Privacy Policy

Last updated: September 25, 2026

1. Information We Collect

We collect the following types of information:

• Account Information: Email address, display name, and profile picture when you create an account.
• Authentication Data: We use Firebase Authentication (Google OAuth or email/password). We do not store your password directly.
• User Content: Monsters, spells, items, campaigns and other content you save to your account or submit to the Community Gallery.
• Payment Records: If you subscribe or donate, the payment is taken by Stripe (see section 4). We keep only your plan, a Stripe customer reference and the dates Stripe reports to us. We never see or store your card number.
• AI Provider Keys: If you add your own AI provider key (for example Anthropic, OpenAI or Google) so Codex can use AI features, it is saved to your account encrypted. See section 5.
• Usage Data: Basic analytics about how you interact with the Service (via Firebase Analytics).

2. How We Use Your Information

We use your information to:

• Provide, maintain, and improve the Service
• Store and sync your created content across devices
• Authenticate your identity and manage your account
• Process subscriptions and donations
• Understand usage patterns to improve features

3. Data Storage and Security

Your data is stored in Firebase (Google Cloud Platform) with industry-standard security measures including encryption in transit and at rest. Profile photos are stored in Firebase Storage with access controls limiting visibility to authenticated users.

4. Third-Party Services

We use the following third-party services:

• Firebase: Authentication, database and file storage (Google LLC)
• Stripe: Payment processing for subscriptions and donations. Stripe collects your payment details directly on its own checkout page, under its own privacy policy.
• The AI provider you choose: Only if you add your own key (see section 5).
• Cloudflare: CDN and security services
• Google Analytics: Usage analytics (via Firebase)
• Google AdSense: Advertising (see section 6 below)

5. Codex and Your AI Provider Keys

Codex, the site's assistant, works without a key: it can find tools and pages, search the gallery and answer from the site's own reference. AI writing and image features use a key you add from your dashboard. More about Codex.

• Your key is stored encrypted in your account and never passes through Chronicle Codex's servers.
• AI requests go from your browser directly to the provider you chose, using your key. What you type into those features, and the form content Codex sends with it, is received by that provider under its own terms and privacy policy, and any charges are between you and that provider.
• You can remove a key at any time from Dashboard → API Keys. Keys are never included in the data export described in section 7.

6. Advertising

Chronicle Codex is preparing to serve advertising through Google AdSense on its reference and community pages. Advertising is not enabled at the time of writing; this section describes how it will work when it is, so that you know before it happens rather than after.

• Google and its partners use cookies to serve ads based on your prior visits to this and other websites.
• Google's use of advertising cookies enables it and its partners to serve ads based on your visit to this site and other sites on the internet.
• You can opt out of personalised advertising at Google Ads Settings, or opt out of third-party vendors' use of cookies at aboutads.info.
• Where required, we will ask for your consent before any advertising or analytics cookies are set, and you will be able to change that choice at any time.
• Advertising will not appear inside the Monster Creator, Spell Creator or Campaign Forge tools, or on account, authentication and settings pages.

For a full list of the cookies involved, see our Cookie Policy.

7. Your Rights: Export and Deletion

From Dashboard → Account you can:

• Download my data: a JSON file of everything stored under your account: your profile, saved monsters and spells, Codex sessions and notes, preferences, activity, campaigns, and every gallery submission you made, whatever its status. Your AI provider keys are never included, in any form.
• Delete my account: after you type a confirmation phrase, we permanently remove your profile and everything stored under it, your campaigns, your quota and activity records, and the images you uploaded (profile photos and art), then delete your sign-in. Your gallery submissions are withdrawn from the gallery and their author is changed to “Former member”. The site's data in your browser is cleared as well.
• Update or correct your account information from the Profile tab.

If you have an active paid subscription, cancel it from the Subscription tab first so Stripe stops billing you; the delete button tells you when this is needed. Stripe keeps its own payment records as the law requires. Works other members remixed from your submissions belong to those members and are not removed.

8. Cookies and Local Storage

Your browser stores what the tools need to work: the monster, spell, item or campaign you are working on, your sign-in, and your cookie choice. With your consent it also keeps optional things between visits: your theme and colour palette, remembered filters, builder drafts, a cache of the spell list and Codex panel settings. If you choose Refuse on the cookie banner, the optional items are deleted and from then on are kept only until you close the tab. You can change your choice at any time with Cookie settings in the footer. Signing out clears your drafts and Codex settings from the browser. See the Cookie Policy for details.

9. Children's Privacy

Chronicle Codex is intended for a general audience and is not directed at children. We do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, contact us and we will delete it.

10. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of significant changes by posting the updated policy on this page with a new "Last updated" date.

11. Contact

For questions about this Privacy Policy, please visit our Contact page.