Privacy Policy.

1. Who We Are

Dexes is a browser-based story and world-building application operated by Kevin Herr. This Privacy Policy explains how we collect, use, and protect your personal data when you use Dexes.

If you have questions about this policy, please contact us at the address listed at the bottom of this page.

2. Data We Collect

We collect the following categories of personal and user-generated data:

• Account information: your display name, email address, and profile picture from your Google account, obtained when you sign in with Google.
• User-created content: all creative content you create within the app, including worlds, stories, characters, groups, items, locations, nations, maps, ideas, timeline entries, codex data, and written Tomes (books/short stories organized into chapters and pages, including any tags or custom properties you attach to them), stored in Firebase Realtime Database.
• Uploaded images: image files you upload to the Image Library or attach to maps, characters, items, locations, and other entities. Files are stored on our web server under a path keyed to your user ID.
• Stock image preferences: Dexes also provides a shared catalog of stock images available to all users. These images are not personal data. The only personal data associated with the catalog is your own list of hidden stock images (which entries you've chosen to hide from your view), stored under your user ID.
• Patreon membership data: if you connect a Patreon account, we store your Patreon patron ID, linked Firebase UID, current membership tier, and (if applicable) a grace-period expiry timestamp. This data is received via Patreon's OAuth and webhook systems and stored in Firebase Realtime Database. We do not store your Patreon access token or payment details.
• Collaboration data: if you are invited to a story owned by someone else, the invitation (your email address, the story, the role offered and who sent it) is held until you accept or decline it. If you accept, your display name is stored in that story’s membership record, with your role and the dates you were invited and joined, so its owner and members can see who has access. Your email address is not stored there: only the owner is shown it, read from your account. If you own a story you have shared, your display name is stored on it so the people you shared with can see who it came from. See Section 6.
• Scheduling data: on a tabletop story, the play dates its owner or co-GMs set, and for each one your answer (going, maybe, or can’t) with any note you add, stored with the story. Your chosen time zone is stored on your account. Notices about sessions you are part of are queued on your account until you dismiss them or open the page. If you ask for a calendar link to a story’s sessions, a random token is stored for it, with which story and account it belongs to; the link is private to you and works only while you are a member. If you link a calendar you keep elsewhere, we store its address, a label you give it, when it was last read and whether that worked, and the start and end times of its busy periods for the next 90 days; we never read or store an event’s title, location, description or attendees. If you connect a Google account instead, we store, encrypted, the token Google issues that lets us ask whether your primary calendar is busy, and the same start and end times; we cannot read the events themselves, and disconnecting deletes the token and asks Google to revoke it.
• Invitations: if someone invites an email address to a story, whether or not it has a Dexes account, we store that address, the story, the role offered, who sent it and the date, so the person can accept or decline it. The address is supplied by the story owner and is used for one thing beyond matching the invitation: a single email telling the person they are invited, described in Section 3. It is deleted as described in Section 8.
• Waiting list: while free accounts are limited, signing in for the first time may place you on a waiting list instead of opening an account. We then store your email address, your display name and the time you joined, so that places can be given out in the order people asked for them. We use the address to send you two emails: one confirming your place in line, and one when a place is yours. We send nothing else to it.
• Usage metadata: the date and time you last signed in, and a record of your consent to these policies.
• Mailing list preference: if you choose to join our mailing list, we store whether you opted in, the date and time you last changed that setting, and where you changed it (the consent screen or your Profile). Joining is optional and is never required to use Dexes. The emails themselves are sent to the address on your Google account, which we already hold as account information; we do not store a separate mailing address.
• Server activity logs: when you use a feature that goes through our web server (for example uploading or deleting images, exporting or importing a story, sharing a story or answering an invitation, linking a calendar, deleting your account's uploaded files, or linking/unlinking Patreon), the server records a log entry containing your user ID, email address, the action performed, and basic technical metadata such as file names, file sizes, and world identifiers. These logs never contain your creative content.
• Feedback submissions: if you use the in-app "Send Feedback" form, we store the message you write together with your user ID, email address, the page you were on, the identifier of the world you had open, and your browser version, so we can investigate the report and follow up with you. Feedback reports are also forwarded to our development issue tracker (see Section 5).
• Technical data: browser storage used to keep you signed in and to remember your preferences, and, only if you allow it, the cookies Google Analytics sets (see Section 4).

We do not collect payment information, sensitive personal data, or data about your activity outside of Dexes.

