What Sheetling stores, and why.
Last updated 13 September 2026.
Who is responsible
Sheetling is a private project in early access, open by invitation only. If you hold an invitation, questions about your data go to the person who invited you; if you requested one through this site, the reply to your request is the address to write to.
Invite requests
When you request an invite on this site, the form stores your email address, the optional note you wrote, and the time of the request. That is all. The data is stored on Supabase in the European Union (Frankfurt) and is used for one purpose: to send you an invitation, or to tell you that none is available yet. Requests are deleted once handled, and at any time on request. The legal basis is your request itself (Art. 6(1)(b) GDPR).
Analytics
This site uses PostHog, hosted in the European Union, to count page views. It runs in cookieless mode: it sets no cookies and writes nothing to your browser's storage, it does not follow you across other sites, and it is not used for advertising. What it records is a pseudonymous page-view event with the page, your browser type and a coarse location derived from your IP address, which is not stored. The legal basis is a legitimate interest in knowing whether the site is being read (Art. 6(1)(f) GDPR). If you would rather not be counted, a content blocker that blocks posthog.com does exactly that, and the site works the same.
The app at play.sheetling.app uses the same PostHog project, in the same cookieless way, to learn which of its features are used and how often. Because the app is signed in, those events are tied to your account's random identifier so that we can tell one tester's usage from another's; they are never tied to your email address. An event says what kind of thing happened on which character — a rest taken, a spell cast, a card opened, a level gained — together with the character's class, species, level and ruleset. The app never sends a character's name, your notes, the names of items or trackers you typed yourself, a portrait, or the sheet's log. The legal basis is a legitimate interest in understanding how the app is used during early access (Art. 6(1)(f) GDPR); the same content blocker silences it, and the app works the same.
Hosting
The site is served by Vercel from its global network. Like every web host, Vercel keeps short-lived request logs that include IP addresses, for security and operation of the service.
The app
If you hold an account, your account details, your characters, your portraits and any content files you import are stored on Supabase in the European Union (Frankfurt). They are readable only by your own account; nothing you store is shared with other users or published. Every character can be exported as a file from the app at any time. To delete your account and everything in it, ask the person who invited you; deletion is done by hand while Sheetling is in early access.
Your rights
- Access to the data held about you, and a copy of it.
- Correction of anything inaccurate.
- Erasure: your invite request, or your whole account.
- Portability: your characters export as plain files.
- Objection to the analytics described above.
- A complaint to a data protection supervisory authority, if you believe your data has been handled unlawfully.
Changes
This notice changes when the service does. The date at the top says when it last did.