Privacy
Who is responsible
This app is an undergraduate thesis project (Department of Informatics, Ionian University), run by Alexandros Mpakodimos-Kopsacheilis, who is the data controller. Contact: support@trucksart.com.
What we collect and why
- Account: e-mail address, username, password (stored only as a hash) and optional profile pictures. These are needed to create and use an account.
- Game content: games, scenes, characters, items, spells, chat messages, dice rolls and images you upload or add by link. Needed to run your games.
- Sign-in session: a record that keeps your browser logged in to your account until you log out or for up to 7 days.
- Security: your IP address in the web host's server logs. Rate limits count requests under a keyed hash of your IP address or account.
Legal basis: providing the service you sign up for (GDPR Art. 6(1)(b)). Server logs and rate limits rest on our legitimate interest in keeping the service secure (Art. 6(1)(f)). There is no profiling, advertising or automated decision-making.
Who sees or handles it
- Other players in a game see what you post in it.
- Service providers store or carry data for us: IP.GR (hosting and e-mail, Greece), Neon (database, Frankfurt), Render (short-lived data and rate-limit counters, Frankfurt) and Cloudflare (uploaded images, stored in its Eastern Europe region and delivered through its global network). Neon, Render and Cloudflare are US companies. Render's and Cloudflare's data-processing terms cover transfers outside the EU under the EU-US Data Privacy Framework and the EU Standard Contractual Clauses. Neon's terms: neon.com/dpa.
- Password check: when you choose a password, our server sends the first 5 characters of its SHA-1 hash to the Pwned Passwords service to check it against known breaches. The password itself is never sent.
- Images added by link are loaded by the browser of each player in that game directly from the website that hosts them, which can see their IP address.
How long we keep it
- Sign-in: 7 days, or until you log out.
- E-mail links: Verification for 24 hours. Password reset and e-mail change for 1 hour.
- Deleted games: remain for 30 days in Recently deleted, then removed permanently with their images.
- Your account and content: until you delete them.
- Rate-limit counters: at most one hour. Server logs: under IP.GR's policy.
On your device
One cookie keeps you signed in for 7 days. It is strictly necessary for the service, so there is no consent banner. Your browser's local storage keeps your theme, dice colours and last "speaking as" choice. These are never sent to us. There are no analytics or third-party cookies.
Deleting your account
To delete your account, go to Dashboard > My account > Bin icon. Make sure you have deleted or transferred your games first. Your account, profile picture and games in Recently deleted are removed. In other people's games, your chat lines, your characters, the tokens and images you added stay, no longer linked to you, so those games stay intact.
Your rights
You can ask to access, correct or delete your data, to restrict or object to its use, and to receive a copy of it (portability). Most of this is in My Account. For the rest, e-mail support@trucksart.com. We answer within one month. If you believe we handle your personal data in a way that breaks data protection law, you have the right to lodge a complaint with a data protection authority: in Greece, the Hellenic Data Protection Authority (dpa.gr).
Accessibility
The site aims to be usable for as many people as possible, including people who use a keyboard instead of a mouse, screen readers, or larger text. The target is the WCAG 2.2 AA standard. Some parts don't meet it yet: moving tokens and drawing fog on the map needs a mouse, the site is designed for computers and tablets rather than phones, and a few colours and labels on the game page still need work.