Your privacy matters. This policy explains what personal information StatBlocker collects, how we use and share it, and your rights. StatBlocker is operated from Ontario, Canada, and handles personal information in accordance with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA).

1. Information We Collect

• Account data: Your username, email address, chosen role (GM or Player), a friend code, and your account picture. If you created your account with a password, we store it only as a hash. If you sign in with Google or Discord, we also store that provider's account identifier so we can recognise you on your next visit, and we save a one-time copy of your profile picture from that provider as your account picture.
• Content data: Characters, creatures, homebrew, campaign worlds, calendars, parties and invite links — plus files you upload for a party, including battlemap and prop images, music, and NPC voice clips.
• Shared character links: If you make a link to show someone a character, we store a copy of that character sheet as it stood when you made the link, along with a name for it. Anyone holding the link can read that copy — the link is the only key. Shared characters are not listed, indexed, or searchable anywhere on the Service, and nothing but the link itself leads to one. You do not need an account to make a link, so the copy need not belong to anyone; if you happened to be signed in, we note which account it came from.
• Messages: Direct messages you exchange with other users are stored so they can be delivered and displayed.
• Subscription & billing data: Your subscription tier and status, the customer and subscription identifiers issued by our payment processor, and a record of billing events. Your payment-card details are collected and processed directly by our payment processor — we never receive or store your full card number.
• AI usage data: The inputs you submit to AI features, which are transmitted to the provider to produce your result, and a meter of how many generations you have run and how large they were. We do not store the text of your AI prompts in our database.
• Activity data: When your account was created, the last time you used the Service, and whether you have finished the in-app tutorial.
• Technical & log data: As with any website, our hosting and infrastructure providers process your IP address, browser and device type, and request details in their server logs, so the Service can be delivered, secured, and debugged.
• Support enquiries: If you use our contact form, the name, email address, subject, and message you submit are sent to our support inbox by email.
• Onboarding measurement: Which steps of our introductory flows a browser reaches — the choice made on the landing page, whether a walkthrough was offered and taken, whether a first creature or character was saved. Each is recorded against a random identifier your browser generates for itself and keeps for 30 days. That identifier is not derived from your address, your device, or anything about you; we do not link it to your account; and it is deleted when you log out. We use it to find where people get stuck, and for nothing else.

We do not run advertising trackers, third-party analytics scripts, or profiling of any kind, and we do not follow you around the Service page by page. The onboarding measurement above is first-party, anonymous, and confined to those introductory steps.

2. How We Use Your Information

• To provide and improve the Service (saving your content, syncing across devices)
• To manage party features (sharing content between GMs and players) and to deliver messages
• To show a shared character to whoever opens the link you made for it, and to nobody else
• To process subscriptions, payments, and generation credits
• To operate the optional Discord integration, if you choose to link your Discord account
• To secure the Service, prevent abuse, and troubleshoot problems
• To understand how visitors move through our introductory flows, and where people get stuck
• To send you service-related messages, and to comply with our legal obligations
• We do not sell your personal information, and we do not use your content or your AI prompts to train any AI model of our own.

3. AI Features

StatBlocker uses third-party AI providers to power content-generation features:

• Text generation (subclasses, stat blocks, and similar) is powered by the Anthropic (Claude) API.
• Image generation (such as creature token art) is powered by the OpenAI API.
• When you use an AI feature, your input is transmitted to the applicable provider through our infrastructure to generate a result. Content you choose to save is stored with your account. We record the size and type of each request so we can meter your credits, but we do not keep the text of your prompts.
• Each provider processes data under its own terms — see Anthropic's privacy policy and OpenAI's privacy policy. Please avoid entering sensitive personal information into AI prompts.
• AI output can be inaccurate or unbalanced. Review anything you generate before you bring it to the table.

4. Third-Party Services & Sub-processors

• Anthropic — AI text generation.
• OpenAI — AI image / token generation.
• Cloudflare — Serverless infrastructure that routes AI requests and helps secure and deliver the Service.
• Stripe — Processes subscription payments (we do not store full card details). We send Stripe your email address, username, and account identifier so your subscription can be matched to your account.
• Google — Powers the "Continue with Google" sign-in button. If you use it, Google confirms your identity to us and we receive your email address, name, and profile picture. Google is contacted only when you press that button — our pages do not load anything from Google otherwise (see Section 7).
• Discord — Powers the "Continue with Discord" sign-in button and the optional community integration described in Section 5.
• Email delivery provider — Sends verification, password-reset, notification, and support email on our behalf.
• Hosting & database provider — Stores your account and content data.

