dungeons-and-hitpoints

Dungeons and Hitpoints

Privacy Policy

Dungeons and Hitpoints — Party health, initiative, and abilities tracker

Effective date: 23 July 2026
Last updated: 23 July 2026

This Privacy Policy describes how Dungeons and Hitpoints (the “App”) collects, uses, stores, and protects information when you use it. We have built this app with a strong bias toward minimal data collection — we only handle the information required to make party tracking work.

Plain-English summary. The App does not require an account, an email address, or a phone number. Everything you enter — party names, character names, HP values, portraits — is used only to run the game and is visible to other members of the same party. We do not sell or share your data with third parties, and we do not use analytics or advertising trackers.

1. Information We Collect

1.1 Device identifier

When you first open the App, we generate a random, anonymous device identifier (a “device UUID”) and store it locally on your device. This identifier is sent to our server whenever you create a party, join a party, edit your character, or take control of a character. It is used only to associate you with the parties and characters you own inside the App.

The device UUID is not linked to your name, email address, phone number, or any real-world identity. If you clear the App’s data or reinstall the App on the same device, a new identifier is generated and your prior parties will no longer recognise you as their owner.

1.2 Information you provide

The following information is collected only when you voluntarily enter it in the App:

Display name — the name you choose when joining a party (e.g. “Player 1” or “Alice”). This is visible to other members of the same party.
Party name — the label you give a party you create. This is searchable by other users of the App.
Party password (optional) — if you protect a party with a password, we store only a cryptographic hash of that password (using the argon2 algorithm). The password itself is never stored, and even we cannot recover it if you forget it.
Character / pet / NPC data — names, current and maximum HP, temporary HP, colour, portrait image (optional, stored in an encoded form), spell slot counts, tracker names and values, and NPC stance.
Character PIN (optional) — if you protect a character with a 4-digit ownership PIN, we store only a cryptographic hash of that PIN (argon2). The PIN itself is never stored.
Timestamps — when parties and entities are created, for ordering purposes.

1.3 Information we do not collect

Your real name (unless you choose to type it as a display name).
Your email address, phone number, or physical address.
Your precise or approximate location.
Your device’s contact list, photos (other than any portrait image you explicitly choose to upload), microphone, or biometrics.
Advertising identifiers or analytics fingerprints.
Cookies (the App is a native mobile application and does not rely on cookies).

2. How We Use Your Information

The information listed in Section 1 is used solely to:

Provide the App’s core functionality: create/join parties, track HP and abilities, take control of characters, and share game state with other members of the same party.
Enforce access control — for example, verifying the party password when someone joins, or verifying an ownership PIN when someone tries to take control of a character.
Preserve the ordering, ownership, and visibility of characters, pets, and NPCs across sessions.

We do not use your information for advertising, profiling, or any purpose unrelated to running the App.

3. Who Can See Your Data

3.1 Members of the same party

All members of a party can see: the party’s name and password-protection status; every character, pet, and NPC in the party; each entity’s name, HP, colour, portrait, trackers, and spell slots; and each member’s chosen display name and role (player or DM). This visibility is a fundamental feature of a collaborative party tracker.

3.2 Non-members

Anyone with the App can search for parties by name. Search results reveal only the party’s name and whether it is password-protected — never the members or entities inside.

To view the full contents of a party (members, characters, NPCs, etc.), the visitor must know the party’s identifier (shared with them by an existing member) or find the party by name and join it — supplying the password if one is required.

3.3 Third parties

We do not sell, rent, or share your data with third-party marketers, advertisers, or data brokers. We do not embed third-party analytics, tracking, or advertising SDKs in the App.

Your data may be disclosed only when we are legally compelled to do so (for example, a valid subpoena), or when strictly necessary to protect the security and integrity of the App.

4. Passwords, PINs, and Encryption

Party passwords and character PINs are hashed on the server using the argon2 algorithm (the current recommended password-hashing function) before being written to the database. This means:

Even someone with full access to our database could not read your password or PIN in plaintext.
If you forget a party password or character PIN, it cannot be recovered — you (or the party’s Dungeon Master) will need to set a new one.

Traffic between the App and our servers is transmitted over HTTPS (encrypted in transit).

5. Data Retention

Your data is retained on our servers for as long as your parties exist. You control this retention:

You can delete individual characters, pets, or NPCs at any time from within the App.
A Dungeon Master can delete their party at any time via the party’s options menu. This permanently removes the party and every character, pet, NPC, and member record inside it.
You can leave a party at any time. Leaving removes you from the member list but preserves any characters you owned so that you can rejoin from the same device without losing progress.

We do not currently offer an automated data-purge on a fixed schedule; data persists until deleted by you or the party’s Dungeon Master.

6. Your Rights

Depending on where you live, you may have certain rights under laws such as the GDPR (European Economic Area / United Kingdom) or the CCPA (California). These include:

Access — the right to know what personal information we hold about you.
Deletion — the right to have your personal information deleted. You can exercise this directly by deleting your characters, leaving parties, or having the party’s DM delete the party.
Correction — the right to correct inaccurate information. You can edit your display name, character details, and any other information you provided directly in the App.
Objection / restriction — the right to object to or restrict certain processing.

Because the App does not collect real-world identifiers (no email, no name, no phone number), we may not be able to locate specific records tied to you outside of your device identifier and the parties you have joined. Where possible, please exercise these rights directly through the App’s built-in delete controls.

7. Children’s Privacy

The App is a tabletop-gaming utility and is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information through the App, please contact us and we will delete that information.

8. Data Location and Security

Party data is stored in a MongoDB database hosted on infrastructure we manage. We apply standard security practices — hashed credentials, encrypted transport (HTTPS), least-privilege server access, and prompt patching of known vulnerabilities — to protect that data. No system is perfectly secure; if we ever become aware of a breach that affects your data, we will notify affected users as required by law.

9. Changes to This Policy

We may update this Privacy Policy from time to time — for example, when we add new features or when the underlying laws change. When we do, we will revise the “Last updated” date at the top of this page, and, for material changes, we will provide notice inside the App.

10. Contact Us

If you have questions about this Privacy Policy or how your data is handled, please contact us at:

basilno_1@hotmail.com