Privacy policy

Who is responsible

The Hero’s Journey is responsible for the personal information used to run its Dungeon Master service in Worcester. In this policy, “I” means the Dungeon Master operating The Hero’s Journey, acting as the data controller for your enquiry and booking records.

You can raise a privacy question or request with the DM in person, reply to an email you have received from The Hero’s Journey, or write to:

You do not need to make a booking or complete the player questionnaire to exercise your privacy rights.

Information collected

• Enquiries: your name, email address, group size, adventure choice, requested session, availability, D&D experience and any message you submit. The site also stores an enquiry reference, submission date and handling status.
• Player questionnaire: your game preferences, playstyle, desired atmosphere, availability, commitment and group preferences, plus any optional notes about previous games, topics to avoid or practical adjustments.
• Booking administration: agreed campaign and schedule, party name or reference, player count, introductory-offer eligibility and the DM’s confirmation that payment has been received. This website does not collect card details or process payments.
• DM access and uploads: a site-specific ChatGPT user identifier for the authorised DM; signed-in account email and optional display name may be supplied by the sign-in service. Photographs uploaded by the DM are used on the public website.
• Technical information: hosting and security providers may process your IP address, browser information, request times, logs and cookies when delivering or protecting the site.

Fields marked with an asterisk are needed for the enquiry form to work. Optional fields can be left blank. Without your contact details, I cannot reply; without the requested game and availability information, I may not be able to match you with a group.

Please describe practical preferences only. Do not include medical diagnoses, health records, other sensitive personal information or private details about other people. A group organiser should provide their own contact details and tell other players about this policy before supplying any information on their behalf.

How and why information is used

I use enquiry details to answer questions, discuss availability and prices, arrange a suitable campaign and contact you about your request. If you book, I use the information needed to organise sessions and administer the agreed game.

The lawful basis for those necessary steps is your request to arrange a service before booking, or performance of our agreement once you book. I use game preferences and questionnaire answers for the legitimate interests of finding compatible groups and preparing an appropriate game. Optional notes are used only for that purpose.

I also rely on legitimate interests to protect the site, prevent duplicate or abusive enquiries, restrict access to the DM’s Desk and keep appropriate administration records. Where a law requires particular records or disclosure, the basis is legal obligation.

Group placement is reviewed personally by the DM. The website does not make automated acceptance or rejection decisions about players. Submitting an enquiry does not reserve a place or add you to a marketing list.

Who can see your information

Enquiries, questionnaire answers and private booking notes are available through the protected DM’s Desk. They are not published in the campaign catalogue or availability calendar. I do not sell or rent your details, provide them to advertisers, or pass your contact details or questionnaire answers to other players without your permission.

Service providers are involved in operating the website and communicating with you:

• OpenAI / Sites: website hosting and management, and ChatGPT sign-in for the DM’s Desk. See OpenAI’s privacy policy.
• Cloudflare: infrastructure for delivering the site, storing enquiry records and uploaded images, and protecting requests. See Cloudflare’s privacy policy.
• Email providers: services used to send, receive and store correspondence when I reply to you.

Information may also be disclosed where legally required, or where necessary and lawful to establish or defend a legal claim. Only information relevant to that purpose should be disclosed.

These providers operate internationally, so processing may take place outside the UK, including in the United States. OpenAI describes adequacy decisions and contractual safeguards, including the UK transfer addendum. Cloudflare describes the UK Extension to the EU–US Data Privacy Framework and contractual safeguards. Their linked notices give details and contact routes for requesting information about those safeguards; data is not promised to remain solely in the UK.

Public session descriptions and venue photographs are intended for visitors to see. The DM should keep personal details out of public session notes and obtain permission before publishing identifiable photographs of players.

Cookies, analytics and sign-in

The custom visitor analytics, analytics dashboard and consent prompt have been removed. This site no longer records page views, referral sources or form activity through that feature. Returning browsers clear the retired analytics preference and visit identifier.

The hosting service can still set cookies independently of the enquiry forms. Cookies observed include Cloudflare’s __cf_bm and cf_clearance security cookies, and the Sites visitor cookie __Host-appgarden-visitor. The latter’s precise purpose and retention are controlled by Sites and have not been independently verified for this website. It is not used by the site’s enquiry code.

Opening the DM’s Desk displays a sign-in button. Choosing ChatGPT sign-in can set login-state and session cookies through OpenAI’s authentication service, including during an unfinished sign-in attempt. Visitors do not need to sign in to browse or send an enquiry.

You can view or remove cookies in your browser settings. Blocking security or sign-in cookies may affect access. See Cloudflare’s cookie information for its security-cookie purposes. This policy does not claim that the site is cookie-free.

How long information is kept

Retention depends on whether an enquiry is being answered, you are still looking for a group, a campaign is active, or a record is needed to resolve a query, meet an accounting requirement or deal with a legal claim.

I review information when an enquiry is withdrawn or closed and when a campaign ends. Information that is no longer needed should be deleted or reduced to the minimum record still required. Optional questionnaire notes should not be kept longer than needed to arrange or run your game.

Enquiry deletion is handled manually; closing an enquiry does not automatically erase it. You can ask for removal at any time using the contact routes above. Hosting and email providers may retain logs or backups under their own retention arrangements, so removal from active records does not necessarily remove every backup immediately.

Your choices and rights

You can ask to see your information, correct it, restrict its use or have it deleted. You may also have a right to receive certain information in a portable form. These rights depend on the circumstances; for example, some records may need to be retained to meet a legal obligation.

You have the right to object to processing based on legitimate interests, including use of your questionnaire for group matching. Tell me if you no longer want to be considered for a group or want optional notes removed. Where I ask for consent to a separate use, such as sharing contact details with a group, you can withdraw that consent for future use.

I may need enough information to confirm your identity before acting on a request. Requests are normally answered within one month; I will explain if a lawful extension or exception applies.

You can contact me about a concern or complain directly to the UK Information Commissioner’s Office through the ICO complaints service. You do not have to contact me first.

Changes to this policy

The date above will change when this policy is updated. If a proposed use of your information changes substantially, I will provide the relevant information and obtain any permission required before that new use.