This Privacy Policy describes what information PF1e Combat Tracker handles and where it lives. The short version: we hold the minimum needed to run your account and subscription, your campaign prep syncs to your account so it follows you across devices, and your live combat data stays in your browser unless you choose to live-share a fight or save a cloud checkpoint.
Last updated: 26 July 2026
Your live combat state stays in your browser.The running fight — combatants, hit points, conditions, buffs — is stored in your browser’s local storage on your device and restores instantly on reload. It is not transmitted to us unless you choose to live-share the fight or save a cloud checkpoint (both described below).
Your campaign prep syncs to your account.So that your campaigns follow you across devices, your campaign names, saved party rosters, and saved encounters are stored with our database provider (Supabase), keyed to your account, and are also cached in your browser’s local storage. Deleting a campaign in the app removes its data from our database as well as from your device.
Cloud checkpoints are saved only when you ask. The “Save fight” button stores a snapshot of the current combat with Supabase, keyed to your account, so a fight that spans several sessions can be resumed on another device. Nothing is uploaded automatically, and loading a checkpoint is always an explicit action.
Live Share stores a filtered snapshot only while you use it.When you start a live share, a filtered, read-only snapshot of the current fight (initiative order, player names, anonymised monster labels, conditions, whose turn it is, and a rough health gauge for monsters and NPCs rounded to the nearest 10% — never monster names, exact hit points, or your notes) is stored with our database provider (Supabase) so your players’ phones can display it. Stopping the share deletes it immediately. Idle snapshots are cleaned up in the ordinary course of the app running — a share left untouched for more than about 24 hours is removed the next time any share is started — and you can always end a share yourself to delete it at once. A snapshot carries no monster names, exact hit points, or notes in the first place.
Campaign prep you save.Campaign names, saved party rosters (character names and basic stats), and saved encounters are stored with Supabase, linked to your account, to provide cross-device sync — along with any combat checkpoints you explicitly save. We use this data only to sync it back to you; we do not analyse it or share it. The running fight itself never reaches our servers unless you live-share it or checkpoint it.
Account data. When you create an account, our authentication provider (Clerk) collects and stores your email address, optional name and avatar, and sign-in metadata on our behalf. We use it to authenticate you, nothing else.
Payment data.The tracker is free, so we do not ask you for payment details and we collect no payment data at all. If we ever introduce a charge, payments would be processed by Stripe via Clerk Billing — card details would go directly to Stripe and we would never see or store your card number — and we would update this policy before that started. For the small number of accounts that subscribed while the tracker was paid, we can still see subscription status and Stripe’s billing records.
Technical data. Our hosting provider (Vercel) logs basic request information (IP address, user-agent, timestamps) for operational and security purposes when your browser loads the app.
Support messages.If you email us, or send a message through the contact form, we receive the content of your message, your email address (for the form, only if you choose to provide one), and — if you were signed in when using the form — your account id. Contact-form messages are delivered to our support inbox by our email provider (Resend). We use them only to respond.
We use no analytics, no advertising trackers, no third-party cookies, and no AI processing of your content. We do not sell or share personal information.
The app sets only the cookies Clerk needs to keep you signed in (session and client-state cookies). They are strictly necessary for authentication — there are no advertising or analytics cookies. The app also uses browser local storage strictly to operate:
pf1e-combat-tracker:campaigns:v1— your list of campaigns.pf1e-combat-tracker:c:<id>:…) holding that campaign’s live combat snapshot, saved party, saved encounters, and active live-share link token — so a page reload loses nothing.pf1e-combat-tracker:sync-pending:v1 and pf1e-combat-tracker:deleted-campaigns:v1— bookkeeping for cross-device sync: which of your edits our database hasn’t confirmed yet, and which campaigns you deleted while offline so the deletion still happens when you’re back. Both hold campaign identifiers only, never their contents.pf1e-combat-tracker:active-campaign— which campaign you have open. This one is session storage, so your browser discards it when the tab closes.Five providers are involved in operating the app:
The Service is not directed to children under 13, and we do not knowingly collect personal information from children. If you believe a child has created an account, contact us and we will delete it.
You can update or delete your account at any time from the account menu inside the app, or by emailing us. Deleting your account removes your data from Clerk, and we are notified so that everything synced to it — your campaigns, party rosters, saved encounters, any combat checkpoints, and any live share still running — is deleted from our database too. Stripe retains billing records for as long as financial regulations require.
You don’t have to delete your whole account to remove data: deleting a campaign inside the app removes its synced prep and any saved checkpoint from our database as well as from your device, and stopping a live share deletes its snapshot at once. You can also email us and ask. Your live combat data lives only in your browser, and clearing the site’s storage erases it.
Who is responsible. PF1e Combat Tracker is operated by Vibing Legends Ltd, a company registered in the United Kingdom (company number 17363538), registered office 52 Barrow Point Avenue, Pinner, HA5 3HG, United Kingdom. Vibing Legends Ltd is the controller of the data described here for the purposes of the UK GDPR and the Data Protection Act 2018. Privacy questions and requests go to pf1ecampaigner@gmail.com, and we aim to answer within 30 days.
Why we may process your data. Account data, subscription status, and the campaign prep and checkpoints you sync are processed to perform the contract you enter into by subscribing. Request logs and abuse limits are processed on our legitimate interest in keeping the Service available and secure. We do not process your data for advertising or profiling, and we do not sell or share it in the sense used by California law.
Where it goes.We are based in the UK, and the providers listed in section 4 are US-based, so your data is transferred to and processed in the United States. Those transfers rely on each provider’s own data-processing terms, which incorporate the safeguards UK law requires for international transfers; their privacy policies are linked above.
How long we keep it. Account and synced campaign data are kept while your account exists and are removed when you delete it (section 6). Live-share snapshots are transient (section 1). Support emails are kept as long as needed to handle the conversation. Stripe retains billing records for as long as financial regulations require.
What you can ask for.You have the right to access the data we hold about you, correct it, delete it, receive a copy in a portable format, object to or restrict certain processing, and withdraw consent where we relied on it. Exercising any of these costs nothing and will never affect your subscription. If you think we have got something wrong you can complain to the UK’s Information Commissioner’s Office (ico.org.uk), or to your own supervisory authority if you live in the EU or EEA — though we would rather you told us first.
We may update this Privacy Policy from time to time. Material changes will be surfaced on this page and the “Last updated” date at the top will be revised.
For privacy questions, email pf1ecampaigner@gmail.com.