Privacy policy

Last updated October 7, 2026. The short version: you can use the whole site without giving us anything. If you sign in, we store your email address and your characters so they follow you between devices, and nothing is sold or used for ads.

Who we are

ThatOneDude’s D&D Forge (play5e.net) is a free D&D 5e character builder run by one independent developer. “We” and “us” below means that developer. See About for more.

Using the site without an account

You don’t need an account. Characters, homebrew, the DM Table Corner (encounters, notes, maps), theme and dice preferences are saved in your own browser’s local storage. They never leave your device unless you choose to sign in or share a character. Clearing your browser data deletes them, and some browsers (Safari after 7 days without a visit) clear it on their own, so the app offers a backup file you can download.

Sharing a character stores a copy of it (with any portrait and the homebrew it uses) on our server under a short code, and gives you a link to it. The first person to open the link gets the character saved to their device, and that deletes our copy. A link nobody opens is deleted after a day. Anyone you give the link to can read the character.

If you sign in

Signing in is optional and uses a one-time code or link sent to your email, with no password. When you sign in we store:

• Your email address, to send sign-in codes and identify your account.
• Up to seven characters, including their current state (hit points, inventory, conditions and so on) and any portrait image you add, so you can carry on from any device.
• Your saved encounters, homebrew and DM table (notes, the current fight, travel and map layout; map images stay on your device).
• Campaign data, if you join or run an online campaign: the campaign, its members and the play history (rolls, damage, conditions and similar events) shared with the others at that table.
• When you were last active, used for the inactivity rule below.

Joining a campaign, accepting a DM invite, or sharing a character or opening a shared one without signing in creates an anonymous guest session instead: it has no email address, only a random ID that links you to that campaign or shared character.

Accounts and guest sessions are hosted by Supabase, which stores this data on our behalf.

Inactive accounts

If you don’t use the site while signed in for 90 days, we email you a reminder. After 120 days of inactivity, everything saved to your account (characters, encounters, homebrew and DM table) is deleted. Copies on your own devices aren’t affected. Using the site again before then resets the clock.

Transfer codes

When you export a character as a one-time code, a copy of the character is stored so it can be imported on another device. The code works once and expires after one day, after which the copy is deleted.

Feedback

The Leave feedback form emails your message to the developer. Your email address is optional and only used to reply. Your IP address is held briefly in memory to stop spam and is not stored. Feedback and account emails are sent through Resend.

Donations

Donations are handled entirely by Stripe on its own checkout page. Your card details go to Stripe, never to this site. Stripe tells us that a payment happened and its amount, and may share the email and name you enter at checkout so a receipt can be sent.

Analytics

We use Vercel Web Analytics and Speed Insights to count page views and measure how fast pages load. They don’t use cookies and don’t identify you across sites. The site is hosted on Vercel, whose servers keep standard request logs.

Cookies

We don’t use advertising or tracking cookies. If you sign in, your session is kept in your browser’s local storage so you stay signed in.

What we don’t do

• We don’t sell or rent your data.
• We don’t show ads or share data with advertisers.
• We don’t send marketing email. The only emails are sign-in codes and inactivity reminders.

Your choices

You can use the site without signing in. You can sign out at any time, and delete any character, encounter or homebrew from your account inside the app. To have your account and everything stored with it deleted, or to ask what we hold about you, send a request through the Leave feedback form (Feedback in the app’s menu) and include the email address you sign in with.

Children

The site isn’t directed at children under 13, and we don’t knowingly collect their personal information. If you believe a child has signed in, contact us and we’ll delete the account.

Changes

If this policy changes, we’ll update the date at the top of this page.