← back to the app · terms of service · English · Italiano

Privacy notice

D&D Encounter Balancer · last updated 16 October 2026

In short: the balancer runs entirely in your browser. Your party, encounters, travel tables and experience ledger are never sent to any server — they stay on your device. We do not profile you, there is no account to create. The one cookie we set exists only if you connect Google Drive: it keeps you signed in, and the permission it unlocks is kept on our server, encrypted, until you disconnect — the only thing of yours we hold, and only if you ask.

Who is responsible

The data controller is TirateIniziativa, which runs this project as non-commercial fan content. Contact: [email protected].

What stays in your browser

The app saves a few entries in the browser's own storage. These are not cookies and are never transmitted.

entry	what it holds	why
`balancer.state.v1`	the document you wrote: parties, characters, encounters, travel tables, experience, language and filters	so your work is still there after you close the tab — it is the very service you asked for by using the app
`balancer.lastVisitDay`	a date, e.g. `2026-09-27`	so the same visit is not counted twice on the same day
`balancer.creatures.v1`	the creatures you wrote or imported into your own library	so your own monsters are there at the next session: the app has no server to keep them on
`balancer.play.v1`	what a session with the players shows: hit points as numbers or as a label, and whether enemies stay hidden before initiative	so the choice is already made the next time you open one
`balancer.play.lang`	the language chosen on the page a player opens	so a player reads in their own language without touching anything of yours
`balancer.play.host` (sessionStorage)	the key of the session you have open, for this tab only	so reloading the page does not lose control of a link already in your players’ hands. It disappears when you close the tab

You can clear everything at any time, from Save and load → Start over inside the app or by clearing the site data in your browser. Neither requires telling us, because we know nothing about it.

If you export a JSON file or a link, your browser produces them and they go wherever you send them. In the case of a link, the document travels in the part of the address after the #, which browsers never transmit to a server — not even we can see it.

What reaches us: the visit counter

At the bottom of the page there is a public visit counter. When you open the app, your browser sends our server a request that says only "one more visit". The server keeps monthly totals only — for example 2026-09: 412 — plus the running total. No IP addresses, identifiers, cookies, device or referrer information are stored, and there is no way, not even for us, to trace those numbers back to a person or to know how many pages anyone viewed. The "once a day" de-duplication happens in your browser, using the date described above, and is never sent.

The session with the players, if you open one

From the Fight tab you can open a session and pass the link to your players, so that they can see whose turn it is on their own phones. It is the only feature in which any game data passes through our server, and it never starts by itself: until you press "Open the session", nothing leaves your browser.

What leaves is only the projection, built in your browser before anything is sent: the names you typed, the initiative order, health in the form you chose (the numbers, a label such as "bloodied", the damage taken, or nothing) and the conditions you have not hidden. Real monster hit points, notes, stat blocks, combatants you have hidden and armour class you have not revealed are not sent: it is not a screen hiding data it received — that data never leaves. Your document, party, encounters and experience ledger never pass through here.

The names you type may be your players' real names: you choose them, and they stay on the server for the length of the session. There is no sign-in and no profile — whoever has the link reads, and that is all: nothing can be written from the phones. The session address is random and new every time, is indexed nowhere, and is not sent to the server by the browser that opens it, because it lives in the part after the #.

The session is ephemeral. The server keeps only the last state you sent, so it can show it to someone who joins late or reloads, and erases it by itself after half an hour of silence. Pressing "Close the session" erases it at once. No history is kept, no list of sessions, and no record of who connected.

Hosting

The site and the counter run on Cloudflare infrastructure (Cloudflare, Inc., United States), acting as data processor. Like any hosting provider, Cloudflare transiently processes the technical data needed to deliver pages and protect the service from abuse, including the request's IP address. See Cloudflare's privacy policy.

Typefaces

The pages use two typefaces (Cinzel and EB Garamond), and the font files are served from this site, alongside everything else. They used to come from Google Fonts, which meant your browser contacted Google's servers before you had touched anything; since 17 October 2026 it does not. The site makes no third-party connection unless you connect Google Drive yourself, or press the Ko-fi link in the footer.

