Privacy policy

What personal information GrimoireCodexDB collects, why, where it is kept, who it is shared with, and how to have it deleted. Last updated 14 October 2026.

Who we are

GrimoireCodexDB (db.grimoirecodex.org, “the database”, “we”) is a free, non-commercial, community-maintained catalogue of tabletop game metadata, run by its maintainers. Questions about this policy or your data go to support@grimoirecodex.org.

What we collect

Nothing, if you only read. Browsing the site or the API needs no account, sets no cookies and stores nothing about you in our database.
Account information from the sign-in provider you choose (Discord, GitHub or Google): that account’s id and username, your display name, your profile picture’s address, and your email address with whether the provider has verified it. We keep the email only if it is verified.
What you contribute: records, edits, notes, comments, votes, reports, ownership claims and the cover images and portraits you upload.
Technical data: a sign-in cookie, and request logs (IP address, page requested, time).

We do not collect payment details, your location, your contacts, or anything else from your sign-in account.

Google user data

GrimoireCodexDB uses Google only for sign-in. When you choose “Continue with Google”, it asks Google for the openid, email and profile scopes and nothing else.

Data accessed: your Google account id, your name, your profile picture’s address, your email address, and whether Google has verified that email. We do not access your Gmail, Drive, Calendar, contacts or any other Google service or data.
Data usage: to create your GrimoireCodexDB account and sign you in; to show your name and picture next to your contributions; to recognise you when you also sign in with Discord or GitHub using the same verified email; and to contact you about your account, ownership claims or moderation decisions. We use it for nothing else: not for advertising, not to build profiles, and not to develop, improve or train AI or machine-learning models.
Data sharing: we do not sell, rent or share your Google user data with anyone. The only other party that handles it is Cloudflare, which hosts our database and processes it on our behalf. We would disclose it only if the law required us to.
Data storage and protection: it is stored in our database, hosted by Cloudflare and reached only over HTTPS. Your email is never shown publicly. Only GrimoireCodexDB’s maintainers can access the database, and they look at personal data only when needed to run the service, for example to answer your request or investigate abuse.
Data retention and deletion: we keep it for as long as you have an account. Delete your account at any time from your account page, which removes your Google user data from our database at once, or email support@grimoirecodex.org from your account’s address and we delete it within 30 days. Database backups that still hold it expire within 30 days.
Revoking access: you can remove GrimoireCodexDB’s access at any time at myaccount.google.com/permissions. That stops future sign-ins with Google; to delete what we already hold, delete your account or email support@grimoirecodex.org.
Changes: if we ever change how we use Google user data, we will update this policy first and tell everyone who signs in with Google, on the site and by email, before the change applies.

GrimoireCodexDB’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. Information from Discord and GitHub is handled the same way.

How we use information

To run your account and keep you signed in.
To publish your contributions. Your edits, votes and comments are public and attributed to your display name; that is how review works.
To moderate: ownership claims, reports and uploads are linked to your account so moderators can review them. The evidence you give for a claim is seen only by admins.
To keep the service working and secure, and to stop spam and abuse.

We do not use your information for advertising or profiling, and we never sell it.

Grimoire and other library managers

Grimoire’s GrimoireCodexDB integration is off unless the server’s admin turns it on, and it can run in lookup-only mode. When it looks a file up it may send:

the file’s hashes (SHA-256 and similar), which identify a file without revealing anything in it;
its ISBN, product code, title, file name, author and publisher names, system name, year and page count.

It never sends the file, its pages or its text. Lookups are not stored. If you submit a book from Grimoire, what you submit becomes an ordinary public edit attributed to your GrimoireCodexDB account, including any file hashes you chose to include.

A hash says “someone has this exact file”. When you submit one, that link between your account and the file is public in the edit history. Leave hashes out if that matters to you.

Cloudflare hosts GrimoireCodexDB, its database and its images, and handles every request on our behalf. Its network is worldwide, so your data may be processed outside your country.
Discord, GitHub and Google handle sign-in under their own privacy policies. Profile pictures are shown from their image servers, so viewing one means your browser fetches it from them.

There are no analytics, advertising or tracking scripts. We share personal information with no one else, unless the law requires us to.

Cookies and local storage

Signing in uses a few short-lived cookies to complete the sign-in safely, then one cookie keeps you signed in for 30 days. They are needed for the site to work and are never used for tracking. Your browser also keeps your theme choice in its own local storage, on your device only.

How long we keep it

Account information: until you delete your account, or ask us to, then removed from our database at once and from backups within 30 days.
Sign-in sessions: 30 days, or until you sign out.
Request logs: a few days.
Contributions: they stay in record history, because the records depend on them. Once your account is deleted they are attributed to a deleted user.

Security

Every connection uses HTTPS. Sign-in sessions and API tokens are stored only as one-way hashes, so a copy of the database cannot be used to sign in as you. Access to the database is limited to GrimoireCodexDB’s maintainers.

Your choices and rights

Change your display name, revoke API tokens, and delete your account, on your account page.
Email support@grimoirecodex.org from your account’s address to get a copy of your data, correct it, object to how it is used, or have your account deleted for you. We reply within 30 days.
Revoke GrimoireCodexDB’s access from your Discord, GitHub or Google account settings at any time.

Children

GrimoireCodexDB is not meant for children under 13, and we do not knowingly keep their data.

Changes and contact

If this policy changes, the date at the top changes too, and significant changes are announced on the site. Questions go to support@grimoirecodex.org. See also the terms of use.