Privacy
Torrii activity measurement
A visible Torrii campaign preview can record a random browser-session key and milestone times for opening the copy flow and reviewing its import. A confirmed original Torrii copy and its first recorded session start are linked to the owning account. Administrators see aggregate conversion counts; these facts contain no campaign text, referrer, IP address or user agent and do not identify a search engine or search query. Preview measurement honors browser Do Not Track and Global Privacy Control signals. Blocking scripts or changing devices can prevent preview attribution; confirmed copy and session actions can still appear in account activity totals. Anonymous preview cohorts expire after 400 days during routine cleanup. Deleting an account removes its linked activity facts. Game backups do not include this measurement.
Adults only
This service is intended for people 18 years of age or older. Accounts for anyone under 18 are not permitted. If you are under 18, do not create an account or submit personal information. We record your adult declaration, the time it was made, and the Terms version when you create an account. We do not ask for your date of birth. This declaration is private and is not shown on shared profiles or character sheets. If you believe an account belongs to someone under 18, use Report profile or contact the site operator.
Signup attribution and shared codes
We record each registered signup’s source, including a referral or profile code and its inviter when available. Referral and friend code histories remain separate. Retired codes are inactive and reserved to their original owner. That owner can explicitly restore a code; earlier lifecycle events remain recorded. Private referrals hide the inviter’s identity from recipients and create no friendship. Owners can see signup counts; administrators can review attribution. Account deletion removes the account’s own signup record and detaches its identity from retained code and referral records.
Your information
Character sheets, inventory, spells, journals, and game progress belong to the account that owns them; the limited sharing paths below determine who else can read them. When you join or host a party lobby, your display name and selected character’s encounter name, level, initiative, HP, AC, and conditions are shared with the joined party. While the lobby is open, its enabled owner-DM can also read the selected character’s saved mechanics through a limited read-only sheet, even with Private friend visibility. Other players cannot read it. Journals, private notes, account details and other characters stay excluded. Leaving or removal, changing the selected character, archiving/deleting it, closing the lobby, disabling the host’s DM controls or account expiry ends this access. Already viewed or printed copies cannot be recalled. Reading a sheet and lobby stat changes do not alter saved sheets; map-linked own-character HP/AC changes follow the separately disclosed map synchronization rules. Lobbies have no inactivity expiry; their owner can close or delete them. Invite codes allow account holders to request entry; they are not login credentials.
If you enable a character share link, anyone with that code can read its sheet statistics, equipment, spell list and feature names. Private notes, journals, history and account details are excluded. You can revoke links from the character’s Share control. All friends visibility allows every accepted connection to read the same limited sheet without a public code. Specific friends visibility limits that access to selected accepted connections. Authorized characters appear on the owner’s profile and in Friends. Removing a friendship or changing permissions ends friend access; reconnecting does not restore specific-friend permissions. Archived characters are hidden from friends. Referral codes record signup attribution without extending access. A referral also creates a friend connection only if its creator enabled that option; the signup form shows that setting. Friend codes connect registered users after confirmation. Revoking a referral or friend code ends future use of that code; existing friendships remain until removed.
Registered friends may exchange private Inbox messages and owned character inventory items. The owner Dungeon Master of a joined open party may also send messages, item gifts and inspiration awards to its registered participants, and grant inspiration directly to selected bound party characters. Mail is stored with the sender display name, recipient identity and message text; pending item gifts store their item fields until claimed or returned. Inbox mail is accessible to the addressed recipient through the application; pending items are removed from the sender’s character when sent and can only be claimed once. These Inbox records remain until deleted individually; deleting activity notifications does not clear them. An anonymous party character can receive a direct group inspiration grant but cannot receive persistent private Inbox mail. Database operators and site backups can retain stored data according to their access and retention practices.
Shared user profiles show the display name, bio, account creation date, and any optional home town or friends you choose to share. If profile details are disabled, accepted friends can still open a minimal profile with your display name, account creation date and characters explicitly shared with them; your bio, home town and friend list stay hidden.
Campaign recruitment preferences include optional ZIP codes, availability, campaign and travel preferences, expected DM session length and adventurer counts, optional character-type preferences and a DM host-location link, and private financial planning fields. Looking status and profile visibility start disabled. You can choose to show each role’s status and active nonfinancial details on your shared profile; this also requires your shared profile card to be enabled. When looking status is disabled, only the optional inactive status is shown. Shared comments are visible text, so keep pricing in the private fields. Fee structure, amounts, currency, session-zero pricing, pricing notes and per-session budgets are excluded from all shared profile views and previews. You and site administrators can inspect your complete saved submissions. Administrators can compose Inbox messages from the two recruitment tables; blocked-contact controls still apply.
When enabled by the site administrator, shared profiles can show separate DM and Adventurer rating averages and counts. For an enabled role, another registered user can submit one current 1–5 rating, update it or remove it. Both rating roles are hidden by default. Disabling a role hides its input and display while retaining prior votes. Participation is not verified. Other raters’ identities and individual votes are not displayed on your shared profile. Turning off your shared profile card hides recruitment details and ratings from other viewers, including accepted friends using the minimal character shelf. Recruitment preferences and rating records are excluded from game/character exports and are removed when their account is deleted; full database and hosting backups can retain them according to the operator’s retention practices.
Anonymous accounts use an Adventurer Code, a hashed PIN, and private session cookies. They expire after the administrator-configured period shown in the account notice. Registered users can import an active anonymous account or keep its data by signing up from that account.
The service stores email addresses and hashed passwords for created accounts, session metadata for security, and administrative activity logs. Active Sessions records the most recent visitor IP address and approximate city, region and country supplied by Cloudflare, plus the time the session was last seen. Session location and last-seen details are shown within the owning account’s security controls. Administrators can inspect the last known Cloudflare visitor IP and current session IPs for moderation. These details are not included in profiles, shared character sheets, game backups or public sitemaps. Location can be incomplete or reflect a VPN or network gateway. Details are removed when the associated session token is deleted; expired sessions are cleared by account cleanup. One last known Cloudflare IP is retained for the account after logout or session revocation and is deleted with the account. Banning an account can also block its recorded visitor IPs, affecting everyone using those addresses. IP ban records remain until an administrator removes them or unbans the associated account; deleting a banned account does not remove its IP bans. Hosting and Cloudflare logs are managed separately by the site operator. Cookies are used for login and request protection. No advertising trackers are included.
The application also stores limited activity facts for private administrator reporting: campaign creation, encounter starts and completions, successful player joins, and days with saved DM activity. These records contain the owning account ID, event type, source and time, with an opaque key to avoid duplicate counts. They exclude names, email, notes, invitation codes and shared links. They are not included in game backups or public pages and are deleted with the account. Administrators see aggregate activation and retention counts for retained accounts; hosting backups are managed separately by the site operator.
You can export your game data from Backup & Restore and delete your account in User Profile. Site administrators can manage account status and review submitted profile reports. Contact the site operator for hosting, backup-retention, or email-delivery questions.