Privacy · Arkham Horror RPG Ledger

Privacy policy

Last updated October 6, 2026

Arkham Horror RPG Ledger is a free, hobby site for keeping Arkham Horror RPG character sheets and campaign notes in sync for a play group. It is run by one person, not a company. This page explains what it keeps about you and why.

What the site keeps

Your account. Your email address, and your name if you sign in with Google, are held by Firebase Authentication so you can sign in. The site itself stores the username you choose, the icon or profile photo you pick (other signed-in users can see it), when you joined, and roughly when you last visited (so the site's owner can see how many people are active).
Your campaigns. Campaign names and pictures, who belongs to each one and their role, investigator sheets, the Journal, house rules, and the GM's scenes, enemies, clues (including any pictures attached to them), notes and activity log.
Invites. When an owner invites someone by email, that email address is stored with the invite until it's accepted, declined or cancelled, and the site sends that address one email saying who invited them and to which campaign.
Emails. The site sends email from arkhamrpgledger@gmail.com, through Gmail: invites, and a reminder to campaign members the day before a scheduled session. To send reminders at the right local time it keeps your time zone. You can turn reminders off under Your account.
Pictures. Portraits, profile photos, campaign pictures, handouts and gallery pictures are stored as files in Google Cloud Storage. Each has a long random link; anyone who has a picture's link can open it, and the site only shows links to the people who can see that picture.
Calendar links. Add to calendar can give your calendar app a link to the campaign's next session. That link shows only the campaign name and the session's time and place, and works for anyone who has it.
Notifications. If you turn on notifications on a phone or computer, the site stores that device's push address (a long code from your browser) with your account so it can send reminders, revealed clues and, if you choose, fight turns. Turning notifications off, or deleting your account, removes it.
Address suggestions. When the owner or GM types a place for the next session, what they type is sent to Google Places to suggest matching addresses. Nothing else is sent, and the place they choose is visible to everyone in that campaign.
Feedback. If you use Send feedback, your message is saved along with the page you were on, your browser type and your account ID. Only the site's owner can read it.
Contact messages. If you use the Contact form, your message, the email address and name you give, and the page and browser you were on are saved and emailed to the site's owner, who replies from his own email. Your address is only used to reply. Only the site's owner can read these.
Error reports. While the site is in beta, if something breaks while you're signed in, the site records the error message, the page, your browser type and your account ID so it can be fixed. Only the site's owner can see these, and they're cleared once dealt with.
On your device. Your browser keeps a copy of recent campaign data so pages load quickly, plus your sign-in. If you try the site without an account, that campaign is kept only in your browser and isn't sent to the site unless you save it to an account. Nothing is used for advertising or tracking, and there are no analytics.

Who can see it

Members of a campaign can see its investigator sheets, Journal and anything the GM has shown to players. Only the GM can see the GM's private material, such as notes and hidden enemies and clues.
Other signed-in users can see your username, for example on an invite. They can't see your email address.
The site's owner can see the stored data through the Firebase console, and only looks when fixing problems or handling a request from you.
Nothing is sold or shared with anyone else.

Services the site uses

The site runs on Google Firebase (hosting, sign-in, the database, picture storage and the server code that sends emails), so your data is stored on Google's servers. Google also handles your IP address and browser details when you visit, as any web host does.

This site is protected by reCAPTCHA, which checks that visits come from a real browser rather than a bot. The Google Privacy Policy and Terms of Service apply.

Removing your data

You can leave a campaign, give up an investigator, or (as an owner) remove investigators from inside the site. To delete your account, click your name at the top of the page and choose Delete my account. That removes your username and sign-in, deletes campaigns you own, and takes you out of the others. To ask what's stored about you, email maniac78@gmail.com.

Investigators you made in someone else's campaign belong to that campaign's story, so the owner may keep the sheet after you leave unless you ask for it to be removed.

Changes and questions

If this policy changes, the date at the top will change with it. Questions? Use the contact form.