This Privacy Policy describes what information PF1e Combat Tracker handles and where it lives. The short version: we hold the minimum needed to run your account, and everything you enter into the tracker — campaigns, party, encounters, stat blocks and the running fight — stays in your browser. If you live-share a fight, a filtered view of it goes straight from your browser to your players’ devices, and we never store it.
Last updated: 17 October 2026
Everything you enter stays in your browser.Your campaigns, saved party rosters, saved encounters, homebrew stat blocks, and the running fight — combatants, hit points, conditions, buffs — are stored in your browser’s local storage on your device. None of it is transmitted to us or to any database. That also means it does not follow you to another device or browser by itself: the Export button on the campaign screen saves a campaign to a file on your device, which you can import elsewhere, and clearing the site’s storage erases it for good.
Live Share goes device to device.When you start a live share, your browser sends a filtered, read-only view of the fight (initiative order, player names, anonymised monster labels, conditions, whose turn it is, and — if you choose — a rough health gauge or a Bloodied label for monsters and NPCs; never monster names, exact hit points, or your notes) directly to the browser of each person who opens your share link. It is not sent to or stored on our servers. To connect the two browsers, and to relay the encrypted connection when a direct one isn’t possible, the app uses the public servers of the PeerJS project (see section 4), which see both devices’ IP addresses and a random connection identifier but cannot read the fight. Anyone with the link can watch while your tracker is open; stopping the share ends it for everyone.
Nothing you enter into the tracker. Campaigns, party rosters, encounters, stat blocks and fights stay on your device, and a live share goes device to device (section 1); we never receive them.
Account data. When you create an account, our authentication provider (Clerk) collects and stores your email address, optional name and avatar, and sign-in metadata on our behalf. We use it to authenticate you, nothing else.
Payment data.The tracker is free, so we do not ask you for payment details and we collect no payment data at all. If we ever introduce a charge, payments would be processed by Stripe via Clerk Billing — card details would go directly to Stripe and we would never see or store your card number — and we would update this policy before that started. For the small number of accounts that subscribed while the tracker was paid, we can still see subscription status and Stripe’s billing records.
Technical data. Our hosting provider (Vercel) logs basic request information (IP address, user-agent, timestamps) for operational and security purposes when your browser loads the app.
Support messages.If you email us, or send a message through the contact form, we receive the content of your message, your email address (for the form, only if you choose to provide one), and — if you were signed in when using the form — your account id. Contact-form messages are delivered to our support inbox by our email provider (Resend). We use them only to respond.
We use no analytics, no advertising trackers, no third-party cookies, and no AI processing of your content. We do not sell or share personal information.
The app sets only the cookies Clerk needs to keep you signed in (session and client-state cookies). They are strictly necessary for authentication — there are no advertising or analytics cookies. The app also uses browser local storage strictly to operate:
pf1e-combat-tracker:campaigns:v1— your list of campaigns.pf1e-combat-tracker:c:<id>:…) holding that campaign’s live combat snapshot, saved party, saved encounters, homebrew stat blocks, and your live-share code and health-display choice — so a page reload loses nothing.pf1e-combat-tracker:active-campaign— which campaign you have open. This one is session storage, so your browser discards it when the tab closes.Five providers are involved in operating the app:
The Service is not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has created an account, contact us and we will delete it.
You can update or delete your account at any time from the account menu inside the app, or by emailing us. Deleting your account removes your data from Clerk. Stripe retains billing records for as long as financial regulations require.
Your campaigns and combat data live only in your browser, so we hold no copy to delete: deleting a campaign inside the app, or clearing the site’s storage, erases it. Deleting your account does not clear your browser’s storage — clear the site’s data yourself if you want it gone from the device too.
Who is responsible. PF1e Combat Tracker is operated by Vibing Legends Ltd, a company registered in the United Kingdom (company number 17363538), registered office 86-90 Paul Street, London, England, EC2A 4NE. Vibing Legends Ltd is the controller of the data described here for the purposes of the UK GDPR and the Data Protection Act 2018. Privacy questions and requests go to pf1ecampaigner@gmail.com, and we aim to answer within 30 days.
Why we may process your data. Account data and subscription status are processed to perform the contract you enter into by signing up. Request logs and abuse limits are processed on our legitimate interest in keeping the Service available and secure. We do not process your data for advertising or profiling, and we do not sell or share it in the sense used by California law.
Where it goes.We are based in the UK, and the providers listed in section 4 are US-based, so your data is transferred to and processed in the United States. Those transfers rely on each provider’s own data-processing terms, which incorporate the safeguards UK law requires for international transfers; their privacy policies are linked above.
How long we keep it. Account data is kept while your account exists and is removed when you delete it (section 6). Support emails are kept as long as needed to handle the conversation. Stripe retains billing records for as long as financial regulations require.
What you can ask for.You have the right to access the data we hold about you, correct it, delete it, receive a copy in a portable format, object to or restrict certain processing, and withdraw consent where we relied on it. Exercising any of these costs nothing and will never affect your subscription. If you think we have got something wrong you can complain to the UK’s Information Commissioner’s Office (ico.org.uk), or to your own supervisory authority if you live in the EU or EEA — though we would rather you told us first.
We may update this Privacy Policy from time to time. Material changes will be surfaced on this page and the “Last updated” date at the top will be revised.
For privacy questions, email pf1ecampaigner@gmail.com.