Chronicler keeps your worlds on your own computer. Your vault (your pages, notes and images) never leaves your device, and nothing in this policy changes that. This policy explains the small amount of personal data that the Chronicler app and the chronicler.pro website do handle, why, and what you can do about it.
Who is responsible for your data
Chronicler is made by Michael Kirkland, an independent developer based in Spain, who is the data controller for everything described here. You can contact him at michael@chronicler.pro. In this policy, "we", "us" and "our" mean Michael Kirkland.
The short version
- The app sends nothing about you unless you choose to share anonymous statistics or you activate a license.
- The website collects what it needs to run community accounts and sell licenses: mainly your email address and what you choose to post.
- We don't sell personal data, show ads, or use analytics or advertising cookies.
- You can edit or delete your account yourself at any time.
The Chronicler app
Your vault. Everything you write in Chronicler is stored as files on your computer. The app never uploads it and we have no access to it.
Anonymous statistics, only if you agree. The first time you open the app, it asks whether you want to share anonymous statistics. If you say yes, it sends one message to our server containing:
- an installation ID, made by combining your computer's machine ID with a secret value and hashing it on your device, so the original ID can't be recovered
- the app version
- your operating system (Windows, macOS or Linux)
This is sent once per installation, and we use it only to count installations and see which operating systems people use. If you say no, nothing is sent. You can change your choice at any time in the app's settings. Because we can't tell which installation ID belongs to whom, we can't look up or delete an individual one.
License activation. If you enter a Community License key, the app sends the key and your computer's machine ID to Keygen, our license service, to activate the license on that computer.
Update checks. The app checks GitHub for new versions. Like any download, this shows your IP address to GitHub.
Legal basis: your consent for the statistics (GDPR Art. 6(1)(a)), and performing our agreement with you for license activation (Art. 6(1)(b)).
The website
Community accounts
When you sign up, we collect your email address, a password, a display name and a username. You can also add an avatar and a bio. Your password is stored only in hashed form by our database provider, Supabase, which also records the IP addresses used to sign in, for security.
Your display name, username, avatar, bio and join date are shown publicly on your profile. Your email address is never shown.
- Why: to create and run your account, and to send account emails such as sign-up confirmation and password resets.
- Legal basis: performing our agreement with you (Art. 6(1)(b)).
- Kept: until you delete your account.
What you post
Posts, comments, images, tags and likes are public once published. You also get notifications when people interact with your posts.
- Legal basis: performing our agreement with you (Art. 6(1)(b)).
- Kept: until you delete them or your account.
Images you upload can be viewed by anyone who has their web address as soon as you upload them, even before your post is published. They're kept in your image library, My Images, so you can reuse them in other posts. Deleting a post doesn't delete its images, but you can delete them from My Images at any time.
Deleting your account immediately deletes your profile, posts, comments, likes, notifications and uploaded images.
Moderation
Moderators review new posts before they're published. To keep the community safe, we keep each post's review status and any feedback from moderators, any account restrictions such as suspensions or temporary mutes, private moderator notes about accounts, and a reputation score ("mana") that you earn from likes.
- Legal basis: our legitimate interest in running a safe community (Art. 6(1)(f)), and our obligations under the EU Digital Services Act (Art. 6(1)(c)).
- Kept: while your account exists.
Buying a Community License
Stripe or PayPal handles your payment, and we never see your card or bank details. After you pay, we receive your email address and an order ID. We use your email address to:
- send you your license key, through our email provider, Resend
- record your purchase with Keygen, our license service, so we can help if you lose your key
Stripe and PayPal also process your data under their own privacy policies, for example to prevent fraud.
- Legal basis: performing our agreement with you (Art. 6(1)(b)), and keeping the records that Spanish tax law requires (Art. 6(1)(c)).
- Kept: for as long as Spanish tax and accounting law requires, generally four to six years.
Supporters list
If you support Chronicler on Patreon, we may thank you in the "Community Champions" section of our homepage, using the name you show on Patreon. If you'd rather not be listed, tell us and we'll remove you.
- Legal basis: our legitimate interest in thanking supporters (Art. 6(1)(f)).
Emails you send us
If you email us, we use your address and message to reply, and keep them for as long as we need to deal with your request.
Server logs
Our hosting provider, Vercel, records basic details of each request to the website (IP address, browser type, the page requested and the time) so we can keep the site running and secure. These logs are kept for a short time. Logs from license purchases can include the buyer's email address.
- Legal basis: our legitimate interest in keeping the website secure and fixing problems (Art. 6(1)(f)).
Cookies
We only set cookies that the website needs to work:
- Sign-in cookies (named
sb-…-auth-token), set when you log in so that you stay logged in. They're removed when you log out.
We don't use analytics or advertising cookies.
Some pages load content from other services, which may set their own cookies or see your IP address:
- PayPal: PayPal's payment buttons only load when you click "Pay with PayPal" on the homepage. PayPal may then set cookies to process your payment and prevent fraud. See PayPal's cookie statement.
- YouTube: videos on the Getting Started page only load when you click play, from YouTube's privacy-enhanced domain (youtube-nocookie.com). Their preview images load from YouTube's servers.
Who we share data with
We use these service providers to run Chronicler. They process data only on our behalf and only to provide their service:
| Provider | What for |
|---|---|
| Supabase | Accounts, sign-in, database and image storage |
| Vercel | Website hosting and server logs |
| Resend | Sending emails |
| Keygen | License records and activation |
| Upstash | Storing the app's anonymous statistics |
Stripe and PayPal handle payments and are responsible for their own processing. We share data with public authorities only when the law requires it. We never sell personal data.
Transfers outside the EU
Some of these providers are based in the United States or store data there. When personal data leaves the European Economic Area, it is protected by the EU–US Data Privacy Framework, where the provider is certified under it, or by the European Commission's Standard Contractual Clauses.
Your rights
Under the GDPR, you can ask us to:
- give you a copy of the personal data we hold about you, including in a portable format
- correct it
- delete it
- restrict or object to how we use it
- stop using it where you gave consent (this doesn't affect what we did before)
You can edit your profile and delete your account yourself from your profile settings. For anything else, email michael@chronicler.pro and we'll reply within one month.
If you think we've mishandled your data, you can complain to the Spanish data protection authority, the Agencia Española de Protección de Datos, or to the authority in the country where you live.
Children
You must be at least 14 to create an account, which is the age of digital consent in Spain. If we learn that an account belongs to someone younger, we'll delete it.
Security
Connections to the website are encrypted, and passwords are stored only in hashed form. Only the developer can see account email addresses. Moderators see only what they need to moderate.
Changes to this policy
If we change this policy, we'll update the date at the top. If a change is significant, we'll tell account holders by email or with a notice on the site.