Privacy Policy

Role Call is operated by Framework and Fable LLC (a Washington limited liability company), doing business as Role Call ("Role Call," "we," "us," or "our"). We operate the websites at rolecall.games and rcg.gg, the Role Call web application, and our official browser, Obsidian, and Foundry VTT integrations (together, the "Service").

This Privacy Policy explains what personal information we collect, how and why we use it, who we share it with, how long we keep it, and the rights and choices you have. We believe in plain language — no buried clauses. If anything here is unclear, email us at your_familiar@rolecall.games.

Role Call is intended only for people 18 years of age or older (see "Children's Privacy" below). By using the Service, you acknowledge the practices described in this policy.

• We collect what we need to run a group finder and GM toolkit: your account, your profile, the content you create, and how you use the Service.
• We do not sell your personal information, and we do not use it for cross-site advertising.
• We share data with a small set of vetted service providers (payments, email, hosting, analytics, error monitoring, spam protection) and with other users when you choose to be discoverable or to transact.
• Your data lives on servers in the United States.
• You can access, correct, export, or delete your data at any time — see Your Privacy Rights.

Account Information

When you create an account, we collect:

• Email address — identifies your account and is used for transactional email.
• Password — if you sign up with a password, it is stored only as a salted bcrypt hash, never in plain text.
• Google OAuth data — if you sign in with Google, we receive your email address and a Google account identifier.
• Discord OAuth data — if you connect Discord, we receive and store your Discord user ID, Discord username, an access token, and the list of Discord servers ("guilds") your account belongs to, so we can offer Discord-based features such as availability polls. You can disconnect Discord at any time.
• Terms acceptance — the date and version of the Terms of Service you accepted.

Profile & Gameplay Content

Information you choose to provide as you use the Service, including:

• Your username, display name, avatar, and profile details.
• Player and GM preferences — game systems, playstyle, availability, tone, genres, locales, commitment level, and similar matchmaking signals.
• Optional self-described attributes you add to your profile or group (for example, marking a group as beginner-friendly or LGBTQ-friendly). You decide whether to provide these; some may reveal information you consider sensitive, so share only what you're comfortable making visible to people you may be matched with.
• Content you create: game and group listings, character sheets and answers, campaign prep, scenes, locations, NPCs, notes and imported note vaults, quests, chronicles, adventures you author, reviews, and uploaded images and files.
• Messages and posts: direct messages to other users, group posts, availability-poll responses, surveys, and feedback you submit.

Payment & Seller Information

Payments are processed by Stripe using Stripe Checkout. We do not collect or store full card numbers or card security codes on our servers. We retain transaction records — such as amounts, platform fees, Stripe identifiers (checkout session and payment IDs), purchase/ownership records, and refund status — to operate the marketplace, provide receipts, and meet tax and accounting obligations.

If you sell on Role Call (as a GM, artist, or adventure author), you onboard through Stripe Connect. Stripe collects the identity, bank, and tax information needed to pay you and to comply with financial regulations; that information is governed by Stripe's privacy policy. We store your Stripe connected-account identifier, your account status (whether charges and payouts are enabled), and payout and fee amounts. See our Marketplace Terms for how the marketplace works.

Communications

When you contact us, submit a data request, or send feedback, we collect the information in your message (such as your name, email, and the contents of your request) so we can respond and keep records of the request.

Usage, Log & Device Data

When you use the Service, we and our providers automatically collect technical data such as your IP address, browser and device type, pages and features used, referring pages, and timestamps. We use PostHog for product analytics. Our PostHog analytics run server-side and do not set a browser analytics cookie; however, events are associated with your account (identified by your email address) rather than being fully anonymous. We use this to understand and improve how the Service is used. We do not sell this data or use it for advertising.

Diagnostic & Error Data

To keep the Service reliable, we use error-monitoring tools (Sentry, PostHog, and Google Cloud Error Reporting) that record diagnostic information when something goes wrong — including the error, technical context, and limited account context (such as your user ID or email) to help us identify and fix the problem.

Integration Data

If you use our Obsidian or Foundry VTT integrations, you generate a game-scoped plugin token that authorizes the integration. The Obsidian integration uploads the vault content you choose to send to your game; the Foundry integration reads your game's scenes and member list. We process this content to provide those features.

We use personal information to:

• Create, secure, and manage your account, and authenticate you.
• Provide the Service — matchmaking and player/GM connections, group and game management, GM prep tools, and integrations.
• Process payments, payouts, refunds, and fees for paid games, sessions, commissions, and adventures.
• Send transactional and service messages (session confirmations, receipts, security and account notices, and updates you've asked for). You can manage non-essential notifications in your settings.
• Maintain safety and integrity — preventing fraud, abuse, and spam, and enforcing our Terms of Service and Community Guidelines.
• Understand and improve the Service through analytics and diagnostics.
• Comply with legal obligations and respond to lawful requests.

For users in the EEA/UK, our legal bases are: performance of a contract (providing the Service you signed up for), legitimate interests (securing and improving the Service and preventing abuse), consent (where we ask for it, such as optional communications — you can withdraw it at any time), and legal obligation (such as tax and accounting record-keeping).

