Legal

Privacy Policy

Last updated: June 2026

RPG Map Editor ("we", "us", or "our") operates the website rpgmapeditor.com, the RPG Map Editor browser-based application, and associated APIs (collectively, the "Service"). We are committed to protecting your privacy and handling your personal data with transparency. This Privacy Policy details the categories of personal data we collect, our legal bases for processing, how your data is utilized and secured, retention periods, third-party disclosures, and the rights you hold under the General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

For the purposes of applicable data protection laws, RPG Map Editor acts as the Data Controller. You can contact us at [email protected] for any inquiries regarding data protection.

1. Information We Collect and Process

We collect information only when it is necessary to provide, optimize, and secure our Service. The categories of information processed include:

  • Account Registration Data: To establish an account, we collect your email address, username, and a secure Argon2 cryptographic hash of your password. Passwords are never stored in plain text.
  • User-Generated Content (Map Data): The JSON map files, scene metadata, and configuration snapshots you create and save are uploaded and stored under your authenticated account.
  • Billing and Transaction Records: For paid plans, payment processing is handled securely by Stripe. We do not store or process raw credit card numbers or billing credentials directly. Stripe provides us with tokenized payment details, subscription status, billing country, postal code, and transaction logs.
  • Technical Logs and Identifiers: When accessing the Service, our servers automatically log certain technical information, including your Internet Protocol (IP) address, browser type and version, operating system, device characteristics, request pathways, and date/time stamps. This logging is maintained strictly for security monitoring, DDoS mitigation, and server performance debugging.
  • Analytics, Advertising, and Tracking Signals: If you grant consent via our Cookie Settings, optional analytics and advertising services may collect information regarding your site navigation path, approximate geographic region (derived from IP), referral source, page interaction metrics, and advertising identifiers.

2. Legal Bases for Processing (EEA / UK Users)

If you reside within the European Economic Area (EEA) or the United Kingdom (UK), we process your personal data in accordance with the GDPR under the following legal bases:

  • Performance of a Contract (Art. 6(1)(b) GDPR): Processing of account data, map data, and transaction details is required to provide the core SaaS functionalities you request, including maintaining your account and saving your custom maps.
  • Legitimate Interests (Art. 6(1)(f) GDPR): We process technical logs and metadata to protect the security, stability, and integrity of our Service, prevent fraud, and diagnose technical errors.
  • Consent (Art. 6(1)(a) GDPR): Processing of optional analytics cookies, advertising signals, and personalized marketing signals is conducted only when you have explicitly given consent via our cookie consent banner where required.
  • Compliance with Legal Obligations (Art. 6(1)(c) GDPR): We retain transaction history, invoicing logs, and consent logs to comply with financial, tax, audit, and legal record-keeping requirements.

3. How We Use Your Data

Your personal information is processed to:

  • Authenticate and manage user accounts.
  • Save, synchronize, and load your custom battle maps.
  • Process subscription payments and manage plans.
  • Provide customer support and debug platform-level bugs.
  • Monitor server health, enforce rate limits, and mitigate malicious traffic.
  • Generate aggregate statistical analytics to improve platform usability.
  • Display context-relevant and personalized third-party ads on approved public informational pages, subject to consent.

4. Third-Party Disclosures & Subprocessors

We do not sell, rent, or trade your personal data. We disclose data to trusted service providers (subprocessors) under strict contractual terms to perform service-related tasks:

  • Infrastructure & Hosting: We utilize cloud hosting providers (e.g., Linode/Akamai, Amazon Web Services) to run our Rocket servers and host our SQLite databases.
  • Payment Processing: Financial transactions are handled by Stripe, Inc. Stripe’s privacy policy governs the processing of financial data.
  • Analytics: When configured and consented to, Google Analytics (Google LLC) registers user engagement events to help us monitor site usage. Microsoft Clarity is not loaded by the current public template.
  • Advertising Vendors: When consented to, Google AdSense and its certified advertising partners serve ads on selected public pages using cookies to personalize and measure ad metrics. Visitors in the EEA, United Kingdom, or Switzerland receive consent controls before advertising cookies are used, and Google Ad Settings may provide additional controls for Google-served ads.

