Privacy Policy

What we collect

Role by Post lets you sign in with Google Sign-In (OAuth) or with a one-time email sign-in link. With Google we receive your name, email address, and profile picture; with an email link we receive and store the email address you enter. We store your display name, avatar, and the messages, dice rolls, and channel memberships you create in the app. When you confirm you meet the minimum age, we record the date of that confirmation so we can show you meet our eligibility requirement. When you accept these terms, we record the date and the version of your acceptance.

Data controller

The data controller is Alvaro Cavalcanti — contact [email protected]. For the fastest response, use the self-serve controls in Settings → Account & Data to download or delete your data.

Where data is stored

Your data is stored in a Supabase-hosted PostgreSQL database, including the authentication records used by Google Sign-In. Push notification subscriptions (browser endpoints) are stored so we can deliver notifications you opt into.

How long we keep things

Uploaded images are kept according to the server's retention setting — indefinitely by default. Uploads are not automatically scanned. Abuse reports and images under review are kept for as long as needed for moderation and legal reporting.

How your messages are stored & who can access them

Messages are not end-to-end encrypted. They are stored on our hosting provider's database, which is encrypted at rest and in transit, but in a form our system administrators can read. We access message content only for limited purposes: operating the service, investigating user reports, enforcing our Acceptable Use Policy, and responding to lawful requests from authorities. We do not sell or share your messages with third parties for advertising.

Data transfers outside Europe

Your data is processed by our service providers in the United States. Where we transfer personal data from the EEA or UK to the United States or other third countries, we rely on appropriate safeguards, including the EU Standard Contractual Clauses and equivalent mechanisms, and we have data processing agreements in place with our providers (including Supabase and Google).

Your GDPR rights

In addition to access/portability and erasure (above), where the GDPR applies you have the right to: rectification of inaccurate data, restriction of processing in certain circumstances, objection to processing based on legitimate interests, and the right to lodge a complaint with your supervisory authority (in Ireland, the Data Protection Commission). Contact the server administrator to exercise any of these rights.

Lawful bases

We process your data on the following legal bases: performance of our contract with you (operating the service), your consent (email updates, which you may withdraw at any time), compliance with legal obligations (e.g., reporting unlawful content), and our legitimate interests (safety, security, and improving the service).

Google OAuth scopes

Sign-in uses the Google OAuth email and profile scopes. We do not request access to your contacts, calendar, drive, or other Google data. We use this information to authenticate you and display your name and profile picture inside the application. If you opt in to email updates in Settings, we also use your email address for the purposes listed there — product updates, beta invitations, and replies to feedback or reports you submit. Your email is never shared or sold, and you can opt out at any time.

Email updates

We email you only if you opt in (Settings → Email me about Role by Post), and only about product updates, beta invitations, and replies to feedback or reports you submit. Account and security notices may be sent without consent. You can opt out at any time in Settings.

Data Sharing & Third Parties

We do not sell, rent, or trade your personal information to third parties. We do not use your personal information for advertising, and we never send unsolicited marketing: the only emails you can receive are those you explicitly opted into (see Email updates above) or necessary account and security notices. Your information is shared only with the services below, and only for the purposes described:

• Supabase — our hosting and database provider. We store your account and game data here so the app works.
• Google Analytics — optional page-view statistics so we understand which screens are used. The app asks for your permission before loading it and never loads it if you decline; you can change your choice at any time in Settings, and turning it off stops all further statistics. If you allow it, it sets first-party cookies. The app sends the page address only, never your search terms, messages, or dice rolls. Google Analytics also records standard browser and device details, session counts, and an approximate location derived from your IP address. It is only available where the operator has configured it.

Google API Limited Use Disclosure

Role by Post's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

Your rights

• Access / portability: use Settings → Account & Data → Download My Data to export your profile, memberships, and authored messages as JSON.
• Erasure: use Settings → Account & Data → Delete Account to permanently delete your account and personal data. Your past messages are kept anonymously so chat history for other players is preserved.