Privacy Policy

This policy applies to all tools published under Bag Of Holding Tools, including Dynasty Tree Builder. All tools share the same account system, so one policy covers all of them. It explains how your personal data is collected, processed and retained, in accordance with French Law no. 78-17 of 6 January 1978 ("Informatique et Libertés") and Regulation (EU) 2016/679 ("GDPR").

"Personal data" means any information that can identify you directly or indirectly, such as your email address.

The data controller is the Site's publisher: an individual acting on a personal and non-commercial basis, publishing under the pseudonym mKzz in accordance with article 6-III-2 of the French LCEN ("We"). Their full details are held by the host.

The data controller can be reached at any time at contact@example.invalid. That address is the single point of contact for every request concerning your data.

You can use every tool without creating an account. In guest mode, your data (characters, relationships and any content you create) is stored only in your browser (localStorage) and is never sent to our servers. Exporting to PNG or JSON happens entirely on your device. We have no access to guest-mode data.

Guest mode is not exempt from the optional audience measurement described in section 5. That covers browsing only (pages viewed, device type), never the content you create, and it stays off until you have accepted it.

Creating an account is optional and only exists to save your work to the cloud. When you sign in with Google, we collect:

• Your email address (provided by Google);
• The data you create in each tool (e.g. characters, relationships, roles and custom names for Dynasty Tree Builder).

We do not collect your name, profile picture, or any other Google account data beyond your email address. The legal basis for this processing is the performance of the contract you enter into by creating an account. Your data is used solely to identify you and let you access your work across sessions and devices.

Your account data is processed by the following providers, solely to operate the service:

• Supabase (EU region) — authentication and database hosting;
• Vercel — application hosting;
• Google — sign-in (OAuth) provider.
• Google Analytics — audience measurement, only if you have accepted it. Nothing is sent to it before you agree, and your content is never sent to it at all. See the Cookie Policy.

Your data is never sold, rented, or shared with any third party beyond these providers.

Account data is retained for as long as your account exists. You may request deletion of your account and all associated data at any time by writing to contact@example.invalid. Deletion is permanent.

We implement appropriate technical and organizational measures to preserve the security, integrity and confidentiality of your data and to prevent unauthorized third-party access.

Your account data is stored on Supabase servers, in a region located within the European Union.

Vercel and Google are based in the United States. Where your data is transferred outside the European Union, that transfer is covered either by an adequacy decision (including the EU–US Data Privacy Framework) or by the standard contractual clauses approved by the European Commission.

Under the GDPR, you have the following rights:

• Right of access, rectification and erasure of your data;
• Right to restrict processing;
• Right to data portability (receive your data in a machine-readable format);
• Right to object to processing;
• Right to withdraw your consent at any time;
• Right to define directives on what happens to your data after your death.

You can exercise these rights by writing to contact@example.invalid. We reply within one month of receiving your request.

You have the right to lodge a complaint with a supervisory authority — in France the CNIL — if you believe the processing of your data breaches applicable law.

Some tools let you enter information about other people (for example family members). You are responsible for having the right to enter that information — see our Terms of Use. If a third party wants information about them removed from an account they do not control, they can contact us and we will forward the request to the account holder or act on it directly where required by law.

Our tools are not directed at children under 15. If you believe a child under 15 has created an account, contact us and we will delete it.

We may update this policy as tools are added or changed. Changes take effect upon publication, reflected in the last-updated date above.

Any question about this policy: contact@example.invalid.