DRAFT REVIEW — NOT YET PUBLISHED. This is an Alpha review draft for review purposes only. It is not an approved or effective policy.
Source document: https://docs.google.com/document/d/1Ej2GzLyqjb_CzwfJBiGr66qfe8M0cWXMHc_bCve-XdA
Status: Alpha review draft — not yet published.
Effective Date: [TO BE CONFIRMED BEFORE PUBLICATION]
This Privacy Policy explains how Campaign Oracle collects, uses, stores and protects personal information.
Campaign Oracle is operated by Chloe Norcross, a sole trader trading as Mosslight Created ("Campaign Oracle", "we", "us" or "our").
We are committed to protecting your privacy and handling personal information in accordance with applicable data protection laws, including the UK General Data Protection Regulation ("UK GDPR"), the Data Protection Act 2018 and other applicable privacy legislation.
By creating an account, accessing the Platform or using any Campaign Oracle services, you acknowledge that you have read and understood this Privacy Policy.
For the purposes of applicable data protection laws, the data controller is Chloe Norcross, a sole trader trading as:
Mosslight Created
49 Gordale Close
Northwich
CW8 4XT
England
United Kingdom
Email:
campaignoracle@gmail.com
We may collect the following categories of information.
When you register for an account, we may collect:
When purchasing a subscription, we may collect:
Payment card details are processed by our payment providers and are not stored by Campaign Oracle.
We may collect and store content created or uploaded through the Platform, including:
Generative AI is disabled in the Alpha. The offered Alpha features do not collect generation prompts or send campaign context to an AI provider for requested generation.
SRD monster search retrieves existing reference information rather than creating AI outputs. Content created elsewhere and uploaded by a user is handled as ordinary campaign content.
We may automatically collect:
Technical information may be processed by the hosting platform to support operation, security and fault diagnosis. Optional analytics must be identified accurately and handled according to applicable consent or exemption requirements.
Pre-publication check: confirm the actual providers, technologies, data categories, purposes and retention periods. Google Analytics has not been confirmed by this launch review and must not be described as deployed on that basis.
Information may be collected:
We may use information for the following purposes:
We process personal information under one or more of the following legal bases:
Where processing is necessary to provide Platform services.
Where processing is necessary for:
provided those interests do not override your rights.
Where you have provided consent, including:
Where processing is required by law.
No generative AI service is offered in the Alpha. Users are not asked to submit prompts or campaign context for generation, and the Alpha subscription includes no AI credits.
Base44 provides the hosting and application infrastructure. This statement concerns the Alpha's offered generation features; it does not mean that hosting, support or security providers never process data.
Before any future AI feature is enabled, we will explain its providers, data flows, purposes, lawful basis and relevant international transfers in updated privacy information. Future AI availability is not promised.
When paid billing is enabled, Stripe is intended to process the DM's annual subscription payment. Invited players register without purchasing a subscription.
Billing records may include Stripe customer and subscription identifiers, payment status, renewal/paid-period dates and cancellation status, to link billing to the correct account and manage the subscription lifecycle.
Campaign Oracle does not need full card numbers or card security codes for hosted checkout. Payment details entered into Stripe are processed under Stripe's privacy information. Test-mode preparation is not evidence that live billing is operating.
Users may choose whether to receive:
Information relating to:
Information relating to:
Marketing communications are optional and separate from essential account, security and billing messages. If you choose to receive launch announcements, Chloe Norcross, trading as Mosslight Created, may use your email address and marketing preferences to tell you about Campaign Oracle and future D&D-related products or brands she operates under the same business. This does not authorise reuse of your private campaign content, notes or character sheets for marketing. Accepting these policies or creating an account does not itself opt you in. You may withdraw consent at any time, without losing access to Campaign Oracle. We will provide an unsubscribe option in marketing emails. This permission does not automatically extend to a separately owned company or another operator. Pre-publication check: enable and verify a separate optional opt-in, consent records and unsubscribe handling before collecting launch-announcement subscriptions or sending marketing emails.
Users may withdraw consent at any time through:
Any analytics or monitoring description must reflect the services actually enabled. Optional analytics must comply with applicable consent requirements; reading this policy or continuing to browse does not itself provide consent where consent is required.
Pre-publication check: verify Base44 and other provider telemetry, cookie/local-storage behaviour, any optional analytics and the available controls. Do not publish an unverified statement that Google Analytics or a consent tool is installed.
We do not sell personal information. Base44 processes information to host and operate the application. When paid billing is enabled, Stripe processes payment information. Other disclosures may be necessary to verified hosting, security, analytics or support providers, professional advisers, regulators or law enforcement, for the purposes described in this policy and under an appropriate lawful basis.
Campaign membership starts with an invitation request and DM approval. The DM can reveal campaign records to approved players. Removing a player revokes campaign access; rejoining requires approval again. DM-only notes and secrets are restricted to the DM. Players' own private notes and character sheets are restricted to their owner and are not shared with the DM or other players. Approved players retain access to previously revealed material after the DM's paid subscription ends, while their membership remains approved and has not been removed.
