Last updated: April 2026
Ruven Czenkusch, An der Brunnenstube 15/12, 55120 Mainz, Germany
Email: support@combatcompanion.app
Encounter data, saved characters, combat history and app settings are stored locally in your browser (localStorage). If you are not signed in, all data stays in your browser and never leaves your device. If you are signed in, your data is additionally synced to our cloud database to enable access across devices — see section 4.
Free users who are not signed in: data stays entirely on your device.
If you submit your email address for launch notifications, your email address is stored with Convex Inc. (San Francisco, CA, USA) under the same conditions as section 4. Legal basis: Art. 6(1)(a) GDPR (consent via explicit checkbox at time of signup). You may withdraw your consent at any time by contacting support@combatcompanion.app.
When you create an account, we send transactional emails (e.g. account confirmation, subscription confirmation, cancellation confirmation, account deletion confirmation) to the email address you provided. These emails are sent via Resend Inc. (548 Market St, PMB 38477, San Francisco, CA 94104, USA). Legal basis: Art. 6(1)(b) GDPR (performance of contract). Data transfer to the USA is governed by Standard Contractual Clauses (SCCs). See Resend Privacy Policy.
If you create an account, your email address and account data are processed. Legal basis: Art. 6(1)(b) GDPR (performance of contract).
Authentication is provided by Clerk Inc. (San Francisco, CA, USA). Data transfer to the USA is governed by Standard Contractual Clauses (SCCs). See Clerk Privacy Policy.
When you create an account, your email address, account status, and subscription data are stored with Convex Inc. (San Francisco, CA, USA). Legal basis: Art. 6(1)(b) GDPR (performance of contract).
If you are signed in, your app data is automatically synchronised to Convex to enable cross-device access. This includes: saved encounters, combat history, saved player characters (Combat and Player Companion), custom monsters, monster favourites, lair action templates, and player groups. All data is stored as encrypted JSON. Legal basis: Art. 6(1)(b) GDPR (performance of contract). Data transfer to the USA is governed by Standard Contractual Clauses (SCCs). See Convex Privacy Policy.
This applies to the Player Companion (/player). When you join a Game Master's live session — usually by entering or opening its session code — the combat-relevant data of your character is transmitted to that Game Master. This includes your character's name, ability scores, current and maximum hit points, armour class, active conditions, combat resources, and character profile.
The recipient is the respective Game Master, i.e. another user, whom you select yourself by entering or opening the session code. This sharing enables the Game Master and your fellow players to see the same combat state during play.
For this purpose the data is stored temporarily on the server side with our processor Convex Inc. (San Francisco, CA, USA) on its servers. Data transfer to the USA is governed by Standard Contractual Clauses (SCCs). Legal basis: Art. 6(1)(b) GDPR (performance and use of the service) and, insofar as your act of joining constitutes consent, Art. 6(1)(a) GDPR.
Your session data is deleted as soon as the live session ends or is discarded, and in any case automatically once the session has been inactive for more than 24 hours. If you delete your account, the live-session entries you hosted are removed as well (see section 8).
Payments are processed by Stripe, Inc. (San Francisco, CA, USA). We never store your payment card details — they are handled directly by Stripe. Stripe is PCI DSS Level 1 certified. Data transfer to the USA is governed by SCCs. See Stripe Privacy Policy. Legal basis: Art. 6(1)(b) GDPR.
This website is hosted by Vercel Inc. Technical connection data (IP address, timestamps) may be processed as part of hosting. See Vercel Privacy Policy.
Monster search data is retrieved from the public Open5e API. Search queries are transmitted to their servers. No personal data is included.
You have the right to access, rectify, erase, restrict processing, and data portability (Art. 15–20 GDPR). To exercise these rights, contact us at support@combatcompanion.app. We will respond within one month (Art. 12(3) GDPR).
You may lodge a complaint with the supervisory authority responsible for our place of business: Der Landesbeauftragte für den Datenschutz und die Informationsfreiheit Rheinland-Pfalz, Hintere Bleiche 34, 55116 Mainz, www.datenschutz.rlp.de (Art. 77 GDPR).
Where processing is based on your consent (e.g. email signup), you may withdraw that consent at any time by contacting support@combatcompanion.app. Withdrawal does not affect the lawfulness of processing prior to withdrawal (Art. 7(3) GDPR).
A data protection officer is not required under § 38 BDSG for our current scale of processing. For all privacy inquiries contact the data controller above.