← Back to RPG Game Tools

Privacy Policy

Last updated: April 28, 2026

RPG Game Tools ("we", "us", "our") operates rpg-game.tools. This policy explains what data we collect, how we use it, and your rights.

1. Data We Collect

• Username — stored in plaintext; used to identify your account.
• Email address — encrypted at rest using AES-256-GCM before storage. Used only for essential account communications (billing receipts, account recovery). Never used for marketing.
• Password — hashed with bcrypt. We cannot recover your password.
• Build data — game builds you save to your account. Contains no personal information.
• Payment data — we do not store card details. Payments are processed by Lemon Squeezy as our Merchant of Record (see Section 4). We retain only the customer ID and subscription status returned by their API.

2. How We Use Your Data

• To provide and maintain the service (authentication, build storage, premium features).
• To process payments via Lemon Squeezy.
• To contact you about your account or subscription (transactional email only).

We do not sell your data. We do not use your data for advertising profiling beyond the third-party ad network described in Section 4.

3. Cookies and Local Storage

We store your authentication token in your browser's localStorage under the key rgt_token. This is strictly necessary for you to stay signed in and cannot be disabled while using the service.

We do not set first-party cookies. Third-party cookies may be set by Google AdSense (see Section 4).

4. Third-Party Services

Google AdSense — We display ads served by Google LLC. Google may use cookies and similar technologies to serve ads based on your prior visits to this and other websites. You can opt out of personalized advertising at google.com/settings/ads. For more information, see Google's Privacy Policy. EU users may also manage consent via the IAB Transparency and Consent Framework.

Lemon Squeezy — Payments are processed by Lemon Squeezy, Inc. as our Merchant of Record. When you check out, you are redirected to Lemon Squeezy's secure hosted page. They handle global VAT and sales tax compliance on our behalf. We receive a customer ID, order ID, and subscription status but never your card number, CVV, or full billing address. See Lemon Squeezy's Privacy Policy.

5. Data Retention

Account data is retained until you request deletion. Build data is deleted when your account is deleted. Lemon Squeezy retains payment records per their own retention policies for tax-compliance purposes.

6. Your Rights

If you are in the EU/EEA or UK, you have the right to:

• Access the personal data we hold about you
• Correct inaccurate data
• Request deletion of your account and associated data
• Data portability (export your build data using the Export button in the app)
• Object to or restrict certain processing
• Lodge a complaint with your local data protection authority

The legal basis for processing is: contract performance (providing the service), legitimate interest (fraud prevention, service security), and consent (personalized ads, where applicable).

7. Security

Email addresses are encrypted using AES-256-GCM with a key stored separately from the database. Passwords are hashed with bcrypt (cost factor 10). All data is transmitted over HTTPS.

8. Children

This service is not directed at children under 13. We do not knowingly collect data from children under 13.

9. Changes to This Policy

We may update this policy. Material changes will be noted by updating the date above. Continued use of the service after changes constitutes acceptance.