5. International Data Transfers

Personal data collected within the European Economic Area (EEA) or the United Kingdom (UK) may be transferred to, and processed in, countries outside of the EEA/UK (primarily the United States). When such transfers occur, we ensure compliance with data protection laws by implementing Standard Contractual Clauses (SCCs) approved by the European Commission, or relying on adequacy decisions where applicable.

6. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes for which it was collected:

  • Account and Map Data: Retained for the duration of your active account. If you delete your account or specific maps, the data is permanently erased from our active database.
  • Technical Logs: Server traffic logs, IP addresses, and request histories are automatically rotated and deleted after 14 days.
  • Financial/Transaction Data: Kept for 7 to 10 years to comply with statutory taxation, accounting, and legal audit obligations.
  • Consent Choices: Records of your cookie and privacy choices are stored for 12 months before requiring renewal.

7. Your Rights under GDPR and CCPA

Depending on your jurisdiction (such as the EEA, UK, or California), you hold specific rights regarding your personal data:

  • Right to Access and Portability: You have the right to request a copy of the personal data we hold about you in a structured, commonly used format.
  • Right to Rectification: You can request that we correct inaccurate or incomplete personal data.
  • Right to Erasure ("Right to be Forgotten"): You can request the deletion of your account and all associated map data. You can perform this directly via the Account Settings dashboard.
  • Right to Restriction and Objection: You can object to, or request that we restrict, the processing of your data for legitimate interest purposes or direct marketing.
  • Right to Opt-Out of Sale/Sharing (CCPA): We do not sell your personal data. You have the right to opt out of the sharing of personal data for cross-context behavioral advertising by updating your preferences in the Cookie Settings.
  • Right to Non-Discrimination: We will not discriminate against you (e.g., by denying service or charging different prices) for exercising your privacy rights.

To exercise any of these rights, you can manage your settings directly in your Account Settings or submit a request to [email protected]. We respond to all verified requests within the statutory timeframe (typically 30 days).

8. Cookies and Tracking Technologies

We use cookies to enable core features and collect performance metrics:

  • Essential Cookies: Rocket uses a signed private session cookie to authenticate you. Additionally, CSRF (Cross-Site Request Forgery) tokens are generated and compared to verify that incoming state changes originate from trusted sessions. These cookies are essential and cannot be turned off.
  • Analytics Cookies: Used to analyze how visitors engage with the Service to optimize website speed and usability.
  • Advertising Cookies: Serves tailored ads, prevents ad repetition, and measures marketing campaign effectiveness.

See our Cookie Policy for detailed cookie categories. You can adjust, withdraw, or review your cookie consent preferences at any time by clicking the "Cookie Settings" link located in the footer or in your browser settings.

9. Children's Privacy

The Service is not directed to children. If you are under the age required to consent to online services in your country, you may use the Service only with permission from a parent or legal guardian. We do not knowingly collect personal data from children without the consent required by applicable law. If we become aware that a child has created an account without required consent, we will take steps to terminate the account and purge their data from our systems.

10. Third-party names and trademarks

RPG Map Editor is an independent software tool and is not affiliated with, endorsed by, sponsored by, or approved by Wizards of the Coast, Dungeons & Dragons, Roll20, Foundry Gaming, Microsoft, or any other third-party platform. All trademarks are the property of their respective owners.

11. Policy Changes

We may update this Privacy Policy to reflect modifications to our Service or changing legal regulations. Any material changes will be announced on our website home page or communicated to registered users via email before the changes become effective.

12. Contact Us

If you have questions, concerns, or wish to submit a data erasure or access request, please contact us at [email protected] or via our Contact Page.