Some of these providers operate in the United States and elsewhere, so your information may be processed or stored outside Canada (see Section 11).

5. Discord Integration

Linking your Discord account is optional, and nothing below happens unless you choose it. If you do link Discord:

• We store your Discord account ID and Discord username so we can recognise the link.
• Our bot can add you to the StatBlocker Discord server.
• Our bot assigns you a role on that server matching your subscription tier. This means your subscription tier is visible on that Discord server, including to other members who can see roles.

You can leave the server or stop using the integration at any time. Deleting your StatBlocker account also removes the roles our bot assigned.

6. Email Communications (CASL)

We may send you service-related messages (such as account, security, and billing notices) that are necessary to operate the Service. We will only send you marketing or promotional emails with your consent, as required by Canada's Anti-Spam Legislation (CASL). Every marketing email identifies us and includes an unsubscribe link, and you can opt out at any time.

7. Cookies, Local Storage & Third-Party Content

Cookies. We use a small number of first-party cookies and no third-party ones. sb_token keeps you signed in and lasts up to 7 days. sb_oauth_state lasts about ten minutes and exists only to protect the Google and Discord sign-in flows against cross-site request forgery. sb_acq lasts 30 days and records how you first reached us — any campaign tags on the link you followed, the site that referred you, and the page you landed on — so we can tell where visitors come from; it is first-party measurement only, it does not follow you to other sites, and blocking or clearing it costs you nothing. sb_home_intro_seen_v simply remembers that this browser has already been shown the welcome message on the home page. We use no advertising or third-party analytics cookies, and we do not sell or share any of this with advertisers.

Local storage. Your browser's local storage holds your preferences and a working copy of your content, so the app loads quickly and keeps working if your connection drops. When you log out, we clear that working copy and everything else belonging to the account from this browser, keeping only device preferences such as your chosen theme — so the next person to sign in on a shared computer starts clean. The onboarding measurement described in Section 1 keeps its random identifier here rather than in a cookie, so it is never attached to a request you did not mean to send, and the logout wipe removes it with everything else.

No third-party content. StatBlocker serves its own fonts and JavaScript from its own servers. Loading a page does not make your browser contact Google, a content-delivery network, or any other outside party, so nobody outside StatBlocker learns your IP address merely because you visited. The only outside services your information reaches are the ones named in Section 4, and only when you use the feature that needs them.

8. Data Security & Breach Notification

We use reasonable technical and organizational safeguards to protect your information, including hashed passwords and encrypted (HTTPS) connections. No system is perfectly secure. If a breach of security safeguards creates a real risk of significant harm to you, we will notify you and the Office of the Privacy Commissioner of Canada as required by PIPEDA, and we keep records of such breaches.

9. Data Retention & Deleting Your Account

We retain your data for as long as your account is active.

A shared character link keeps its own clock: 30 days after you make it, the link stops working and the copy behind it is deleted. You can also take it down sooner. When we hand you the link we hand you a private revoke key with it — keep that key and you can withdraw the share at any time, whether or not you have an account. Once a link has been revoked or has expired, opening it shows nothing, exactly as though it had never been made.

Two things outlive a deletion. Residual copies inside our routine backups age out within about 30 days. Transaction records that we are legally required to keep for tax and accounting are retained with your account identifier removed, so they are no longer linked to you. Anonymized or aggregated data may also be retained for analytics.

If you would rather we carried out the deletion for you, contact us using the details in Section 13.

10. Your Rights

Under PIPEDA — and, where they apply to you, the GDPR / UK GDPR and CCPA / CPRA — you have the right to:

• Access the personal information we hold about you
• Request correction of inaccurate data
• Delete your account and its data — do it yourself from Profile → Settings → Danger Zone, or ask us to
• Obtain a copy of what you have created — the profile Settings tab has an Export Creations option, and we will provide a fuller export on request
• Withdraw consent for data processing at any time

To exercise any of these rights, contact us using the details in Section 13. You also have the right to complain to the Office of the Privacy Commissioner of Canada.

