Privacy notice · GDPR

What Sheetling stores, and why.

Last updated 29 September 2026. This notice covers the website sheetling.app and the app at play.sheetling.app.

1. Who is responsible

Forest River UG (haftungsbeschränkt)
Hofkoppel 17
23715 Bosau
Germany
Email: info@foriver.de

The company details in full are in the legal notice. We have not appointed a data protection officer, because we are not required to. Sheetling is in early access; automatic emails come from an address that does not take replies, so write to the address above.

2. Hosting

The website and the app’s interface are served by Vercel Inc., 440 N Barranca Avenue #4133, Covina, CA 91723, USA. On every request Vercel processes what delivery technically needs: your IP address, the date and time, the address requested, the referrer and your browser’s details. This serves delivering and securing the pages (Art. 6(1)(f) GDPR). Vercel is certified under the EU-U.S. Data Privacy Framework and keeps these short-lived logs only as long as it needs them for those purposes.

3. Invite requests

Until 29 September 2026 this site took invite requests. A request stored the email address, the optional note written with it, and the time of the request, on Supabase in the European Union (Ireland, see section 7), and was used for one purpose: to send an invitation. Sign-up is now open to everyone, so the form is gone and no new requests are taken. The requests already made are deleted once handled, and at any time on request. The legal basis was the request itself (Art. 6(1)(b) GDPR).

4. Analytics (PostHog)

Both the website and the app use PostHog (PostHog, Inc., 2261 Market Street #4008, San Francisco, CA 94114, USA), with the data stored in its EU cloud in Frankfurt. It runs cookieless: no cookies are set and nothing is written to your browser’s storage. There are no session recordings, no heatmaps and no advertising, and you are not followed across other sites.

On the website, what is recorded is pseudonymous: a page-view event with the page, your browser type and a coarse location derived from your IP address, which is not stored; how far down a page you scrolled before leaving it; in the manual, that a search was made and how many results it found (never what you typed), and which result you opened, by its place in the list; which kind of link you followed (to the app, to the manual or a download).

In the app, events say which features are used and how often. Because the app is signed in, they carry your account’s random identifier, so one tester’s usage can be told from another’s; they are never tied to your email address or your name. An event says what kind of thing happened on which character (a rest taken, a spell cast, a card opened, a level gained) together with that character’s class, species, level and ruleset. The content stays out: never a character’s name, your notes, the names of items or trackers you typed yourself, a portrait, or the sheet’s log. On a party’s screens, events also carry the party’s random identifier and whether you are its DM or a player. The accounts of Sheetling’s own testers (its developer and the members of one test table) carry a flag saying so, which we set and which lets their use be left out of the figures. Addresses are stripped of their query and fragment before an event is sent, so a sign-in link’s token cannot leave in one.

The legal basis is our legitimate interest in knowing whether the site is read and how the app is used during early access (Art. 6(1)(f) GDPR). You can object at any time by writing to the address in section 1, and a content or script blocker that blocks PostHog stops it outright — both the site and the app work exactly the same.

Feedback you send from the app. The Feedback button in the app opens a form where you pick a kind (bug, idea or something else) and write a message. This is the one place the app sends text you wrote yourself, and only when you press Send: nothing is sent while you type, and nothing if you close the form. The message goes to PostHog (above) with your account’s random identifier and, if a character is open, that character’s own random identifier, class, subclass, species, level and ruleset: never its name, your notes or your email address. We use it to fix what is broken and decide what to build next; the legal basis is our legitimate interest in improving the app during early access (Art. 6(1)(f) GDPR). A content blocker that blocks PostHog blocks feedback too; you can always write to the address in section 1 instead. Ask us to delete a message you sent at any time.

5. Fonts

The website and the app load their typefaces (Instrument Sans, Newsreader) from Google Fonts (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland), which receives your IP address and your browser’s details to serve the files. The legal basis is our legitimate interest in a consistent appearance (Art. 6(1)(f) GDPR).

6. Email (Resend)

Emails from Sheetling (for account holders the confirmation of a new account, password resets, sign-in links and notices that your password or email address changed) are delivered by Resend (Plus Five Five, Inc., 2261 Market Street #5039, San Francisco, CA 94114, USA) from its Ireland region. Resend receives the recipient’s address and the message to deliver it, and keeps a delivery log. Open and click tracking are switched off, so no pixel reports that you read one. Sheetling sends no newsletters and no marketing email. Resend is certified under the EU-U.S. Data Privacy Framework.

7. The app at play.sheetling.app

Account. For an account we store your email address and your password as a secure hash. Sign-in, password reset and email changes are handled by Supabase’s authentication service.

Your characters. Everything you make in the app: characters and their sheets, the names and notes you write, portraits you upload, house-rule sets, and any homebrew or content files you import. All of it belongs to your account, and only your account can change it. Outside a party, nothing you store is shared with other users or published: the database enforces that row by row, and portraits sit in a private bucket. There is no public profile.

Parties. When you join a party and seat a character at it, the party’s members see that character’s table card: its name, portrait, species, class, background, level, the appearance lines you wrote, hit points, Armor Class, speed, conditions, equipped items, companions and languages. The party’s DM can also read the rest of the sheet, without changing it: abilities, skills, inventory, spells, the personality and backstory you wrote, and the homebrew files that character uses. Your notes stay yours. House rules and homebrew you share with a party can be read by its members.

Where. The app’s data and files are stored with Supabase (Supabase Pte. Ltd., 65 Chulia Street #38-02/03, OCBC Centre, Singapore 049513) in the EU region Ireland (AWS eu-west-1). Where Supabase or its subprocessors access the data from outside the EU, this is based on the EU Standard Contractual Clauses.

Storage in your browser. The app keeps what it needs to work in your browser’s local storage: your sign-in session, the character you had open, whether you chose the light or dark base, and, if you use it without an account, the characters themselves, which then never leave your device. This is strictly necessary for the service you asked for (§ 25(2) no. 2 TDDDG); the app sets no cookies.

Purpose and legal basis. We process these data to provide the app to you (Art. 6(1)(b) GDPR).

How long. We keep your account and its characters for as long as your account exists. Every character can be exported as a plain file from the app at any time. To delete your account and everything in it, write to the address in section 1 — while Sheetling is in early access, deletion is done by hand.

8. Your rights

9. Changes

This notice changes when the service does. The date at the top says when it last did, and the version published here applies.