Privacy Policy

Data Controller

The legal data controller is pending final legal review. Until a formal entity and contact channel are published, this page is a non-indexed implementation placeholder and should not be treated as final legal notice.

Data We Collect

When you use Lazy Lands, we collect:

• Email address — used for authentication and product communications.
• Campaign content — the notes, NPCs, factions, session logs, and other content you create inside the application. This data is yours and is only accessible to you.
• Authentication tokens — technical tokens (Supabase) stored in your browser to maintain your session.

Legal Basis

Processing is based on GDPR Art. 6.1.b — processing is necessary for the performance of a contract to which you are party (the Lazy Lands terms of service), or in order to take steps at your request prior to entering into a contract.

Your Rights

Under GDPR, you have the following rights regarding your personal data:

• Right of access — request a copy of the personal data we hold about you.
• Right to rectification — request correction of inaccurate data.
• Right to erasure— request deletion of your personal data ("right to be forgotten").
• Right to portability — receive your data in a structured, machine-readable format.
• Right to object — object to processing based on legitimate interests.

To exercise any of these rights before our formal contact channel is published, reach out via privacy@lazylands.app (temporary inbox, monitored during early access).

Data Retention

We retain your data for as long as your account is active. Deleting your account removes all campaign data. Authentication logs are retained for up to 90 days for security purposes.

No Third-Party Sharing

We do not sell, rent, or share your personal data with third parties for marketing purposes. We use Supabase (an infrastructure provider) to store and process data; they act as a data processor under a data processing agreement.