1. Overview and Privacy Commitment
Adventure Keeper is engineered with user privacy and data sovereignty as fundamental architectural requirements. We collect strictly the information necessary to provide the service and never engage in data brokers, third-party advertising, or behavioral profiling.
2. Data Controller and Contact Officer
For inquiries, clarifications, or to exercise your rights as a data subject under applicable laws, reach out to our privacy team at privacidade@adventurekeeper.com.br.
3. Collected Data and Purposes
The following table describes the categories of data handled by the platform, operational objectives, and retention schedules:
| Category | Collected Data | Primary Purpose | Retention Schedule |
|---|---|---|---|
| Account & Access | Email address, user ID, WebAuthn credentials (Passkeys) | Secure authentication without passwords | While the account remains active |
| Campaign Lore | Campaigns, sessions, entity records [[...]], reminders, and media | Delivering the core campaign manager experience | Managed by user; portable export via .zip/.json |
| Beta Waitlist | Email (required); name and preferred RPG systems (optional) | Assessing demand and delivering preview invitations | Up to 90 days or until registration/requested removal |
| Security & Operations | Minimized technical logs of requests and error diagnostics | Service integrity and incident mitigation | Strict operational lifecycle |
4. Data Subject Rights
In alignment with privacy regulations, we empower you with direct control over your personal information:
- Confirmation and Access: inspect personal information associated with your account.
- Portability: download structured, machine-readable copies of your campaigns (.json / .zip).
- Rectification: update personal and profile details directly within the application.
- Consent Revocation: adjust communication and privacy preferences at any time.
- Permanent Deletion: irreversibly wipe your account and all associated campaign lore.
5. Permanent Deletion and Minimal Audit Records
Upon confirming account deletion, our servers trigger a cascading purge across all your campaigns, sessions, entities, and uploaded assets. Only minimal anonymized records of consumed backup recovery keys are retained without personal identifiers to prevent the unauthorized replay of obsolete copies.
6. Third-Party Infrastructure Providers
Our architecture relies on reputable cloud providers, including Vercel (static edge delivery and compute) and Supabase (PostgreSQL database with Row-Level Security). Data is never shared or monetized for commercial advertising.