Privacy notice

Who is responsible

La Mesa is personal software, used privately among friends: it is not an open service and has no public contact for a controller. If you have an account, the person running the table invited you; for any question about your data, talk to them directly.

What we process and why

Only what a table needs to work. Unless stated otherwise, the legal basis is performing the service you ask for when you sign up (GDPR Art. 6(1)(b)).

• Your email address: to send you the sign-in link or code and to recover your account.
• The name you choose for the table. We do not take it from Google, Discord or your email: you type it.
• The language you choose, kept in your account and in a cookie in this browser.
• What you create or upload at a table: campaigns, scenes, images and sounds, characters and their sheets (and the sheet looks you save as your own themes), handouts and the DM’s session notes.
• Your dice rolls: formula, result, visibility and time.
• Your presence while the table is open (which scene you are looking at). It travels live to your table and is not stored.
• Technical sign-in logs, with IP address, kept by our authentication provider to protect accounts. Basis: legitimate interest in the security of the service (GDPR Art. 6(1)(f)).

If you sign in with Google or Discord

That provider sends us your email, your name and the address of your profile picture (GDPR Art. 14). Our authentication provider stores them with your account at every sign-in; that is how that service works. The app copies neither the name nor the picture: at the table only the name you choose appears.

Who sees what

People who share a campaign with you see your name, the portrait the DM gives you at that table, your presence and the rolls whose visibility allows it. Nobody outside your campaigns sees anything of yours, and nobody but you sees your email.

Who processes data for us, and where

These providers process data on our behalf under a data processing agreement (GDPR Art. 28):

• Supabase: database, authentication and realtime, in a European Union region. Data processing agreement.
• Vercel: hosts the web app; its functions run in Paris (European Union). Data processing agreement.
• Backblaze B2: stores your images and sounds, in a European Union region. Data processing agreement.
• Resend: sends the sign-in and confirmation emails (your address and the code), from a European Union region. Data processing agreement.
• Google and Discord, if you use them to sign in, act as independent controllers for the sign-in step, under their own privacy policies.

The data is hosted in the European Union. Supabase, Vercel, Backblaze and Resend are US companies; any access from outside the Union relies on the EU–US Data Privacy Framework and on standard contractual clauses (GDPR Arts. 45 and 46).

How long

What belongs to a campaign (rolls, handouts, sessions and notes) lasts as long as the campaign. Your account’s data lasts as long as your account. Nothing is kept “just in case”. When something is deleted it is really deleted: the rows go at once and the files leave storage shortly after, usually within minutes and at most within a day.

Our authentication provider’s sign-in log and the providers’ technical logs are kept for the periods each of them publishes.

Cookies

Only the strictly necessary ones: your session’s, to keep you signed in, and the language one. None is for analytics or advertising and we load no third-party scripts, which is why there is no cookie banner (LSSI Art. 22.2).

Your rights

You exercise them yourself from your profile, at once and without asking anyone:

• Access and portability (Arts. 15 and 20): download a JSON with what is yours: profile, campaigns and sessions, files (with the link to download them while signed in), rolls, the characters you control and your library. Images come back as the WebP they were stored as on upload, because the original is not kept; sounds as you uploaded them.
• Rectification (Art. 16): change your name whenever you like.
• Changing your email: first a code sent to your current address, then another to the new one.
• Objection and withdrawal (Arts. 7(3) and 21): leave a campaign and you stop appearing in it. The character you played is campaign content and stays with its DM, with nothing of yours in it.
• Erasure (Art. 17): delete your account. Your profile, the campaigns you run (with everything in them, your players’ characters included), your files, your library, your rolls and your access are deleted. In other people’s campaigns your character stays with its DM with nothing of yours in it.
• Deleting a campaign or your account first asks for a code sent to your email, so that nobody can do it with a stolen session.

If you think we mishandle your data, you can complain to the Spanish Data Protection Agency (AEPD). You can also write to us first at the contact address above.

Minimum age

You must be at least 14 to use La Mesa (LOPDGDD Art. 7).

Security

Permissions are checked in the database, not on the screen; files are private and served only to people who may see them; the connection is encrypted. If a breach ever affected your data, we would notify the AEPD within 72 hours and you when the risk is high (GDPR Arts. 33 and 34).

Changes to this notice

If this notice changes, the date above will say so.