Privacy Policy

We collect the following categories of information:

• Account information. When you create an account we collect your email address, a hashed password, and optionally a display name and avatar.
• Game data. The campaigns, bastions, facilities, turns, events, achievements, custom content, and other data you create in the app.
• Subscription & purchase data. If you upgrade to BastionForge Premium, purchase a content pack, or make a donation, our payment processor (Stripe) handles your card details. We receive a customer identifier, subscription status, and the amount and currency of the transaction. We never see or store your full card number.
• Device & technical data. Standard logs such as IP address, device type, OS version, app version, and basic crash/error diagnostics.

• To provide, operate, and maintain the Service.
• To sync your campaigns and bastions across your devices and with party members you have invited.
• To process subscriptions, content pack purchases, and donations.
• To respond to support requests and communicate service notices.
• To diagnose bugs, prevent abuse, and improve the Service.

We do not sell your personal information.

BastionForge relies on the following third-party providers, each of which has its own privacy policy:

• Supabase — authentication, database, and storage for your account and game data.
• Stripe — payment processing for subscriptions, content packs, and donations.
• Apple App Store and Google Play — app distribution and (where applicable) in-app purchases on iOS/Android.
• Vercel — hosting for the website at bastionforge.app.

BastionForge is collaborative. When you join a campaign, the campaign's Dungeon Master and other players can see information you contribute to that campaign — including your display name, the bastions you create, the turns you run, and the events your bastion experiences. Co-owners you add to a bastion can view and edit that bastion. Do not put information in the app that you do not want your party to see.

We retain your account and game data for as long as your account is active. You can request deletion of your account and associated data at any time by emailing support@bastionforge.app. We will delete your data within 30 days of receiving a verified request, except where retention is required by law (for example, tax records related to purchases).

We use industry-standard measures to protect your data, including encryption in transit (HTTPS), encrypted storage at rest with our providers, hashed passwords, and row-level security in our database. No system is perfectly secure, and we cannot guarantee absolute security.

BastionForge is not directed to children under 13 (or under 16 in the EEA/UK). We do not knowingly collect personal information from children. If you believe a child has created an account, please contact us and we will delete it.

Depending on where you live, you may have rights to access, correct, export, or delete your personal information, and to object to or restrict certain processing. To exercise these rights, email support@bastionforge.app.

BastionForge operates globally and stores data on servers operated by our service providers, which may be located outside your country. By using the Service you consent to such transfers.

We may update this Privacy Policy from time to time. When we do, we will update the "Last updated" date at the top and, for material changes, notify you in the app or by email.

Questions about this Privacy Policy? Email us at support@bastionforge.app.