VTT

PRIVACY POLICY

Last updated: 2026-07-14

1. DATA CONTROLLER

Virtual Tabletop is operated by Emanuele D'Angelo. Contact: info@ggally.net

2. DATA WE COLLECT

Account data:

  • Name
  • Email address
  • Password hash

User content:

  • Characters
  • Campaigns
  • Notes
  • Images you upload

Usage data:

  • WebSocket connection logs
  • Room participation
  • Dice rolls
  • Local storage preferences (theme settings, UI state)

Technical data:

  • IP address
  • Browser user agent
  • Device information
  • Logs for debugging

Payment data:

None collected at present

3. PURPOSE OF PROCESSING

  • Account management and authentication
  • Providing VTT functionality and real-time features
  • Storing and synchronizing your game content
  • Security, debugging, and service improvement
  • Responding to support requests
  • Remembering user interface preferences (theme, sidebar state)

4. LEGAL BASIS

  • Contract performance: providing the service you request
  • Legitimate interest: security, abuse prevention, service improvement
  • Consent: optional features where applicable

5. DATA RETENTION

  • Account data: retained while your account is active. Deleted within 30 days of account deletion request.
  • Game content: deleted with your account or on request.
  • Logs and IP addresses: retained for a maximum of 90 days.
  • Local storage data: retained until cleared by user or until browser data is cleared.

We do not sell or rent your personal data.

6. DATA SHARING

We do not share your data with third parties, except:

  • Hosting infrastructure providers for technical operation
  • Legal compliance when required by law
  • Future payment processors only if donation features are activated, with full disclosure

7. LOCAL AI MODELS FOR DEBUGGING AND SUPPORT

We utilize locally-hosted artificial intelligence models exclusively for:

  • Debugging assistance and error analysis
  • Development support and code improvement
  • Internal quality assurance processes

These models operate solely on our internal servers and do not process any personal user data. All AI processing is performed on anonymized, aggregated logs or synthetic test data. No user-generated content, account information, or personal data is ever transmitted to or processed by these AI systems.

8. INTERNATIONAL TRANSFERS

Data is processed in the European Union. No transfers outside the EEA without appropriate safeguards.

9. COOKIES AND TRACKING

We use strictly necessary session cookies for authentication:

  • sessionid: Django session identifier
  • csrftoken: Cross-site request forgery protection

We also use localStorage to store user interface preferences:

  • theme: User-selected interface theme (auto, light, dark, or class-specific themes)
  • django.admin.navSidebarIsOpen: Admin interface sidebar state
  • django.admin.navSidebarFilterValue: Admin interface filter values
  • django.admin.filtersState: Admin interface filter configurations

We do not use:

  • Analytics cookies
  • Third-party tracking cookies
  • Advertising cookies
  • Persistent cookies for marketing purposes

10. CHILDREN'S PRIVACY

Our service is designed for tabletop roleplaying enthusiasts of all ages. However:

  • Users under 13 years old should not use the service without parental consent
  • Users between 13 and 16 years old (varies by EU member state) may require parental consent depending on local implementation of GDPR Article 8
  • We do not knowingly collect personal data from children under 13
  • If we become aware that we have inadvertently collected personal data from a child under 13, we will delete such information promptly
  • Parents wishing to exercise their rights regarding their child's data should contact us at info@ggally.net

11. YOUR RIGHTS

Under GDPR, you have the right to:

  • Access your personal data
  • Rectify inaccurate data
  • Erase your data
  • Restrict processing
  • Data portability
  • Object to processing

Exercise your rights by contacting us at info@ggally.net. Response within 30 days as required by GDPR.

12. AUTOMATED DECISION-MAKING AND PROFILING

We do not use automated decision-making processes that produce legal effects or significantly affect users. We do not engage in profiling for marketing, advertising, or behavioral advertising purposes.

13. DATA BREACH NOTIFICATION

In the event of a personal data breach:

  • We will notify the relevant supervisory authority within 72 hours of becoming aware of the breach, where feasible
  • If the breach is likely to result in a high risk to the rights and freedoms of individuals, we will notify affected users without undue delay
  • Notifications will include details of the breach, its likely consequences, and measures taken to address it

14. SECURITY

We implement appropriate security measures including:

  • Password hashing using industry-standard algorithms
  • Encrypted connections (HTTPS) for all data transmission
  • Access controls and authentication mechanisms
  • Regular security reviews and updates
  • Secure server configurations

We cannot guarantee absolute security, but we strive to protect your data against unauthorized access, alteration, disclosure, or destruction.

15. CONTACT

For questions about this Privacy Policy or our privacy practices, contact us at: info@ggally.net