What the app stores about you

This is a test of a small app run by one person for friends. This note says what it keeps about each person, who can see it, where it lives and how to get out. It was written from the code on 2026-10-11 (lib/members.ts, lib/member-names.ts, auth.ts, lib/audit.ts, lib/portraits.ts, lib/member-removal.ts, lib/member-erase.ts, lib/compendium-notes.ts, lib/factions.ts, lib/feedback*.ts, docs/DEPLOY.md); if the app changes what it stores, this note changes with it.

The short version

You sign in with Google. The app keeps your e-mail address, your name and the web address of your Google profile photo.
Your name, or the nickname you chose in its place, is shown to the group. Your e-mail address is used to sign you in; other players never see it, the GM does.
Everything you do in the app is saved with your name and e-mail address, and the GM can see all of it, including a log of every change.
There is no analytics, no advertising and no tracking script in the app. Its only e-mail is the invite: the GM can send your invite link to the address you gave him, and Google carries that mail (it goes out through the owner's Gmail account); the address is kept only with the invite.
The GM can remove you from the group at any time. Nothing is erased by that. If you want everything erased, ask the GM: the GM who runs the server can erase you completely on request (see the end).

What is kept about you

E-mail address (lower case)

Where it comes from: Google, at sign-in. It is the key of your member row: it decides whether you may sign in and which sheet is yours.
Who sees it: You (in the menu). The GM (members list, Explorers list, invites, the log). Not other players.

Name

Where it comes from: Your Google account's name, taken once, at your first sign-in. The app never reads it again and never changes it.
Who sees it: You, and the GM. The other players see your nickname instead, if you have one (below).

Nickname (optional)

Where it comes from: You: "Your name" in the menu with your name. The GM can also set or clear one for you. A name, not an e-mail address or a link, at most 40 characters.
Who sees it: Everyone in the group, in place of your Google name wherever the app names you (the ledger shows your character's name where you have one). The GM also sees your Google name beside it. The log lines about you are kept with your Google name and shown to the other players with your nickname.

Profile photo address

Where it comes from: Google, at sign-in. Only the address is kept, not the picture. Your browser loads the photo from Google to show it in your menu.
Who sees it: You.

Role (player or GM), who invited you, the day you joined, the vessel you are assigned to

Where it comes from: The app and the GM.
Who sees it: The GM. Your role decides which pages you can open.

If you were removed: when, and by whom

Where it comes from: The GM's action.
Who sees it: The GM.

Google tells the app that your e-mail address is verified before anything is kept; the app never sees your Google password.

What you make

Your Explorer's sheet, with everything on it, including the "Player name" you typed and your notes. Every member can open any sheet and look; only its owner and the GM can change it.
Your portrait, if you upload one. The app decodes it and keeps two new, small WebP copies (800 by 1000 and 160 by 160) in its database. The file you sent is not kept, and the copies carry none of its camera data (location, camera, time): the re-encoding drops it. Every member sees the portrait.
Requests, decisions, rewards, the creation rolls, item moves, the group's ledger and the journey entries. Each is stored with the e-mail address of the person who did it, and shown to the group, with names, where the app shows it.
The crew's note on a compendium entry (a preview feature: one note per entry, shared by the whole crew). If you write or change one, the app keeps the note, the history of the entry's note (who, when, and the note as it was after each change) and your e-mail address with each. The crew sees your name (your nickname, if you have one) and the date, never your address. There are no private notes: whatever you type there belongs to the crew, and the GM can read all of it.
The crew's standing and the star chart (preview features). The GM's standing changes with their reasons, what the GM has shown the crew on the chart, where the crew's vessels are, and the GM's own notes on the chart (which no player ever sees) are the GM's records: each carries the e-mail address of the GM who made it and says nothing about you. The one line about you is your Explorer's Faction, text on your sheet like the rest: the Group page lists the Explorer under the organization it names.
The log (the "Log" drawer, GM only). One line per change: who (name and e-mail), when, which sheet, what changed from and to. When the GM acts as you ("View as"), the line says so. The newest 5,000 lines are kept; older ones are deleted.
Feedback reports ("Send feedback" in the menu with your name). A report holds what you typed, the page you were on (its address and name), your window width and the app's version. The nickname is optional and cannot be an e-mail address; any text that looks like an e-mail address is replaced before the report is stored. The report is kept in the app's database and the GM reads it under Game Master, Feedback. If the owner connects a GitHub token, the report is also sent as an issue to a private repository, with your nickname (or "anonymous") and a reference that is not your e-mail address. A screenshot you add stays in the app's database (re-encoded, camera data dropped, at most 2400 px); the issue holds only a link that works for the GM and for you. You see the reports you sent; the GM sees all of them.

