Privacy Policy

Who we are

Braosa Tales (braosatales.com, including Braosa's Atelier and The Signet) is operated by João Fidalgo Rodrigues, based in Montijo, Portugal, who is the data controller for the personal data described here. For anything about your data, email braosa.tales@gmail.com.

What we collect

• Account data — your email address, the name you give us, an optional profile picture you upload, your display preferences (such as text size) and your password (stored only as a secure hash by our authentication provider). If you sign in with Google, we receive your name and email address from Google. We don't receive your Google password or access anything else in your Google account.
• Tool data — what you create and save in our tools: generator settings, generated names, saved names, presets, generation history, your credit balance and plan.
• Payment data — if you buy a plan, payment is handled by Stripe. We never see or store your card number; we keep your plan, purchase status and the related Stripe records.
• Newsletter, waitlist and seat alerts — your email address, if you sign up, and which campaign you asked to hear about. A seat alert sends one email when a seat opens, then stops.
• Feedback — the message you send us and, if you're signed in, your name and email.
• Campaign sites — for players of our campaigns: character details, your private journal, the lore and quests you pin, and other content you or the game master add. If you link a D&D Beyond character, we read its public character sheet from D&D Beyond (name, species, class, level, hit points, ability scores and portrait) about every 30 minutes while the campaign site is in use, and keep a copy on the character.
• Technical data — basic logs (such as IP address, browser type and timestamps) kept by our hosting provider for security and to keep the service running.

Why we use it (and the legal basis)

• To create and run your account and provide the tools you use — performance of our contract with you.
• To process payments and keep records required by Portuguese tax law — contract and legal obligation.
• To send the newsletter or waitlist updates you asked for — your consent, which you can withdraw at any time.
• To keep the service secure, prevent abuse and improve it based on feedback — our legitimate interests.

We do not sell your personal data, and we do not use it for advertising.

AI generation

Some tools, such as The Signet, use AI. When you generate content, your settings and prompt are sent to Anthropic (the provider of the Claude models) to produce the result. We send only what's needed for the generation — not your password or payment details. Anthropic processes this data under its commercial terms as our service provider.

Google user data

If you choose "Continue with Google", we use Google Sign-In only to create your account and sign you in. This is exactly what happens to the data Google shares with us:

• What we access: only your name, email address and profile picture URL, through the standard openid, email and profile scopes. We do not access your Gmail, Google Drive, contacts, calendar or any other Google data, and we never receive your Google password.
• How we use it: to create and identify your Braosa Tales account, sign you in, show your name in the app and contact you about your account. Nothing else.
• How we store it: your name and email are stored in our authentication provider and database (Supabase), encrypted in transit and protected by access controls. Google's profile picture link is kept by the authentication provider as part of your sign-in record, but we never display or use it: the only picture on your account is one you upload yourself in Settings.
• How we share it: we do not sell, rent or share Google user data with third parties, do not use it for advertising, and do not use it to train AI or machine-learning models. It is only processed by Supabase to run sign-in.
• Retention and deletion: we keep it while your account is open. To delete it, email braosa.tales@gmail.com and we'll delete your account and the Google data linked to it within 30 days. You can also remove Braosa Tales' access at any time from your Google Account connections page.

Braosa Tales' use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Who helps us run the service

We share data only with providers that need it to operate Braosa Tales:

• Supabase — authentication and database.
• Vercel — website hosting.
• Stripe — payments.
• Anthropic — AI generation.
• Google — only if you choose "Continue with Google" to sign in.

Some of these providers process data outside the European Economic Area, including in the United States. Where that happens, transfers are covered by appropriate safeguards such as the European Commission's Standard Contractual Clauses or the EU–US Data Privacy Framework.

We may also disclose data where the law requires it.

Cookies and local storage

We use only essential cookies — the ones that keep you signed in. Some tools remember display preferences (for example grid or list view) in your browser's local storage. We don't use advertising or third-party tracking cookies.

How long we keep it

• Account and tool data: while your account is open. You can delete your account yourself in Account settings, which removes it straight away; or email us and we’ll do it within 30 days.
• Payment records: as long as Portuguese tax and accounting law requires.
• Newsletter and waitlist: until you unsubscribe or ask us to remove you.
• Server logs: for a short period, for security purposes.

Your rights

Under the GDPR you can ask to access, correct, delete or receive a copy of your data, to restrict or object to how we use it, and to withdraw consent at any time. Email braosa.tales@gmail.com — we'll reply within one month. You can also complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD).

Children

Braosa Tales is not intended for children under 13, and we don't knowingly collect their data. If you believe a child has given us personal data, contact us and we'll delete it.

Security

Data is encrypted in transit, passwords are stored only as hashes, and access to user data is restricted. No system is perfectly secure, but we take reasonable measures to protect your information.

Changes to this policy

If we change this policy, we'll update the date at the top. For significant changes, we'll let account holders know by email or on the site.