3. How We Use Your Data

Your data is used solely to provide the Dexes service:

• To authenticate you and maintain your account.
• To store and display your creative content across devices.
• To enable features such as timeline management, map editing, image library, and codex search.
• To determine your subscription tier and enforce storage limits.
• To let you share a story with other people and to enforce who may see and edit what, including sharing specific content with specific players (Section 6).
• To apply your saved display preferences and restore your interface state between visits.
• To record your acceptance of these policies as required for legal compliance.
• To tell someone that a story owner has invited them, by one email to the address the owner typed, saying who invited them, to which story and in what role. No invitation is emailed twice, and each account can have at most 30 sent a month.
• To tell the members of a tabletop story about its play sessions, by a notice in the app and, if email is enabled, by email: proposed times, a session set, changed or cancelled, a reminder before one, and, for a GM, that everyone has voted. Each kind of email can be switched off under Preferences in your profile; the notices in the app come either way.
• To send you occasional news about new features and major updates, but only if you have opted in to our mailing list. We do not sell, rent, or share your email address, every message includes an unsubscribe link, and you can turn the mailing list off at any time from the Profile menu without affecting your account.
• To maintain security and provide support: server activity logs (Section 2) help us investigate account issues, reports of abuse, and data-loss reports.

We do not use your data for advertising, profiling, or sale to third parties.

4. Cookies & Local Storage

Dexes stores the following in your browser:

• Authentication: Firebase keeps you signed in by holding your session in this browser’s own storage (IndexedDB), not in a cookie. Signing in with Google opens a Google window, which uses Google’s own cookies under Google’s terms. Connecting Patreon, or a Google account for scheduling, sets a short-lived cookie on our server for that one sign-in step.
• Preferences: Display settings (such as the Tome editor's serif-font toggle) are stored in local storage so they persist across page loads.
• World and map context: The currently open world and map are cached in local storage and in Firebase to ensure they are restored after page refreshes or navigation.
• UI state: Map pan/zoom, timeline day selection, section collapse state, and favorites lists are stored in local storage to restore your view when you return to a page.
• Analytics, only if you allow it: your first visit asks whether Dexes may count your visits. Until you answer, and after you say no, no analytics code is loaded and no analytics cookie is set. If you allow it, Google Analytics sets cookies (names beginning with "_ga") to measure aggregate usage (see Section 5), kept no longer than your consent. Your answer is remembered in this browser for 13 months and then asked again.

Sign-in, preference and interface storage is never shared with third parties or used for advertising. Analytics cookies are used solely for the aggregate usage measurement described in Section 5, never for advertising or profiling.

You can change your analytics choice at any time, here or under Preferences in your Profile: Change my analytics choice Withdrawing deletes the analytics cookies, and the pages you open after that load no analytics at all.

5. Third-Party Services

Dexes is built on Google Firebase (Authentication and Realtime Database). Your account and content data are stored on Firebase infrastructure operated by Google LLC. Google's use of data in connection with Firebase is governed by Firebase's Privacy and Security documentation and Google's Privacy Policy.

With your permission (Section 4), Dexes uses Google Analytics to understand how the app is used in aggregate: which pages are visited, how often, and from what general kind of device and region. Each page’s address is sent without the part after its “?” or “#”, which on a story’s pages identifies the story, and each page is named by a fixed title rather than its own, so no story or account identifier reaches Google. IP anonymization is enabled, Google signals and ad personalisation are switched off, and we do not send your name, email address, or any of your world content to Analytics. This data is used only to improve Dexes and never for advertising.

Google's processing of Analytics data is governed by Google's Privacy Policy; you can opt out of Google Analytics on all websites using the Google Analytics Opt-out Browser Add-on.

If you connect a Patreon account, your membership tier is retrieved from Patreon's API and webhook system. Dexes receives only your patron ID, email address (for account matching), and entitled tier information. Patreon's data practices are governed by Patreon's Privacy Policy.

Google Fonts serves the Fraunces, Outfit, Lora, Uncial Antiqua, Eagle Lake, and Almendra SC typefaces. Google Fonts CDN requests may be logged by Google; see Google's Privacy Policy.

Font Awesome icons are loaded via CDN. Font Awesome's CDN may log request metadata; see Font Awesome's Privacy Policy.

The html2canvas (Map Export to PNG), JSZip (story export/import), and Cytoscape.js (relationship graph) libraries are loaded on demand from CDNs. They run entirely in your browser and send none of your data to any server; the CDNs may log the standard network request for the library code itself.

Emails from Dexes (the waiting-list emails described in Section 2, and the invitation and session emails described in Section 3) are sent through Resend, an email delivery service. Resend receives the recipient's email address, the message and the delivery details needed to send it, and processes them on our behalf; see Resend's Privacy Policy.

