Privacy Policy

We collect the following categories of information:

• Account information. When you create an account we collect your email address, a hashed password, and optionally a display name and avatar.
• Game data. The campaigns, bastions, facilities, turns, events, achievements, custom content, and other data you create in the app.
• Subscription & purchase data. If you upgrade to BastionForge Premium or make a donation (and, in the future, if you purchase any optional content packs we may offer), our payment processor (Stripe) handles your card details. We receive a customer identifier, subscription status, and the amount and currency of the transaction. We never see or store your full card number.
• Device & technical data. Standard logs such as IP address, device type, OS version, app version, and basic crash/error diagnostics.

• To provide, operate, and maintain the Service.
• To sync your campaigns and bastions across your devices and with party members you have invited.
• To process subscriptions, content pack purchases, and donations.
• To respond to support requests and communicate service notices.
• To diagnose bugs, prevent abuse, and improve the Service.

We do not sell your personal information.

BastionForge relies on the following third-party providers, each of which has its own privacy policy:

• Supabase — authentication, database, and storage for your account and game data. Hosted on AWS in the US East (North Virginia) region.
• Stripe — payment processing for subscriptions and donations. Operates globally with primary processing in the United States.
• Vercel — hosting for the website at bastionforge.app and the web app at app.bastionforge.app.

BastionForge is collaborative. When you join a campaign, the campaign's Dungeon Master and other players can see information you contribute to that campaign — including your display name, the bastions you create, the turns you run, and the events your bastion experiences. Co-owners you add to a bastion can view and edit that bastion. Do not put information in the app that you do not want your party to see.

We retain your account and game data for as long as your account is active. You can request deletion of your account and associated data at any time by emailing support@bastionforge.app. We will delete your data within 30 days of receiving a verified request, except where retention is required by law (for example, tax records related to purchases).

We use industry-standard measures to protect your data, including encryption in transit (HTTPS), encrypted storage at rest with our providers, hashed passwords, and row-level security in our database. No system is perfectly secure, and we cannot guarantee absolute security.

BastionForge is not directed to children under 13 (or under 16 in the EEA/UK). We do not knowingly collect personal information from children. If you believe a child has created an account, please contact us and we will delete it.

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, email support@bastionforge.app.

BastionForge is operated from Quebec, Canada. Your personal information is stored and processed on servers located in the United States — primarily AWS US East (North Virginia) via Supabase, with payment processing handled by Stripe (United States) and website hosting by Vercel (United States). By using the Service, you consent to your personal information being transferred outside of Quebec and Canada.

We do not make decisions about you based solely on the automated processing of your personal information. If this changes in the future, we will update this Policy and notify affected users.

The BastionForge website and web app use a small number of technologies to store information on your device:

• Authentication cookies and tokens set by Supabase to keep you signed in across sessions.
• Local storage used to cache your campaigns and bastions for offline access and to remember your onboarding progress.
• Stripe sets cookies on its checkout and customer portal pages for fraud prevention and session continuity.

We do not use advertising cookies or third-party analytics trackers.

The person responsible for the protection of personal information at BastionForge is our Privacy Officer. You can reach the Privacy Officer at support@bastionforge.app for any questions about this Privacy Policy or to exercise your rights under applicable privacy laws, including Quebec's Act respecting the protection of personal information in the private sector (Law 25).

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top and, for material changes, notify you in the app or by email.

Questions about this Privacy Policy? Email us at support@bastionforge.app.