Privacy policy

Updated 2 October 2026

Website: https://heroquest-card-templates.done-well.co.uk

HeroQuest Card Templates is a free, independent community project run by Mark Forster. For privacy questions, contact heroquest-card-creator@markforster.info or the HeroQuest Card Creator Facebook page.

Information we use

Google or Facebook supplies your account identifier, name, profile image and, where available, email when you sign in. We never receive your provider password. We store your provider identifier, display name, avatar link or uploaded avatar, account creation date, and any username and biography you add. Email can be included in your encrypted sign-in cookie; it is not stored in our user database.

We store your uploaded PDFs, generated previews, titles, descriptions, tags, original filenames, sizes, page counts, file fingerprints and export-marker results. We also keep submission history, reports, moderation notes, account restrictions and administrative records needed to operate the site. Messages you send us are used to answer your request.

Public sharing

Your profile name, avatar, username and biography are public. Published PDFs and their listing details can be viewed and downloaded without an account and indexed by search engines. Information embedded in your PDFs is included in the shared file. Only submit material you intend to share publicly. Pending submissions are available to you and site administrators.

Why we use information

We use information to provide sign-in, manage accounts, attribute contributions, host and display submissions, respond to requests and prevent abuse. Our lawful basis is legitimate interests in running and protecting this community service. You can object to this processing using the contact details above.

Storage and other services

Account information and uploaded files are stored in the United Kingdom on infrastructure used to operate this website. Access to non-public information is limited to those administering it. This service is not backup storage: keep your original files.

Google and Meta handle sign-in under their own privacy policies. Provider-hosted avatars and the embedded itch.io widget make requests to those services, which receive connection information such as your IP address and browser details. External sites have their own privacy practices.

Activity records and analytics

We do not use visitor analytics or statistics tracking. We keep submission, report and administrative records to operate and moderate the service. The web server produces access logs, which can include connection addresses, requested URLs, response status and browser details. These support operation and troubleshooting. Technical error diagnostics may also be produced when an operation fails.

Cookies

Authentication cookies keep you signed in and protect the sign-in process. Sessions last up to seven days and can renew while you use the service. Signing out clears your current session. Account deletion invalidates access through other sessions too.

Retention and deletion

We keep account information while your account exists and uploaded files until removed. Deleting your account removes its profile, provider connections, PDFs, previews and related database records. Moderation records relating to other accounts may remain. Copies already downloaded by others are outside our control.

There are currently no routine backups. This free prototype may change or close; availability is not guaranteed. If the service closes, remaining personal data will be deleted unless a specific legal requirement requires retention.

Your choices and rights

You can edit your profile and delete your uploads. See account and data deletion for complete removal or requests if you cannot sign in. Depending on the circumstances, you can ask for access, correction, erasure or restriction of your information. You can object to processing based on legitimate interests. Where another applicable basis provides portability or withdrawal of consent rights, you can exercise those too.

Changes to this policy

We will update this policy when our practices change, including if we introduce analytics, additional logging or backups. The date above identifies the latest update.