Google Drive, if you connect it

Connecting Google Drive is optional and never automatic: it starts only when you press “Sign in with Google”, and until you do, the site does not contact Google at all: there is no Google script on the page, and the sign-in window opens only when you press the button. When the page opens it asks our own server whether you are signed in; only if you are does it reach Google, to read the account name and your files.

If you do connect it:

one permission is requested, the drive.file scope, which grants access solely to files this app created and to nothing else in your Drive: the rest of your files stay invisible to us;
your email address is never requested, nor is any other profile data. The only thing we read about you is the display name of the account, and only to show you which Drive you are writing into — the same sign-in serves every tool, so it may well be an account you chose somewhere else, and saving into the wrong Drive would otherwise fail silently. That name stays in this browser for the session, is never stored and never reaches us. The email address is not merely ignored: the request we send to Google asks for the name alone, which anyone can verify by looking at the traffic;
documents travel straight from your browser to Google, never through us: we keep no copy and never see them;
the permission Google issues is kept on our server — the TirateIniziativa home page’s Worker, on Cloudflare’s infrastructure — encrypted with a key that exists only there, so that one sign-in serves every TirateIniziativa tool for thirty days. When this app needs to reach your Drive, it asks that server for a short access token (one hour), which it keeps in memory only. No name, no email address and no profile are stored with it: it is a permission, not an account;
the sign-in lasts thirty days and starts again from thirty every time you come back with fewer than fifteen left; unused, it expires and is deleted. It is also deleted as soon as Google turns the permission down, and “Disconnect” deletes it at once and revokes the permission at Google — for every tool and every device. Besides the cookie described below, all that stays in the browser is the fact that you said yes, plus the folder identifiers, which open nothing on their own;
files are created in the TirateIniziativa_AppDataStorage folder of your Drive. They are yours: move, rename or delete them whenever you like, and “Disconnect” revokes the permission without touching them.

Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Transfers, retention, minors

The monthly visit totals contain no personal data and are kept indefinitely, since their purpose is to show how often the tool has been used. A Google Drive sign-in is kept for thirty days from your last visit, or until you disconnect. The state of a session with the players stays on the server while the session is alive: it erases itself after half an hour of silence, or at once if you close it. The data in your browser is kept by you, for as long as you like. The service is not specifically directed at children and does not knowingly collect data about them — it does not knowingly collect data about anyone.

Your rights

Regulation (EU) 2016/679 gives you rights of access, rectification, erasure, restriction, objection and portability. In practice almost no personal data here can be subject to them — the one thing we hold, the encrypted Drive permission if you connected it, is deleted by “Disconnect”, with no need to ask us — and for the rest: what you write is on your device and you delete it yourself. If you think something is wrong you can write to the address above, or lodge a complaint with the Italian Data Protection Authority.

Cookies

One cookie, and only if you connect Google Drive. Until you do, this site sets none at all — neither technical nor profiling, neither first- nor third-party. The local-storage entries described above are not cookies and never leave your device.

cookie	what it holds	why	how long
`ti_session`	a random key that opens your Drive sign-in on our server — not the Google permission, no name, no email address, no profile. It is `HttpOnly`: not even our pages’ scripts can read it	so that one sign-in covers every TirateIniziativa tool: it belongs to `tirateiniziativa.com` and is sent only to its sign-in address (`/api/auth`), where this app asks for a fresh permission instead of asking you to sign in again	thirty days, renewed when you come back. Deleted when you press “Disconnect”, or when Google turns the permission down

It is a strictly necessary cookie: it exists only to deliver the function you asked for by pressing “Sign in with Google”, it is not used to profile you and it is never shared with anyone. That is why no consent banner is shown — connecting Drive is itself the consent, and it can be withdrawn at any time with “Disconnect”.

What it costs, said plainly. Unlike the local-storage entries above, a cookie travels: the browser sends it to our sign-in address whenever a tool asks for a permission. The server keeps only its fingerprint (a SHA-256 hash), never the key itself, so even the stored sessions open nothing on their own — but the cookie does leave your device, which those entries never do. We accepted that because it is the only way a single sign-in can serve every tool. If you would rather it did not exist, do not connect Drive, or press “Disconnect”: it is deleted immediately and the app goes on working exactly as before.