11. International Users & Cross-Border Data

Your information may be processed or stored in Canada and in other countries (including the United States) where our service providers operate, and may be subject to the laws of those countries.

If you are in the European Economic Area or the United Kingdom, you have rights under the GDPR / UK GDPR, including access, correction, erasure, portability, and objection. Our legal bases for processing are: performance of a contract — running your account, storing your content, producing the AI results you ask for, and taking payment; legitimate interests — securing the Service, preventing abuse, diagnosing faults, and measuring anonymously how our introductory flows are used; consent — optional extras such as linking Discord, and any marketing email; and legal obligation — keeping tax and accounting records. If you are a California resident, you have rights under the CCPA / CPRA; we do not sell or share personal information as those laws define it. To exercise these rights, contact us using the details below.

12. Children's Privacy

StatBlocker is not directed to children under 13, and we do not knowingly collect personal information from them. Every route that creates an account — email sign-up, Google, Discord, and party invitations — asks you to confirm that you are at least 13 first, and we do not create the account without that confirmation. We do not ask for your date of birth. If you believe a child has provided us with personal information, contact us and we will delete it.

13. Contact

For privacy questions or requests (including access, correction, or deletion), contact us at: support@statblocker5e.com

Not Affiliated with Wizards of the Coast

SRD Content

This product includes content from the Systems Reference Document 5.1 ("SRD 5.1") by Wizards of the Coast LLC, available under the Creative Commons Attribution 4.0 International License.

The SRD is a subset of the full rules and does not include all content from published sourcebooks. StatBlocker provides only SRD-legal content plus user-created homebrew.

AI-Generated Content

Some features of StatBlocker use AI to help generate content such as subclasses, races, and stat blocks. This content is unofficial homebrew — not balanced, playtested, or approved by any game publisher.

• AI-generated content may contain errors, imbalances, or inaccuracies
• Always review and adjust AI-generated content before using it in a game
• We make no guarantees about the quality, balance, or accuracy of generated content

No Professional Advice

StatBlocker is a hobby tool for tabletop gaming. Nothing on this site constitutes legal, financial, or professional advice of any kind.

Use at Your Own Risk

Your use of StatBlocker, including any content you create or generate through the service, is entirely at your own risk. We disclaim all warranties, express or implied.

StatBlocker is built by a very small team, and we want it to be usable by as many people as possible. This statement sets out what we aim for, where we know we fall short, and how to reach us if something on the site gets in your way.

1. Our Goal

We aim to meet the Web Content Accessibility Guidelines (WCAG) 2.1, Level AA. We treat that as a target we are working toward rather than a claim of full conformance: the site has not been independently audited, and parts of it do not meet the standard yet.

2. Known Limitations

Being honest about the gaps is more useful than a blanket claim. The areas we know need work:

• Play mode and battlemaps are drawn on a canvas and are driven by pointer input — dragging tokens, drawing walls, painting fog. These are not usable by keyboard or screen reader today.
• Drag-and-drop and hover are used in a few places to reorder or preview things. Where that happens, we are working to make sure there is always another way to do the same job.
• Colour contrast varies between the themes on offer, and none of them is a dedicated high-contrast mode. Switching themes from the control at the top of the page may help in the meantime; a proper high-contrast option is on our list.
• AI-generated images (such as creature tokens) are produced on request and do not carry descriptive alternative text.

3. Accessible Formats and Support

If you need information from StatBlocker in another format, or need help with something the site makes difficult, contact us and we will work with you to provide it in a way that suits you, at no extra cost. This includes the content of these legal pages.

4. Feedback — Tell Us About a Barrier

If you hit something you cannot use, please tell us. Reports from people who actually ran into the problem are the most useful thing we get, and they go to the top of the list.

• Email: support@statblocker5e.com
• Or use our contact form

Please tell us the page you were on, what you were trying to do, and what got in the way — including any assistive technology you were using. We aim to reply within 10 business days.

5. Ontario (AODA)

StatBlocker is operated from Ontario, Canada. We are a small organization under the Accessibility for Ontarians with Disabilities Act, and we provide accessible formats and communication supports on request as described above. This statement is published voluntarily, and we update it as the site changes.

6. Contact

Accessibility questions, requests, or complaints: support@statblocker5e.com