Draft — not yet approvedThis text is a draft. It will be replaced by the approved version.
Privacy
Version: beta 1 · Effective from: [date of publication]
This policy explains what personal data Fog Atlas holds, why, for how long, and what you can do about it. It covers the hosted Fog Atlas service at world.fogatlas.online (the app for game masters) and adventure.fogatlas.online (the links players open).
It does not cover a copy of Fog Atlas that someone else installs and runs on their own computer or server. Whoever runs that copy is responsible for it.
1. Who runs Fog Atlas
Fog Atlas is run by Controlled Chaos BV, a company registered in Belgium:
- Address: Wilselsesteenweg 349/1, 3010 Leuven, Belgium
- Company number: BE 0730.857.188
- Contact person: Maarten Peeters
- Email: hello@fogatlas.online
In this policy "we", "us" and "our" mean Controlled Chaos BV. We have not appointed a data protection officer; the service is too small to require one. Send every privacy question to hello@fogatlas.online. It is also our support address.
2. Who this policy is about
- Game masters ("DMs"). People we have invited to the beta, who have an account. You must be
16 or older to have an account.
- Players. People a DM invites to their game. Players do not have an account. They open
a private link the DM gives them.
- People named in a DM's game. A DM may type real names into their notes, for example the
name of a player.
3. Who is responsible for which data
Your DM account. For a DM's own account (email address, display name, password, login sessions), we decide how the data is used. We are the controller.
What a DM puts into their game. A DM decides what goes into their own adventures: character names, player names, notes, images, dice rolls, and the like. For that content the DM is the one who decides, and we only store and show it on the DM's behalf. Where data protection law applies to them, we treat the DM as the controller of their players' data, and we act as the DM's processor.
We offer every DM a processor agreement ("verwerkersovereenkomst") built on the European Commission's standard contractual clauses for processors (Implementing Decision (EU) 2021/915). The processor agreement is linked from the Terms of Use; you accept it when you create an account. The beta welcome email repeats the link.
Many DMs run a game for friends as a hobby. A DM doing that may fall under the household exemption, which means data protection law may not apply to them at all. Either way, our own responsibilities as processor apply, and we handle the data as described in this policy.
If you are a player and want to know what a DM stored about you, or want it removed, ask your DM first: they can see and change it. You can also email us and we will help, or pass your request to the DM.
4. What data we hold, why, and on what legal basis
4.1 DM accounts (we are the controller)
| Data | Why | Legal basis (GDPR) |
|---|---|---|
| Email address, display name | Your login; contacting you about your account | Contract — art. 6(1)(b) |
| Password | Your login. Stored only as a one-way hash, never in readable form | Contract — art. 6(1)(b) |
| Login sessions: a hashed session token, when it was created and last used, and your browser's "user agent" text | Keeping you logged in; letting you see and end your sessions | Contract — art. 6(1)(b) |
| Invitation: the email address it was sent to, a note on who it is for, when it was made and used | Running an invite-only beta; stopping misuse of invitations | Legitimate interest — art. 6(1)(f): knowing who was invited |
| Password reset links (hashed, valid for one hour) | Letting you reset a forgotten password | Contract — art. 6(1)(b) |
| Email addresses of people you lend a world to | Lending a world to another DM | Contract with you — art. 6(1)(b); for the other person, legitimate interest — art. 6(1)(f) |
| Account backups you import | Restoring your own data | Contract — art. 6(1)(b) |
4.2 Game content (we act as the DM's processor)
Everything a DM creates: worlds, maps, adventures, records, chronicle entries, character sheets, images, and the names in them. From players, through their link: the name they write notes under, their notes, images they upload for their character, dice rolls, and which announcements they have read.
We process this only to host it, show it to the DM and to the players the DM chooses, back it up, and keep it secure. We do not use it for anything else.