New protected image uploads use private storage and temporary links issued after access checks. Hiding content or removing a campaign member prevents new links being issued where that access is no longer permitted; a previously issued link may remain usable until it expires. External public image links and older public uploads are not made private by record visibility controls. Do not use public links for confidential material.
The platform operator and necessary service providers may process stored information for hosting, support, security, legal compliance and authorised administration. “Private” does not mean inaccessible to the operator. The version being launched and its provider configuration must be checked before publication.
Campaign Oracle retains information only for as long as reasonably necessary to:
Information associated with active Accounts may be retained for the duration of account activity.
This includes:
Cancelling billing or removing a campaign member does not automatically delete an account or its personal notes and character sheet. Users may request deletion through the privacy contact below.
We will retain personal information only where necessary for the purposes and legal bases described in this policy, and explain relevant exceptions when responding to a deletion request.
Pre-publication check: confirm and document account, campaign, upload, log and backup retention/deletion periods. The previously proposed ninety-day recovery period and continuing player access after DM deletion are not verified operational features.
Subscription and transaction records may be retained for longer periods where required by:
Backup availability, encryption, retention and deletion behaviour must be confirmed with the hosting provider before publication. This draft does not promise encrypted backups, a specific recovery period or restoration of deleted information.
Campaign Oracle may use third-party providers located outside the United Kingdom.
As a result, personal information may be transferred to countries that do not provide the same level of legal protection as the United Kingdom.
Where such transfers occur, Campaign Oracle will take reasonable steps to ensure appropriate safeguards are in place.
These safeguards may include:
Users acknowledge that certain Platform services may require international processing of information.
Subject to applicable law, users may have the following rights regarding personal information.
You may request confirmation of whether we process your personal information and request a copy of such information.
You may request correction of inaccurate or incomplete information.
You may request deletion of personal information in certain circumstances.
This right is subject to:
You may request that certain processing activities be limited.
Where applicable, you may request a copy of information in a commonly used electronic format.
You may object to certain forms of processing based upon legitimate interests.
Where processing relies upon consent, consent may be withdrawn at any time.
Withdrawal does not affect processing carried out before consent was withdrawn.
Requests regarding privacy rights may be submitted to:
campaignoracle@gmail.com
Campaign Oracle may request reasonable verification of identity before responding to requests.
Campaign Oracle uses authentication and application access controls designed to separate DMs, approved campaign players and owners of private player records. Ownership is assigned by authenticated backend functions rather than accepted from client-supplied owner fields.
Bounded ordinary-user preview checks have exercised approval/removal, revealed-content access, withheld DM secrets, cross-campaign restrictions, private player records and protected image access. These included direct denied reads and signing requests, rather than interface checks alone. They do not guarantee absolute security or establish the configuration of an unpublished production version.
New protected uploads use private storage and temporary access links. Public or external image URLs remain accessible outside the application access controls. No online service can guarantee absolute security. Protect your credentials, avoid unnecessary sensitive personal information and report suspected access problems to campaignoracle@gmail.com.
Pre-publication check: complete the outstanding access, file-storage, provider and security verification before making stronger security assurances.
Campaign Oracle is intended solely for users aged eighteen (18) years or older.
We do not knowingly collect personal information from children.
If we become aware that information has been collected from a person under eighteen years of age, we may:
Parents or guardians who believe a child has provided information should contact:
campaignoracle@gmail.com
Campaign Oracle may utilise automated systems, including artificial intelligence services, to generate content and provide Platform functionality.
Campaign Oracle does not currently make legally significant decisions about users solely through automated decision-making.
Any moderation, enforcement or account action may involve human review where appropriate.
The Platform may contain links to third-party websites, products or services.
Campaign Oracle is not responsible for:
Users should review the privacy policies of any third-party services they access.
If you have concerns regarding our handling of personal information, we encourage you to contact us first.
Privacy-related enquiries should be directed to:
campaignoracle@gmail.com
Users in the United Kingdom may also have the right to lodge a complaint with the Information Commissioner's Office (ICO).
Further information is available from the ICO website.
Campaign Oracle may update this Privacy Policy from time to time.
Changes may be made to reflect:
Updated versions will be published on the Platform.
Continued use of the Platform after publication constitutes acknowledgement of the revised Privacy Policy.
Campaign Oracle
Operated by Chloe Norcross, trading as Mosslight Created
Business Address:
49 Gordale Close
Northwich
CW8 4XT
England
United Kingdom
General Enquiries:
campaignoracle@gmail.com
Customer Support:
campaignoracle@gmail.com
Legal & Privacy Enquiries:
campaignoracle@gmail.com
By creating an Account, purchasing a Subscription when billing is enabled, uploading content or otherwise using Campaign Oracle, you acknowledge that:
END OF PRIVACY POLICY
Other policies
Contact: campaignoracle@gmail.com