Privacy

Last updated 6 October 2026

This page explains what Gansos VTT stores about you, why, and how to delete it. In short: only what's needed to run your games, nothing is sold, and you can delete everything yourself at any time.

What we store

• Your account: the id, name and avatar picture link that Discord or Google sends when you log in (we ask for nothing else: no email address, no friends list), the display name you choose, and your preferences (dice colours, call quality).
• Your games: the campaigns you run or join, and what's in them: scenes, tokens, maps, characters, initiative, NPCs, monsters, content packs and Spotify playlist presets.
• Your notes: private notes you write on a character. Only you can read them.
• Images you upload (maps and token portraits), with a record that you uploaded them, which counts toward your storage quota.
• A login cookie that keeps you logged in for 30 days. It's the only cookie we set (plus a short-lived one during login itself). There are no advertising or analytics cookies.

What we don't store

• Video and audio. The call goes directly between the players' browsers (peer-to-peer). It never passes through our server and is never recorded. To find a route between players, browsers contact public "STUN" servers run by Google and Twilio, which see your IP address.
• Chat. The last 100 messages of a table are kept in the server's memory so people who join late can catch up, and are gone when the server restarts.
• Your Discord or Google password or tokens. Login uses them for a moment and discards them.

Other services

• Discord and Google handle login, under their own privacy policies.
• Spotify: if a DM connects Spotify to a campaign, we store that connection's access tokens (encrypted) so the ambiance music keeps playing. It's the DM's own Spotify account; players connect nothing.
• D&D Beyond: importing a character fetches that character's public page from D&D Beyond and stores a copy of its sheet in the campaign.
• Turso hosts the database where all of the above is kept.

Who can see what

Everyone in a campaign sees its table, chat, and the display name and avatar of everyone else at it. The DM also sees things players don't (hidden tokens, NPC stats). Your notes are yours alone. Nobody outside a campaign can see anything in it.

Deleting your data

On your dashboard, Delete account permanently removes your account, every campaign you run with everything in it, your notes in other campaigns, and the images you uploaded. Leaving a campaign removes you from it. Deleting a campaign removes everything in it. Copies in the database host's backups expire on their normal schedule.

Contact

Questions or requests about your data: CONTACT_EMAIL.