Privacy and cookies

Last updated: 2 November 2026

Who runs this site

Duality is a private project in development, run by its owner for a small group of invited testers. If you have any questions about your data, contact the site owner directly using the email gm@dualityttrpg.com.

What we collect, and why

• Your username. Used to identify your account and show who you are to other players.
• Your email address. Every account needs one. It is used to confirm your account when it is created, to confirm any change of address, and to contact you about your account (for example, to send a password reset link if you forget your password). It is never used for marketing. You can change it at any time on your My Account page.
• Pending confirmations. When an account is created, an email address is changed or a password reset is sent, the username, email address and a scrambled copy of the emailed link are kept until the link is used, or for 48 hours at most (password resets: 1 hour if you request it yourself with "Forgot your password?", 24 hours if the site owner sends it).
• Account status. If an account is suspended, we store only the date and time the suspension ends.
• Your chosen look. If you choose Dark or Match my device under Appearance on your My Account page, we keep that choice with your account, so every page is shown to you that way on any device you sign in on. If you keep the usual light look, nothing is stored. You can change it at any time, and it is erased with your account. It is kept on our server, not in your browser.
• Your password, in scrambled form only. We store a one-way "hash" of your password, never the password itself. Nobody, including the site owner, can read your password.
• Sign-in and sign-out times, and account changes. The server notes when an account signs in or out, or changes its details (but never the new details themselves), to help keep the site secure. These notes are not saved permanently.
• Who is signed in. While you are signed in, the server keeps a record of your sign-in so that restarting the server doesn't sign you out: which account it is, when you signed in and last used the site, whether you ticked Stay signed in, and scrambled codes that can't be turned back into your cookie or your password. The record is deleted when the sign-in ends.
• Sign-in codes and remembered browsers. When you sign in on a browser we don't recognise, we email a 6-digit code to the address on your account, to check it's really you. The code is kept on the server only in scrambled form, only until it is used or expires (10 minutes). If you leave Remember this browser for 30 days ticked, the server keeps a record that this browser may skip the code: which account it is for, when it was remembered, and a scrambled code that can't be turned back into the browser's cookie. The record is deleted after 30 days, when you change or reset your password, or when your account is deleted.
• Your forum posts. Topics and replies you write, shown to every member with your username and the date. You can edit or delete your own posts at any time. A deleted post's text is erased, and a "This post was deleted" note is left so the conversation still makes sense. So that your "My posts" page loads quickly, the site also keeps a private list of your own posts (where they are, their dates and the first line of each visible post). Only you can see it, and it changes with your posts: deleting a post, or your account, removes it from the list.
• Your votes on forum posts. When you give a post a thumbs up or thumbs down, we record which post you voted on and how, only so that each member can vote once per post. Everyone sees how many votes a post has, but the site never shows who voted. Your votes are erased when your account is deleted, and votes on a post are erased when the post is.
• Campaigns and invitations. For each campaign (a game run on the site) we keep its name, when it was created, who runs it (the GM) and who plays in it. Only the people in a campaign can see it: there is no public list of games. A GM invites someone by typing their username; we then keep who was invited and when, and email them to say so (the email names only the GM). Nobody joins without accepting. An unanswered invitation is deleted after 14 days. If you decline, we note that for 7 days so the same campaign can't keep inviting you. Campaigns you run are deleted when you delete them or your account; leaving a campaign, or deleting your account, takes you out of the others.
• Campaign notes. In each campaign you can keep notes. Your private notes can only be read by you, except your Backstory, which the campaign's GM can also read (it is marked "GM" in your list of notes). If you leave or are removed from a campaign, your private notes there are hidden straight away and deleted 30 days later (if you are invited back and accept within that time, you get them back). Deleting a campaign deletes all its notes, and deleting your account deletes your private notes at once. The campaign's GM can also keep their own notes inside your Backstory (for example about your character's family). Only the GM can see those; if you leave the campaign, or delete your account, the GM keeps them in their own notes.
