Privacy Policy

Who we are

TableTop DM Tools is run from tabletopdmtools.com. If you have a question about this policy or your data, write to admin@tabletopdmtools.com or use the contact page.

What we keep

• Your account. Your name, email address and a password, which is stored only as a one-way hash. Optionally a display name, a short bio, an avatar, your birthday month, your time zone and a location (a ZIP code). You choose who can see your profile and whether you appear in the players directory.
• What you create. Campaigns, characters, notes, encounters and initiative, maps, sounds and other files you upload, soundboards, friend connections, and messages you send in campaign channels and direct messages. Other people can see these only as the campaign, channel or sharing setting allows.
• Orders and subscriptions. Payments are handled by Stripe. We keep the order and subscription records and Stripe's identifiers for them. We never see or keep your card number.
• Connections you set up. A Discord webhook address, API keys for an AI provider, a Pixels dice token, and a Wi-Fi network name and password you choose to share with the DMs of your campaigns. These secrets are stored encrypted, and the Wi-Fi details are shared only if you switch sharing on.
• TVs and devices you connect. For each display: a name, a random device identifier, a pairing secret and access token, the device model and screen size, and when it last checked in. For a Bridge and the Fire TV sticks it finds: their addresses on your home network, the sticks' model and serial number, and the IR codes you teach it.
• Technical records. Your IP address and browser details appear in server logs and are used to limit abuse. To list a TV for you to connect, the site compares a keyed fingerprint of public IP addresses; the address itself is not stored for that. We use cookies to keep you signed in (see below).

The TV display app (Amazon Fire TV)

The app shows your table on a TV. To do that it sends tabletopdmtools.com:

• a random device identifier it made for itself, a pairing secret, and the access token it receives when you connect it;
• the TV's screen size and model name, so a person can tell two sticks apart in a list;
• whether sound is playing.

It does not use the camera, microphone, location, contacts or any account of yours on the TV, and contains no advertising or analytics. When a DM sends sound from a browser tab to the TV, the audio travels directly between the DM's computer and the TV over your local network; the website only passes the short connection messages. The app keeps its token and identifier on the device only. From the remote's Menu button you can make it forget the connection, and a DM can disconnect or remove a TV from the Screens page at any time.

How we use it

To run the site and the tools you ask for, to show your campaigns to the people you share them with, to take payment and deliver what you buy, to keep accounts secure and stop abuse, and to answer you when you write to us. We do not sell your personal information and we do not run advertising on the site or in the app.

Who else is involved

• Hosting. The site runs on Hostinger, which stores the data described above.
• Stripe processes payments and subscriptions under its own privacy policy.
• Discord, only if you connect a webhook: what you choose to post to that channel is sent to Discord.
• AI providers, only if you add a key and use an AI feature: the text you send to that feature goes to the provider you chose, using your own key, under that provider's terms.
• YouTube, when you play a YouTube sound or video: YouTube's player is embedded and YouTube receives the usual information a video player sends.
• Fonts. Some pages load a typeface from Bunny Fonts, which receives your IP address when it does.
• Other people. Anything you put in a shared campaign, channel or public profile can be seen by the people it is shared with.

We may also disclose information when the law requires it.

Cookies

We use a session cookie and a security (CSRF) cookie to keep you signed in and to protect forms, and a "remember me" cookie if you ask to stay signed in. We do not use advertising or tracking cookies. The TV app uses no cookies.

Your choices

• Edit or remove your profile details, and set who can see them, from your profile.
• Remove an integration, key or shared Wi-Fi network from your profile at any time.
• Disconnect or remove a TV from the Screens page, or from the TV's own Menu.
• Delete your account from your profile (it asks for your password). Deleting it removes your account and the things attached to it.
• Ask us for a copy of your data, a correction, or deletion of something specific by emailing admin@tabletopdmtools.com.

Keeping it safe

The site and the app talk only over encrypted (HTTPS) connections. Passwords are hashed, and the secrets you give us (webhooks, API keys, Wi-Fi passwords, tokens) are encrypted where they are stored. No system is perfectly secure, so please use a strong, unique password.

Children

TableTop DM Tools is not aimed at children under 13, and we do not knowingly collect their information. If you believe a child has given us personal information, email us and we will remove it.

Changes

If we change this policy we will update the date at the top. If a change affects how we use what you have already given us, we will tell you on the site or by email.