What we keep, and why

Sitting down at somebody else’s table takes a code and nothing else. No account, no name, no email. If that is all you ever do, the only thing kept about you is what happens at that table — your piece, your rolls, what you type in the table’s chat — and it belongs to that table rather than to you.

An account is for keeping things: your characters, your tables, your dice, your name following you between screens.

• A username and a display name, both chosen by you.
• Your password, stored only as a scrypt hash. We cannot read it and neither can anybody who steals the database.
• A one-time recovery code, also hashed. Since no email is required, this is the only way back into an account whose password is lost.
• Whatever you make: characters, adventures, dice sets, journals, notes, pictures you upload or have drawn for you.

No email address is required to make an account, and none is asked for.

Signing in with Google means Google tells us two things: a permanent account identifier, and your email address. We keep both. The identifier is what actually recognises you on the way back; the email address is kept alongside it.

Your email address is never shown to other people unless you turn that on yourself, and it is off to begin with.

Signing in with Google never opens an account that already exists, even when the email matches one exactly. It makes a new account. Joining the two together happens only from inside an account you are already signed in to. This is deliberate: matching people to accounts by email address is one of the most common ways apps like this get broken into.

We do not ask Google for anything else — not your contacts, your calendar, your files or anything in your Google account.

This is the part worth reading twice.

DnD Max uses outside AI services to narrate, to draw pictures and to make voices. When somebody at a table asks the AI dungeon master for something, what is happening at that table is sent to one of those services so it can answer. That can include what players have typed, the state of the game, and the names and descriptions of characters.

The services are:

• Anthropic (narration and writing)
• Google (narration, pictures, voices)
• OpenAI (pictures)
• ElevenLabs (voices, sound and music)

Each has its own privacy policy and its own terms, and your content is subject to them once it arrives. If you would rather keep a table’s content away from this entirely, do not use the AI features — the game itself works without them, and the rules and the dice never leave this app.

You can also bring your own key, in which case the asking goes to that provider under your own account rather than ours.

The site runs on Vercel. Game and account data is stored in Upstash Redis; pictures, voice lines and other files are stored in Cloudflare R2 and Vercel Blob. Those companies hold the data on our behalf and have their own security and privacy terms.

One cookie, to keep you signed in. That is the whole list.

There is no analytics, no tracking, no advertising and no third-party scripts watching what you do. Nothing about you is sold or shared with anybody for marketing, because there is nothing of the sort here to sell it to.

Things you publish — an adventure on the shelf, a dice set in the pool — can be seen by anybody, and that is the point of publishing them. Things you do not publish are seen by you, and by the people at a table you are playing at, where the table’s own rules apply: a table sees what happens at it.

The site administrator can see reported content in order to act on reports, and can see account records in order to run the site.

You can delete your account from your account page. Deleting it removes the account and what it holds.

Two honest caveats. Things you published and other people have taken copies of do not come back from those copies. And what happened at a table — the log of a night you played in — belongs to that table, so it stays with the table rather than leaving with you.

DnD Max is not aimed at children under 13, and accounts are not knowingly made for them.

Use the feedback form, which reaches the person who runs the site. If you want something deleted and cannot do it yourself, say so there and it will be done.

If this page changes, the date at the top changes with it. It is kept alongside the app’s own code, so every change to it is on the record rather than something we ask you to take on trust.