhere else, your information gets transferred to and processed in the US, where data protection law may not look like the law where you are. Using the Service means you’re okay with that transfer.

10. Changes to This Policy

We’ll update this policy from time to time. When a change is material, we’ll tell registered users by email or an in-product notice. The “Last updated” date at the top always reflects the latest version.

11. Contact

Questions about this policy, or want to exercise your data rights? Email us at support@mycenastudios.com.