4.3 Technical data (we are the controller)
| Data | Why | Legal basis |
|---|---|---|
| Web server logs: IP address, time, page requested, browser type. Player link tokens are removed from these logs | Security, stopping abuse, fixing faults | Legitimate interest — art. 6(1)(f) |
| Rate-limit counters (IP address, in memory only) | Stopping password guessing and overload | Legitimate interest — art. 6(1)(f) |
| Technical error reports, on our own server (self-hosted). Player link tokens are stripped before a report is stored | Finding and fixing faults | Legitimate interest — art. 6(1)(f) |
4.4 What we do not do
- No advertising, no tracking, no analytics, no profiling.
- We do not sell or rent personal data.
- We do not send marketing email.
- We do not use your content to train AI models.
4.5 Support emails and beta feedback (we are the controller)
| Data | Why | Legal basis |
|---|---|---|
| Emails you send to hello@fogatlas.online, and our replies | Answering your questions and privacy requests | Legitimate interest — art. 6(1)(f): helping you; legal obligation — art. 6(1)(c) for privacy requests |
| Your answers to beta feedback questions | Improving Fog Atlas | Legitimate interest — art. 6(1)(f): improving the service with its testers |
5. AI features
Hosted AI is off. Fog Atlas has no AI of its own switched on: hosted AI is off for every account, and our server holds no AI key. If we ever offer hosted AI (for example as part of a paid plan), we will update this policy first and name the provider. It would stay off for your account until you switch it on yourself.
Your own AI provider or local model. As a DM, you can save your own AI provider key (for example for Anthropic or OpenAI), or the address of your own local model, in Settings. When you then use an AI feature, your request passes through our server on its way to the provider you chose: we pass it on at your instruction. We store your key encrypted, and we only ever show its last 4 characters. We do not log your questions. The calls are billed to your own account with that provider, and the provider handles your request under your own agreement with them and their terms, not ours. That provider may be outside the EU; that transfer is made at your instruction, under your agreement with them (section 7). You decide what to send, and you are responsible for that choice, including for your players' data in it. That provider is not one of our service providers, and section 6 does not cover it.
The same applies if you follow our guide to making a Fog Atlas import file (.fogatlas.json) with your own Claude or ChatGPT: what you give that assistant goes to its provider under your own account and terms. Fog Atlas only receives the finished file when you import it.
We do not log the questions you ask the AI features.
6. Who else handles the data
We use these service providers. Each acts on our instructions under a data processing agreement.
| Provider | What for | Where |
|---|---|---|
| Hetzner Online GmbH (Germany) | The server that runs Fog Atlas, and a separate storage box for backups | Falkenstein, Germany |
| Brevo (Sendinblue SAS, France) | Sending invitation and password-reset emails | EU |
| Combell | The mailbox for fogatlas.online, which receives the emails you send to hello@fogatlas.online | Belgium (EU) |
| Google (Gmail) | Reading and replying to the emails sent to hello@fogatlas.online | US company; data in EU and US data centres, transferred under the EU-US Data Privacy Framework (Google LLC is certified) |
| Cloudflare | DNS for fogatlas.online only: it answers which server a name points to. Traffic to the app does not pass through Cloudflare | US company with a global network; the DNS service is covered by the EU-US Data Privacy Framework (Cloudflare, Inc. is certified) |
Brevo's data processing agreement is Appendix 3 of Brevo's terms (version of 1 October 2025), accepted when our Brevo account was created.
We have accepted Hetzner's data processing agreement in the Hetzner console, for both the server and the storage box.
The invitation and password-reset emails contain only your email address, display name, and a link or code. They never contain anything from your games.
Discord. We run a small group chat on Discord for beta DMs on game nights. It is optional. Discord is not our service provider: what you post there falls under Discord's own terms and privacy policy.
Administrator access to the server runs over Tailscale, a private network between our contact person's two machines. It is encrypted (WireGuard) and carries no Fog Atlas content, so Tailscale is not one of our service providers.
We do not give personal data to anyone else, unless the law requires us to.
7. Where the data is
All Fog Atlas data is stored in the EU: the server and the backups are with Hetzner in Germany.
Some of the services named in section 6 are run by US companies: Google (Gmail), Cloudflare (DNS), Discord (the optional game-night chat), and any US sub-processors that Brevo uses. Where personal data goes to one of them, the transfer relies on the EU-US Data Privacy Framework if that provider is certified under it, and otherwise on the European Commission's standard contractual clauses.