Cookies (what the browser keeps)

These are all the cookies the app sets. None is for analytics or advertising, and nothing sets one but the app itself. On the live site the sign-in cookies (the first four rows) carry a __Secure- prefix (the CSRF one __Host-), a browser rule that they travel only over HTTPS.

authjs.session-token

What it is for: Keeps you signed in. Signed and encrypted; it carries your e-mail address, name, photo address and role.
How long it lasts: About 30 days

authjs.csrf-token

What it is for: Protects the sign-in and sign-out forms against forged requests. A random value.
How long it lasts: Until you close the browser

authjs.callback-url

What it is for: Remembers the page you wanted, so that signing in can take you back to it.
How long it lasts: Until you close the browser

authjs.pkce.code_verifier, authjs.state

What it is for: Safety checks while Google signs you in: random values that prove the answer belongs to your own sign-in.
How long it lasts: 15 minutes at most, and deleted when the sign-in ends

pending_invite

What it is for: While you accept an invite: the invite's token, so that the sign-in can finish it.
How long it lasts: 15 minutes

gm_impersonate

What it is for: For a GM only: who they are viewing the app as ("View as").
How long it lasts: Until you close the browser, or the GM ends "View as"

nav_width, nav_open_width

What it is for: The width of the side menu, so that the page is drawn right at once.
How long it lasts: 1 year

demo-flash, archive-flash, gm-items-flash

What it is for: For a GM only: a short message shown once after an action on the demo data, the archive or the prepared items pages.
How long it lasts: 30 seconds

ui_layout

What it is for: An old cookie of an earlier layout. The app sets none any more; if your browser still has it, the app deletes it.
How long it lasts: Deleted at your next visit

Not cookies: the light or dark theme, and which approval requests the GM's banner has already shown, are kept in your browser's local storage, and whether the Log drawer is open in the tab's session storage. They stay in your browser and are never sent to the server.

The app loads no scripts or fonts from other sites. The only other sites it talks to are Google (sign-in, your profile photo) and, if feedback is switched on, GitHub (from the server, not from your browser).

Who can see what

You: your own sheet, portrait and requests, and the group's shared pages.
The other players: your name (your nickname, if you have one), your Explorer's sheet and portrait (to look at, not to change), the Bird, the vessels, the ledger and the crew's notes with the name of whoever wrote them. Not your e-mail address, and not your Google name while you have a nickname.
The GM: everything above, plus the e-mail addresses, the log, the approvals, the feedback reports, and every sheet (the GM can change any of them and can "View as" you, with a banner saying so). A server can have more than one GM.
The owner, who runs the server, can read the database file and its backups, so: everything.

Where it lives

In one SQLite file on a server in the owner's home in Germany: a small Ubuntu machine of his that runs the app in Docker (docs/DEPLOY.md, "The home lab"); on a development machine it is data/uncharted.db. Portraits and screenshots are inside that file. A nightly backup copy of it is made on the same machine and kept for 60 days. Cloudflare carries the traffic: the app is reached through a Cloudflare Tunnel, so your browser's connection (HTTPS) ends at Cloudflare, which passes it on to the server through the tunnel; Cloudflare therefore sees the requests, as any such provider in front of a site does, but stores nothing of the app's data. The code is in a private repository; the app sends data there only through feedback issues. The server's own log records start-up and errors; no access log of the pages you open is written.

Who else handles your data

Google: the sign-in. Your e-mail address, name and photo address come from it, and your browser loads your profile photo from Google. When the GM sends an invite by e-mail, Google's mail service carries that mail too: it goes out through the owner's own Google account.
Cloudflare: carries the traffic between your browser and the server (see "Where it lives"). It stores none of the app's data.
GitHub: only if the owner has connected it. A feedback report is then sent as an issue to a private repository, with your nickname (or "anonymous") and no e-mail address.

Nobody else is given your data. The app loads no scripts, styles or fonts from other sites, and the only picture your browser takes from another site is your own Google profile photo in the menu.

Who is responsible

The person responsible for this app is its owner, who runs the server and is the one to ask about any of this. His name, postal address and e-mail address are the ones on the imprint page; this page shows them too, taken from the same place.

Name: not filled in yet
Postal address: not filled in yet
E-mail address: not filled in yet

If you want out

Leaving the group. Ask the GM to use "Remove from the group" on you. You can then no longer sign in, and your Explorer is archived (hidden from the group, not deleted). Your member row, your name and e-mail address and the log lines stay, so the GM can bring you back with one click; your name stays on the old ledger and log lines.
Deleting your Explorer. The GM can delete it for good from the Archive. The sheet and the portrait go. The log and ledger lines that mention it stay.
Erasing everything about you. Ask the GM: on request the GM who runs the server (an admin) can erase you completely, from Admin, Game Masters, "Erase..." next to your name, behind a confirm that says there is no undo. It deletes, in one step: your member record (your e-mail address, name, nickname and photo address), all your Explorers (also archived ones) with everything on them (the sheets, items, requests, rewards and gift notices), your portraits, your feedback reports and screenshots, your invites and the creation dice, the requests you made, and every line of the log that names you (the lines about your sheets, the ones you wrote, the ones where the GM acted as you, and the ones that carry your address). What stays is the group's own record without you: the ledger and the crew points keep their lines (the amounts and notes) with your address taken out, as do the voyage log and "who decided" fields, and the crew's notes on compendium entries and their history (the words stay, the address goes, and the page then says "A former member"); a note a person typed by hand that happens to contain your character's name is not searched for. A Game Master has to be made a player again first. Your Google account is not touched. The backups keep the old data until they age out: 60 days, on the same server. A feedback issue already sent to GitHub is the owner's to delete there; the app deletes only its own copy.
Your Google account. You can take the app's access away in your Google account's settings. That stops you from signing in; it deletes nothing here.