Feedback you submit through the in-app "Send Feedback" form is forwarded to GitHub (GitHub Issues), the privately-hosted issue tracker we use to manage Dexes development. The forwarded report contains your message, user ID, email address, and the technical context described in Section 2, and is visible only to the Dexes developer. GitHub's processing of this data is governed by GitHub's Privacy Statement.

The CodeMirror 6 text-editing library (the editor of Tome pages, notes and map text boxes) is served from our own server, so loading it involves no third party.

Backups. Two services are involved in taking and storing our backups. GitHub Actions runs the scheduled backup job: a temporary virtual machine exports your database records, account records, and uploaded files, encrypts them, uploads the result, and is then destroyed. Your data is present on that machine only for the few minutes the job takes, and is not retained by GitHub afterwards. Backblaze B2 (Backblaze, Inc., United States) then stores the encrypted result. Because the encryption happens before upload, Backblaze holds only encrypted data and cannot read your content. Backups are used solely to restore data after loss or corruption, and never for analysis, profiling, or any other purpose. GitHub's processing is governed by GitHub's Privacy Statement and Backblaze's by Backblaze's Privacy Policy.

If you connect a Google account for scheduling, Dexes asks the Google Calendar API only whether your primary calendar is busy, under a permission limited to that, and stores the token Google issues encrypted on our side. You can withdraw the permission on the Sessions page or in your Google account at any time.

6. Sharing and Collaboration

You can invite other people into a story you own. Doing so moves personal data between accounts, so it is worth being precise about what.

• What the story owner learns about you: when you are invited, nothing beyond the address they typed. You are invited by email address, so they already know it, and Dexes gives the same answer whether or not that address has an account. Once you accept, the owner sees your display name, and your email address read from your account, in their sharing dialog; the other members see your display name, never your address.
• Nothing until you accept: an invitation gives nobody access to anything and shares nothing about you. You join only by accepting it, in your library, which says who sent it and the role it offers. Until then you are not on the story: its members cannot see you, your calendar’s busy times reach nothing, and no session email is sent to you.
• What you learn about the owner: a story shared with you shows the owner’s display name.
• What the other people can see: that depends on the role the owner gives you. A co-GM can read and edit everything in the story, including content marked GM-only. A player sees the story’s shared content, plus anything the owner has chosen to share with them specifically, and can edit a character sheet assigned to them. An observer has read-only access to shared content.
• Content you add to someone else’s story is stored in that story, under the owner’s account. The owner and other members can see it, and it stays with the story if you leave.
• Sessions: on a tabletop story, your answers to its play dates and your availability, including the busy periods of a calendar you have linked, are visible to the story’s other members, its owner and co-GMs included, since agreeing a time is what they are for. A linked calendar’s address is visible to nobody, not even shown back to you.
• Per-player sharing: a story owner can share individual objects, map content, or whole maps with named players rather than the whole group. This controls what each player’s copy of the app displays and what their account is permitted to read.

Invitations. A story owner can invite any email address, with or without a Dexes account. We hold the invitation (the address, the story, the role offered and who sent it) until it is accepted or declined, the owner withdraws it, or it lapses after 90 days (Section 8). We do not email the address. If you have no account yet, the invitation is waiting the first time you sign in with that address, and lets you past the waiting list; if you have one, it waits in your library. Declining it, or ignoring it, changes nothing about your account.

The owner of a story controls access to it: they can change your role or remove you at any time. You can leave a story at any time from the Stories page, which removes your membership and your access.

We do not use sharing to move your data anywhere else. Nothing is shared with anyone outside the story you were invited to, and inviting someone does not give them access to your account, your other stories, or your personal image library.

7. Administrative Access

Authorized administrators of Dexes (currently limited to the operator, Kevin Herr) have access to an internal administration tool used for account support and moderation. Through this tool, an administrator can:

• View account-level information such as your email, sign-in history, subscription tier, and ban status.
• Open a read-only view of a world's content (characters, maps, items, and other codex data) strictly to investigate a support request or a report of abuse. This view is clearly labeled as an administrative session and cannot be used to modify your data.
• Ban an account found to violate these Terms, or apply a subscription-tier override in connection with support requests.
• Initiate account deletion in cases of Terms violations. Administrator-initiated deletion applies a 7-day grace period, during which the account is suspended but not yet deleted, before your data and uploaded files are permanently removed and your Google account's access to Dexes is revoked.

All administrative actions are logged, including who performed the action, when, and why. Administrative access is not used to browse or monitor user content outside of a specific support or moderation need.

8. Data Retention

Shared stories. Leaving a story, or being removed from one, ends your access and deletes your membership record and the display name it held. Your availability and any linked calendar’s busy periods are removed from that story too, within a day; your answers to its sessions stay with the story’s record of them. Content you added to that story remains part of it, because the story belongs to its owner.