No AI provider is used by Fog Atlas itself. If you use your own AI provider key (section 5), the provider you chose may be outside the EU; that transfer happens at your instruction, under your own agreement with that provider.
8. How long we keep data
| Data | How long |
|---|---|
| DM account and all its content | Until you delete the account. Deletion removes it from the live database immediately. |
| The same data in backups | Removed from backups within 90 days of deletion. |
| Player data in an adventure | Until the DM removes it, deletes the adventure, or deletes their account. Then as above. |
| Player links | Stop working after 90 days, or earlier if the DM revokes them. |
| Login sessions | Expire 30 days after last use, or when you log out. |
| Password reset links | Expire after one hour. |
| Invitations | Until the person or the DM who sent it deletes their account, then the email address, the note and the "for whom" line are erased from the invitation (the dates and state stay, with no name on them). |
| Invitations to help run an adventure (sent by email) | Until the person it was sent to or the DM who sent it deletes their account — then the invitation is deleted outright, not kept with the name removed. |
| Web server logs | 14 days |
| Emails at Brevo | |
| Support emails you send to hello@fogatlas.online, and our replies | Up to 2 years, then deleted. |
| Your answers to beta feedback questions | Until 1 year after the beta ends, then deleted. |
| Technical error reports | 30 days. |
9. Your rights
You have the right to:
- access your data and get a copy;
- correct it;
- delete it ("right to be forgotten");
- restrict how we use it;
- object to use based on legitimate interest;
- take it with you (data portability).
You can do much of this yourself in the app:
- change your display name, email and password in your account settings;
- export all your data as a file at any time;
- delete your account. If you share an adventure with someone else, the app will first ask you
to sort that out.
For anything else, email hello@fogatlas.online. We answer within one month. We may ask you to prove who you are first.
Players: see section 3. Your DM controls your adventure's content, but you can always email us.
Complaints. You can complain to the Belgian data protection authority, the Gegevensbeschermingsautoriteit / Autorité de protection des données, Drukpersstraat 35, 1000 Brussel, or to the authority in your own EU country. We would appreciate the chance to fix the problem first.
10. Cookies
Fog Atlas uses one cookie: a login cookie (fog_session) that keeps a DM logged in. It is strictly necessary, so it needs no consent. It lasts up to 30 days.
The app also stores some settings in your browser's local storage (for example, layout choices and data that lets a player's page keep working when the connection drops). This stays on your device and is needed for the app to work.
There are no analytics, advertising or tracking cookies, and no third-party cookies.
11. Recording game sessions
The hosted service does not record, receive or store audio.
Fog Atlas includes a separate session recorder that a DM can run on their own computer. Recordings stay on that computer. The recorder refuses to start until the DM has recorded the consent of everyone at the table. The DM is responsible for those recordings and for that consent. The hosted service only receives a signal that a recording is running and how many people consented — never names, audio or transcripts.
12. Security
- All traffic uses HTTPS.
- Passwords, session tokens, invitation codes, reset links and player links are stored only as
hashes.
- Backups are encrypted before they leave the server.
- Each DM's games are kept apart from other DMs' games. This is tested automatically: a second account is tried against every route of the first account's data and must get nothing. Uploaded images are fetched by a long, unguessable address; anyone who already holds that exact address can fetch the image.
- Only our contact person, Maarten Peeters, has administrator access to the server.
If a data breach puts your data at risk, we will report it to the Belgian data protection authority within 72 hours where the law requires it, and tell you without undue delay. If it concerns a DM's game content, we will tell that DM without undue delay so they can act.
13. Children
DM accounts are for people aged 16 or older.
Players do not need an account, and a DM may invite younger players to their game. The DM is responsible for having permission from a parent or guardian where that is needed, and for not putting more about a child into the game than necessary.
14. Changes to this policy
We will post any change on this page with a new date. For important changes we will email DMs at least [30] days in advance, unless the change is needed sooner for legal or security reasons. We will never start sending data to a new kind of recipient (such as an AI provider) without updating this policy first.
Last updated: [date]