Soheili Labs · RPG MasterTool

Privacy and security

What this app stores, who can see it, and how it is protected. Every point below is something RPG MasterTool actually does today; nothing here describes a plan.

Last changed 19 September 2026. The same text is shown inside the app, under your account.

What an account holds

Your email address, which is how you sign in and where a reset link would go.
A display name, if you chose to give one. It is optional and you can leave it blank.
Your password — never in a form anyone can read. See below.
Nothing else. There is no profile, no address, no payment details, no phone number.

How your password is kept

It is put through scrypt with a random salt generated for your password alone, and only the result is stored.
That is one-way. Nobody at Soheili Labs can read your password, and neither can anyone who obtained a copy of the database.
Because it cannot be read back, there is no way to send you your password — a reset link is the only route in.
Sign-in attempts are rate limited, so a stolen email address cannot be used to guess at a password indefinitely.

How staying signed in works

Signing in issues a long random token and sets it in a cookie marked HttpOnly, so scripts running on the page cannot read it.
The cookie is marked Secure over HTTPS and SameSite=Lax, so another site cannot make your browser act as you.
The server keeps only a SHA-256 hash of that token, so the database does not hold anything that could be used to sign in as you.
Sessions expire, and signing out revokes yours immediately rather than waiting for it to lapse.
Changing your password through a reset link signs out every other device.

Your campaigns

Campaigns, characters, notes, session logs and dice history are stored on the Soheili Labs server and in this browser.
The browser copy is what lets the app work offline. Clearing your browser data removes that copy, not the server one.
A campaign belongs to the account that created it. Players joining by invitation get access to that campaign, not ownership of it.

Who at your table can see what

The Game Master and campaign owner see everything in their campaign, including every character sheet and its secrets.
A player sees the whole roster, but the secrets only on characters they own, and may change only their own character.
An observer can read the campaign and change nothing.
These rules are enforced by the server, not just hidden in the interface, so material a role cannot see is never sent to that device.

When we email you

Password reset links, when you ask for one.
Campaign invitations, when a Game Master invites you to their table.
That is the entire list. There is no newsletter, no marketing, and no announcement mail.
Delivery goes through Resend, which handles the sending and therefore sees the address and the message.
Your address is never sold, rented, or passed to anyone for their own use.

Turn notifications

When it is your turn, your own device can raise a notification. That uses your browser’s notification permission and nothing else.
The app treats granting that permission as your consent; there is no second setting to find.
What is announced is the turn event already shared with your table. No extra information leaves your device.
Withdraw it whenever you like in your browser’s site settings; the in-page banner still works without it.

Tracking

There are no third-party analytics, advertising, or tracking scripts in this app.
The page loads no code from any other origin, so no other company learns that you use it.
Nothing about you is shared with anyone for advertising, profiling, or measurement.

Getting your data out, and deleting it

Export downloads everything this browser holds as a JSON file you can keep or move elsewhere.
The server can also hand back everything tied to your account — campaigns, shares and your own activity — as JSON.
A campaign owner can delete a campaign, which removes its snapshot, members, invitations, events, backups and content packs.
To have your whole account removed, ask through the suggestions form on this panel; it identifies your account, so no proof is needed.

How the service itself is protected

All traffic runs over HTTPS.
Credentials for the database and the mail provider live in the server’s environment, never in the code or in anything sent to the browser.
Write requests from another origin are rejected, which is what stops a hostile page acting on your behalf.
Session tokens, reset tokens and invitation tokens are generated from a cryptographic random source and stored only as hashes.

Changes to this page

This is versioned with the app, so it changes when the behaviour it describes changes — not on its own schedule.
If something here stops matching what the app does, that is a bug worth reporting through the suggestions form.

Text messages

A Game Master may send a campaign invitation to a mobile number instead of an email address.
One message per invitation, with no follow-ups and nothing recurring.
How consent is obtained, and how to stop, is set out in full on its own page.