Your account data is retained for as long as your account is active. Free-tier accounts that have had no sign-in activity for 12 consecutive months are considered inactive and subject to permanent deletion. Paid Patreon subscribers (Copper tier and above) are not subject to inactive-account deletion for as long as an active pledge is detected.

You can also delete your account at any time from the Profile menu within the app. Deletion removes your Firebase database records (worlds, maps, characters, codex data, ideas, timelines, Tomes, and all related data) and your uploaded image files from our server. This process is initiated client-side and takes effect immediately.

Self-service deletion does not delete your sign-in record (the account Firebase keeps for your Google sign-in), so you can sign back in and start afresh. Nor does it delete your account’s flags (such as a ban, or a subscription tier we have set) or your Patreon link (your patron ID and tier), which only our server can change and which keep a paid tier attached to a pledge you still hold. Your Google account itself is not affected. To have these deleted as well, ask us at the address at the bottom of this page, and we will delete the account in full as described in Section 7.

Accounts deleted by an administrator under Section 7 are removed after the 7-day grace period described there. Unlike self-service deletion, this also revokes the account's access to sign in to Dexes.

Demo sandbox worlds created through the one-time demo offer are automatically and permanently deleted 30 days after creation, as stated when the demo is offered.

Your mailing list preference (Section 2) is retained for as long as your account exists and is deleted along with it. If you opt out, we keep the record of that choice while your account exists so that the preference continues to be honored.

Server activity logs (Section 2) are retained for up to 90 days and then automatically deleted.

Sessions and your answers to them stay with the story and are deleted with it, or with your account. Session notices queued on your account are deleted when you dismiss them or open the page they point at. A calendar link ends when you turn it off, when you leave the story, or when the story or your account is deleted. A linked calendar’s busy periods are replaced each time it is read and deleted, with its address, when you remove the link or delete your account. A connected Google account’s token is deleted, and Google asked to revoke it, when you disconnect it or delete your account.

Invitations (Section 2) are deleted when they are accepted or declined, when the story owner withdraws them, when the story is deleted, or when either account is deleted. One that is never answered is deleted automatically after 90 days. If you have received an invitation you do not want, decline it from your library, or ask us to delete it using the contact address at the bottom of this page.

A waiting-list entry (Section 2) is deleted when you are given a place or when an administrator removes it. If you no longer want to wait, ask us to remove it using the contact address at the bottom of this page.

Feedback submissions (Section 2) are retained until they have been reviewed and addressed; the copy forwarded to our issue tracker may be retained longer as part of the project's development history.

Backups. We take encrypted backups of the database, your account record (including the email address associated with your sign-in), and uploaded files, and keep them for up to 90 days before they are automatically deleted. This means that when you delete content or your account, it is removed from the live service immediately, but a copy may remain in an encrypted backup until that backup rotates out, up to 90 days later. Backups are restored only to recover from data loss or corruption; we do not use them to reinstate data you have deleted.

Firebase may retain anonymized system logs for a shorter period as required for security and operational purposes.

9. Your Rights

Depending on your location, you may have the following rights regarding your personal data:

• Access: request a copy of the data we hold about you.
• Rectification: request correction of inaccurate data.
• Erasure: delete your account and all associated data at any time via the Profile menu in the app, or by contacting us. See Section 7 for how administrator-initiated deletion differs. Deleting your account removes the stories you own, and removes you from every story other people invited you to, including your display name on their membership record. It does not delete the stories themselves when they belong to someone else, since those are their data, and content you added to them stays with them.
• Portability: export your creative world data as a downloadable archive (your world data as JSON, plus the uploaded images it references) using the Export Story feature on the Stories page.
• Objection / Restriction: object to certain processing or request that we restrict how we use your data.
• Withdraw marketing consent: you can leave the mailing list at any time from the Profile menu, or by using the unsubscribe link in any email. This is independent of your account: opting out stops the emails and nothing else changes.
• Withdraw analytics consent: change your choice at any time under Preferences in your Profile, or with the button in Section 4. Withdrawing deletes the analytics cookies, and nothing is sent to Google Analytics from then on.
• Withdraw consent: you may withdraw consent at any time by signing out and deleting your account. Note that withdrawal will make the service unavailable to you, as authentication and data storage are core to Dexes.

To exercise any of these rights (other than self-serve deletion and export, which are built into the app), please contact us at the address below.

10. Children's Privacy

Dexes is not directed at children under the age of 13. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has created an account, please contact us and we will delete the account promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top of this page and, if the changes are material, require you to re-accept the updated policy the next time you sign in.

12. Contact

If you have questions, concerns, or requests regarding your data or this Privacy Policy, please contact: