The short version
Realms Unbound is a personal project run by Tom Belajonas. Signing in with Google stores your email address, your name, your profile picture URL, and Google's internal account identifier. Everything else stored about you is content you create — your characters and campaigns. Nothing is sold, and nothing is shared with advertisers.
What is collected when you sign in
Sign-in uses Google OAuth. This service never sees or handles your Google password. When you sign in, Google sends a signed identity token containing:
- your email address, and whether Google has verified it;
- your display name and profile picture URL, if your Google account has them;
- a stable account identifier (Google calls this the subject).
The account identifier — not the email address — is what links you to your data, so that changing your email with Google does not detach you from your own characters.
What is stored while you use the service
- Your content — characters, campaigns, parties, notes and saved games.
- Sessions — a random session identifier in an HttpOnly cookie, an approximate expiry, your browser's user-agent string, and a one-way hash of your IP address. The hash exists so a session can be spotted moving between networks; the IP address itself is not stored.
- An audit log — sign-ins, registrations, and material changes to campaign state, so that if a campaign disagrees with what you remember there is a record to consult.
Cookies
Two, both strictly necessary, both HttpOnly and Secure. One holds a short-lived value used to verify that a sign-in came back from Google unaltered; it expires in ten minutes. The other is your session. There are no advertising or analytics cookies, and there is no third-party tracking on this site.
Where the data lives
On Cloudflare's infrastructure — Workers and D1 — under an account controlled by the project owner. No other processor receives your data.
AI features
Where the service uses AI, the text sent to the provider is the game context needed for that request — the current scene, the characters involved, the relevant rules. It is not your email address or account details. If you supply your own provider key, requests are made with your key and are subject to that provider's terms. AI features are optional and can be turned off without losing access to anything else.
What is never stored
- Passwords. Sign-in is Google's; this service has no password to lose.
- Payment card details. If paid plans arrive, a payment processor handles cards and this service stores only whether a plan is active.
Your choices
You can sign out at any time, which deletes the session on the server rather than only clearing the cookie. To have your account and its content deleted, email the address below and it will be removed.
Changes
If this policy changes materially, the date at the top changes and the change is announced on the site rather than made quietly.