• Shared notes. Everyone in a campaign can read and change its "Shared notes", and only the GM can delete them. They belong to the campaign, not to one person, because several people write them together: we don't record who created or wrote them, and they stay in the campaign if you leave it or delete your account (so other people's writing isn't lost). If you have written something about yourself there and want it removed, you can delete your words yourself, or ask the GM or us. They are deleted when the campaign is deleted. The same goes for the "Session N notes" page made each time the GM starts a session (these can't be deleted on their own).
• Typing together. While you have a note open, the other people in the campaign who have it open can see your typing as it happens, with your name in the game next to your cursor, in your colour (see "Your name and colour in a game" below). This is only sent while the page is open, and is not stored apart from the note itself.
• Notes the GM shows to players. A campaign's GM can show any of their own notes to every player in the campaign, who can then read them (and see the GM typing) but not change them. The GM can hide them again at any time. They are the GM's notes, and are deleted with them.
• Links between notes. A note can link to another note in the same campaign. Everyone who can read a note sees its links' words, even if they can't open the linked note (they never see its title or text unless they can open it). A link to a heading saves that heading's wording, hidden, in the note's text, so the list warns you before you link from a shared note to a heading in your private notes. To show "Linked from" on a note, we keep a list of which notes link to which (only their reference numbers, no text). You only ever see links from notes you can open yourself. The list goes when the note does.
• Scenery pictures and battle maps. A campaign's GM can upload pictures ("scenes") and show one at a time to the campaign's players, with a coloured frame and words on top. Only the GM can see their collection of scenes; players see only the scene being shown to them, and nobody outside the campaign can see any of them. The same goes for the GM's battle maps on the game table (a picture under a grid): players see only the map the GM shows them; and for the pictures the GM gives the tokens (each player character's piece on the map). Before a picture leaves the GM's computer, and again on our server, hidden information inside it (such as the camera used, or the GPS location where a photo was taken) is removed. Each picture is stored once, as a file on our server, until the GM deletes the scene or map, or removes the token picture, or the campaign or account is deleted; the file is then deleted within a day (unless a report still needs it). Players' browsers keep a copy of a picture they have been shown, so it doesn't have to be downloaded again; clearing your browser's cache removes it. Please only upload pictures you have the right to use, and don't upload photos of people without their permission.
• Your name and colour in a game. In each campaign everyone has a colour, so people can tell who is who: everyone is given one when they join, and can choose any other colour in the game (the GM can change anyone's, also on the campaign page). We keep each person's colour with the campaign, and remove it when they leave. In the game you are shown by your name in the game: "GM" for the GM, and your character's name for a player. Everyone in the campaign sees these, in the "who's who" pills on the map, next to your cursor in the notes, and with your measurements. The pills also show whether each person has the game open right now: the server knows this only while your page is connected, keeps it only in its memory (never saved), and tells only the people in that campaign.
• The roll log. When you roll dice, flip a coin, write a message or play rock paper scissors in a game, it is kept in that game's roll log (rolls are made on our server) and shown with your name in the game and your colour: to everyone in the campaign, or (if you choose "GM only") only to you and the GM, or (a whisper) only to you and the one person you choose. The GM does not see whispers between players. Rock paper scissors is always shown to everyone in the campaign, and your choice is kept secret until the other person has chosen. Anyone who can see a message, apart from its writer, can report it; a report keeps a copy of the message for the site owner to review. Each game keeps only its last 500 entries; older ones are erased automatically. Deleting your account erases everything you put in any roll log, and every whisper or challenge sent to you.
• Measuring on the map. When you measure a distance with the ruler on a battle map, the others on that map see it as you measure, with your name in the game and your colour (the GM's measurements are not shown while the GM works on the GM layer). Measurements are only passed on as they happen; nothing about them is stored. Pings (pointing out a spot on the map) work the same way: the others on the map see the spot with your name in the game and your colour, for a few seconds, and nothing is stored. The GM's ping can also move the players' view of the map to that spot.
• Drawings on the map. When you draw on a battle map (lines, shapes, words or an area template), we keep the drawing with a note that you drew it, and show it to everyone on that map in the campaign with your name in the game (the GM's drawings on the GM layer are seen only by the GM). It stays until it is erased: you can erase your own, and the GM can erase any. Anyone who can see a drawing, apart from you, can report it; a report keeps a copy of it for the site owner to review. Deleting your account erases everything you drew on any map.
• Lights on the map. When you place a light on a battle map (a spot or a token, its brightness, size and colour), we keep it with a note that you placed it, so only you (and the GM) can change or remove it. Other people on the map see the light it gives, not who placed it. It stays until it is removed; deleting your account erases every light you placed.
• Tokens. On the game table's battle maps, each player character can have a token (its piece on the map), placed by the GM. Each character has one token look (picture, shape and colours) chosen by the GM, shared by all of its tokens; it is also shown in that character's sheet, which only the character's player and the GM can see. A token shows its character's name, chosen numbers and conditions from the character sheet, as the GM allows. The GM can also write up creatures (their creature sheets are seen only by the GM) and place tokens of them, which show the creature's name and numbers as the GM allows. Tokens stay until the GM deletes them, the character or creature is erased, or the campaign is deleted.
• Turn order. When the GM runs a fight on a battle map, we keep the order of turns (worked out from the characters' and creatures' game numbers), the round, whose turn it is and how many action points each has spent. During a session, the players on that map see the order, with each token's picture and name as the GM allows and whose turn it is in that person's colour; each player sees only their own character's action points, and never the GM's hidden creatures. It is kept until the GM ends the fight.
• Treasury. In each campaign you have private Treasury places (where your character keeps money and stored items, with the names you give them), which only you and the campaign's GM can see and change, and there are group places everyone in the campaign can see and change. We keep what you type there. Who changed a group place is not recorded. When the GM adds or removes one of your items, you see a short notice saying so. If you leave a campaign, your private places are hidden at once and erased 30 days later (they come back if you rejoin in time); deleting your account erases them everywhere.
• Character sheets. In each campaign you have a character sheet (your character's name, details, attributes, skills, training, statistics, conditions, languages, abilities, magic (spells), held items (inventory, money, armour and weapons) and the About section, as you type them), which only you and the campaign's GM can see and change. We keep what you type there. If you or the GM retire your character (as retired or deceased), it is cleared from your view, but a copy is kept for the GM, who can bring it back; the GM keeps at most 5 of your past characters per campaign (the oldest is erased when another is retired), and can delete them. If you leave a campaign, your sheets (past ones too) are hidden at once and erased 30 days later (they come back if you rejoin in time); deleting your account erases them everywhere.
• Removed content. If the site owner removes a forum post or topic because it breaks UK law, it is hidden from other members but kept for 28 days, so it can be put back if you appeal successfully. It is then erased. You can still see your own removed post, with the reason it was removed.
• Reports of illegal content. If you report a forum post, a session notes page (a shared campaign page, or, for a GM, a player's backstory), a Scenery picture you are shown, a Treasury place (a group one, or for a GM a player's), or, for a GM, a player's character sheet, we keep your username, what you chose and wrote, and a copy of what you reported (so it can be checked even if it is changed afterwards; for a picture, its words and the picture file are kept until the report has been dealt with). The site owner, who is not in your campaign, sees that copy only because it was reported. The site owner is emailed that a report has been made, but the email never includes the reported content. The person you report is never told who reported them. Reports are kept until they have been dealt with, then deleted 90 days later. We handle reports because the Online Safety Act 2023 requires it (lawful basis: legal obligation).
• Evidence of child sexual abuse content. The law requires child sexual abuse content to be reported to the National Crime Agency, and evidence about it to be kept. If a post, notes page, Scenery picture or battle map is reported as child sexual abuse, or the site owner finds such content, we keep a copy of it (for a picture, a locked copy of the picture file that only the site owner can reach), the account that wrote or uploaded it (username, email address and join date) and that account's other forum posts from the two weeks before, and what the report said (not who made it). For a page of Shared notes, who wrote it is not recorded, so no account is kept with it. If the site owner decides it is not child sexual abuse, the copy is deleted straight away. If it is reported to the National Crime Agency, the copy is kept for one year and the Agency's reference number for five years, as the law requires (the Online Safety (CSEA Content Reporting by Regulated User-to-User Service Providers) Regulations 2026). This is kept even if the post, page or account is deleted (lawful basis: legal obligation). Only the site owner can see it.
• Your network (IP) address, temporarily. This is held only in the server's memory to limit sign-in attempts and connections, protecting the site from attacks. It is never recorded or stored.

We use this information on the basis of legitimate interests: giving invited testers access to the site and keeping it secure. We never sell your information or use it for advertising. We share it only where we need to:

• Emails are sent through an email delivery provider, which handles your email address only to deliver our messages.
• Where the law requires it, or someone's safety is at risk, information may be passed to the police or other authorities. For example, the law requires child sexual abuse material, and related account details, to be reported to the National Crime Agency. The lawful basis for this is legal obligation.

Cookies and browser storage

This site uses two cookies, both only to sign you in safely:

• duality_session (named __Host-duality_session on the secure version of the site): keeps you signed in. It holds a random code with no personal information in it, and is deleted when you sign out.
  • Normally, it is deleted when you close your browser, and your sign-in ends after 24 hours at most (or 2 hours if you don't use the site).
  • If you tick Stay signed in (it is never ticked for you), it lasts up to 30 days (or 7 days if you don't use the site). Don't use this on a shared or public computer.
• duality_trusted_browser (named __Secure-duality_trusted_browser on the secure version of the site): set only if you leave Remember this browser for 30 days ticked after entering a sign-in code. It holds a random code with no personal information in it, lets this browser skip the emailed code (never the password) for 30 days, and is sent only when you sign in. Untick the box on a shared or public computer, and it is deleted.

These cookies are strictly necessary to sign you in securely, so the law does not require us to ask for consent. The site saves nothing else in your browser's storage (an older version remembered whether you had closed a cookie notice; that notice has gone, and the item is deleted the next time you open the sign-in page). Your chosen look (light or dark) is kept with your account on our server, not in your browser. There are no analytics, tracking or advertising cookies. Your browser may also keep copies of the site's files (such as images and styles) so pages load faster. These contain no personal information.

Account management

The site owner can see each account's username, email address, join date and status, in order to run the site. To comply with UK law, as explained in the community guidelines, the site owner may:

• suspend an account for a set time (it is signed out straight away, and can't sign in until the suspension ends),
• delete an account, which permanently erases it and everything linked to it,
• send a password reset email to an account's address, if its owner has forgotten their password. The site owner never sees or chooses anyone's password.

How long we keep it

Your account stays until you ask for it to be removed, or the testing period ends. Sign-in sessions (and the server's record of them) end when you sign out, change your password, or the sign-in expires. Forum posts stay until you delete them or your account is deleted, and votes stay until you remove them, your account is deleted, or the post is erased. Campaign invitations are deleted when answered or after 14 days, and a "declined" note after 7 days. Shared campaign notes stay until the GM deletes them or the campaign is deleted. Group Treasury places stay until the GM deletes them or the campaign is deleted. Scenery pictures and battle maps stay until the GM deletes them or the campaign is deleted (the file goes within a day). Removed posts, topics, notes pages, Scenery pictures, battle maps and token pictures are erased 28 days after removal. Reports are deleted 90 days after they have been dealt with. Evidence of child sexual abuse content reported to the National Crime Agency is erased one year after the report, and the Agency's reference number after five years.

Deleting an account erases it, its forum posts, its votes, and its name on any reports it made. (Where a report needs to be kept, for example because someone else's content is still being dealt with, it is kept without the deleted account's name or posts.) The one exception is evidence of child sexual abuse content, which the law requires us to keep for the periods above.

Backups. So that nothing is lost if the server fails, the site makes an encrypted copy of its stored information once a day. Backups are locked with a key that only the site owner holds (the server itself can't read them), and uploaded pictures are never included. Each backup is deleted after 14 days, so anything erased from the site (for example when you delete your account or a post) is gone from the backups within 14 days too. Backups are only ever used to restore the site after a failure.

Your rights

Under UK data protection law you can ask to see, correct or delete the information we hold about you, or object to how we use it. Contact the site owner to do this. If you are unhappy with how your data is handled, you can complain to the Information Commissioner's Office at ico.org.uk.