We do not sell your personal information. We share it only in these situations:

• With other users — information you make discoverable (your public profile, game and group listings, reviews, posts) is visible to other users. When you transact or join a game, the relevant counterparties (for example, a GM and the players in a game, or an artist and their buyer) can see the information needed to coordinate, such as your username and the details of the transaction. Direct messages are visible to the participants in the conversation.
• With service providers (subprocessors) who process data on our behalf to run the Service — see the table below. They are permitted to use the data only to provide their service to us.
• For legal and safety reasons — to comply with law or valid legal process, to enforce our terms, or to protect the rights, safety, and property of our users, the public, or us.
• In a business transfer — if Role Call is involved in a merger, acquisition, financing, or sale of assets, your information may be transferred as part of that transaction, subject to this policy.

We rely on the following third-party providers. Each has its own privacy policy governing its handling of data:

• Stripe — payment processing and seller payouts (Stripe Connect). Privacy Policy
• Google Cloud — application hosting, file storage, and error reporting (United States). Privacy Notice
• Google — optional "Sign in with Google" login. Privacy Policy
• Discord — optional account connection and server features. Privacy Policy
• PostHog — product analytics and error capture (server-side; identified by account email). Privacy Policy
• Sentry — application error monitoring. Privacy Policy
• Resend — transactional email delivery. Privacy Policy
• Cloudflare Turnstile — bot and spam protection on our forms (processes IP and interaction signals). Privacy Policy

We keep this list current as our providers change. See our Cookie Policy for details on cookies set by some of these providers.

We use a small number of strictly necessary cookies to keep you logged in and to protect our forms, and certain providers (such as Stripe and Cloudflare) set cookies when you use payment or verification features. We do not use advertising or cross-site tracking cookies. See our Cookie Policy for the full list.

We keep your personal data for as long as your account is active and as needed to provide the Service. If you delete your account, we delete or de-identify your personal data within 30 days, except where we are required or permitted to retain certain records — for example, transaction and tax records (which we may retain for the period required by law), and information needed to resolve disputes, prevent fraud and abuse, or enforce our agreements.

Residual copies may persist in encrypted backups for a limited period before being overwritten on our normal backup rotation. Content you shared with others (such as messages or reviews) may remain visible to those recipients.

We use reasonable technical and organizational safeguards to protect your information, including encryption in transit (HTTPS), hashed passwords, scoped access controls, and bearer-token authentication for integrations. No method of transmission or storage is 100% secure, so we cannot guarantee absolute security. If we become aware of a breach affecting your personal data, we will notify you and the relevant authorities as required by applicable law.

Role Call is operated from, and stores data in, the United States. If you access the Service from outside the United States, you understand that your information will be transferred to, stored, and processed in the United States, where data-protection laws may differ from those in your country. Where required, we rely on appropriate safeguards (such as the EU Standard Contractual Clauses) for international transfers.

Depending on where you live, you may have some or all of the following rights:

• Access — request a copy of the personal data we hold about you.
• Correction — ask us to correct inaccurate or incomplete data.
• Deletion — ask us to delete your personal data.
• Portability — receive your data in a portable, machine-readable format.
• Objection / Restriction — object to or restrict certain processing.
• Withdraw consent — where we rely on consent, withdraw it at any time.

To exercise any of these, use our Personal Information Request page or email your_familiar@rolecall.games. We will respond within the time required by applicable law (generally within 30–45 days). We may need to verify your identity first, and we will not discriminate against you for exercising your rights.

EEA/UK residents: you also have the right to lodge a complaint with your local data protection authority.

California residents (CCPA/CPRA): in the past 12 months we have collected the categories of personal information described in "Information We Collect" (identifiers, account and profile information, commercial/transaction information, internet and usage activity, and content you provide), for the purposes described in "How We Use Your Information," and disclosed them to the service providers listed above. We do not sell or share your personal information as those terms are defined under California law, and we do not knowingly process the personal information of consumers under 16 for sale or sharing. You have the right to know, delete, correct, and opt out of any sale/sharing (not applicable here), and to be free from discrimination for exercising these rights. You may use an authorized agent to submit a request.

Other U.S. state residents (including Virginia, Colorado, Connecticut, Utah, Texas, and others with comprehensive privacy laws) have similar rights to access, correct, delete, and obtain a copy of their data, and to opt out of targeted advertising or sale (which we do not do). Submit requests the same way.

Because we do not sell or share personal information or perform cross-site tracking, browser "Do Not Track" and Global Privacy Control (GPC) signals do not change what we collect. We will treat a valid GPC signal as an opt-out request where applicable law requires.

The Service is intended for adults. You must be at least 18 years old to use Role Call. The Service is not directed to children, and we do not knowingly collect personal information from anyone under 18. If we learn that we have collected personal information from a person under 18, we will delete it and terminate the account. If you believe a minor has provided us personal information, contact your_familiar@rolecall.games.

The Service may link to or interoperate with third-party sites and services (such as Discord servers, artists' external portfolios, or Foundry VTT). We are not responsible for the privacy practices of those third parties; their own policies apply.

We may update this policy from time to time. If we make material changes, we will notify you by email or by a prominent notice on the Service before the change takes effect. The "Last updated" date at the top reflects the most recent revision. Your continued use of the Service after an update means you acknowledge the revised policy.