Sub-processors
Last updated: 21 August 2026.
These are the third parties that process data on behalf of Rolegend so the product can work. Each entry says what that company receives and where it processes it. This list is part of Nightshift Software's Privacy Policy and of the service schedule for Rolegend.
Supabase
Sign-in, the database everything is stored in, and file storage for generated images.
- What it receives: Your email address and sign-in session; every row your account owns - profile, worlds, campaigns, characters, turns, world state, quests, inventory, credit history; and any image you generate.
- Where: Paris, France (Supabase region eu-west-3).
Vercel
Hosting. The site and its API run as Vercel functions, and the platform holds the server logs they write.
- What it receives: Every request you make to the site, and whatever those requests put in a log line - request paths, errors, and the tool calls the GM makes.
- Where: vercel.json pins the functions to Vercel's cdg1 region (Paris). Static assets are served from Vercel's global network.
PostHog
Product analytics and error tracking. Counts what accounts do inside the game so we can tell whether the product works, and receives the server's error reports so a failure is visible rather than merely logged.
- What it receives: From your browser, only if you accept the cookie banner: pages visited, which buttons you pressed, and where on a page you clicked or scrolled. From our servers, whether or not you accept: your account's internal identifier and the fact that an account was created, a character was made, a turn was played, or a subscription started or ended, plus structured details such as the plan chosen. Also any error the server reports, with secrets and long values stripped before it is sent. Never your campaign text.
- Where: European Union (PostHog Cloud EU, eu.i.posthog.com).
OpenRouter
Routes the GM's narration to whichever model vendor the platform is set to use. Every generation request now goes through OpenRouter first, and it passes the prompt on to the vendor named in the configured model.
- What it receives: The prompt behind each GM reply: your character sheet, the campaign and world state, the recent transcript, retrieved lore, and the text you write.
- Where: United States.
Anthropic
Generates the GM's narration when the configured model is one of Anthropic's. Reached through OpenRouter rather than directly, so it receives the prompt from them.
- What it receives: The prompt behind each GM reply: your character sheet, the campaign and world state, the recent transcript, retrieved lore, and the text you write.
- Where: United States.
OpenAI
Four jobs, reached two different ways. It generates the GM's narration when the configured model is one of OpenAI's, and that route goes through OpenRouter like any other. The other three are direct, because OpenRouter does not offer them: the embeddings behind lore retrieval, which happen whichever vendor writes the narration; entity images; and reading the Game Master's replies aloud when you ask for audio.
- What it receives: The same per-turn prompt as above when it is the generation vendor; the text of anything indexed for retrieval; the prompt behind an image you ask for; and the text of any reply you ask to hear read aloud.
- Where: United States. OpenAI offers European data residency for eligible endpoints; Rolegend does not currently use it.
Stripe
Subscription payments and the billing portal.
- What it receives: Your email address, and the payment details you enter - those go straight into Stripe's own hosted checkout page, so card numbers never reach Rolegend. What comes back to us is the customer and subscription identifiers and the subscription status.
- Where: United States (Stripe, LLC).
Resend
Sends product email - the welcome message, the account-deleted confirmation, and the other notices under src/server/email/.
- What it receives: Your email address and the contents of those messages.
- Where: United States. Resend can send from an EU region, but account data, email metadata and logs are held in the United States regardless.
Cloudflare
Runs the check that you are a person, on the early access form. It is the only page on the site that asks you for anything, and it is the only page Cloudflare is involved in.
- What it receives: Your IP address, and signals your browser gives up while the check runs - things like how the page was loaded and how the pointer moved. Not what you typed into the form: the answers go to our own servers, and what Cloudflare returns to us is a yes or a no.
- Where: Cloudflare's global network - the check is served by whichever of their locations is nearest to you, so it is not tied to one country.
Dictating your turn
The microphone button in the composer uses your browser’s own speech recognition, not ours. In Chrome and Edge your browser sends the audio to Google’s speech service to turn it into text; Safari can do it on your device. Either way Rolegend never receives or stores the recording - only the text your browser hands back, and only once you press send. Nothing is recorded until you press the microphone, and browsers that have no recognizer do not show the button.
Transfers outside the UK
Supabase, Vercel and PostHog process in the EEA, so nothing leaves it for those three. The rest process in the United States, and each transfer is covered by that company’s own arrangement rather than by one blanket mechanism:
- OpenRouter. European Commission adequacy decisions where one applies, otherwise the EU Standard Contractual Clauses approved under Article 46 GDPR, as stated in OpenRouter's privacy policy.
- Anthropic. Anthropic's Data Processing Addendum, which incorporates the EU Standard Contractual Clauses and forms part of their commercial terms.
- OpenAI. OpenAI's Data Processing Addendum: an adequacy decision where one applies, otherwise the EU Standard Contractual Clauses with the UK International Data Transfer Addendum.
- Stripe. The EU-US Data Privacy Framework, under which Stripe, LLC is self-certified, with the EU Standard Contractual Clauses and the UK International Data Transfer Addendum carried in Stripe's Data Transfers Addendum as a fallback.
- Resend. The EU-US Data Privacy Framework and its UK Extension, under which Resend is certified, with the EU Standard Contractual Clauses carried in their Data Processing Addendum.
- Cloudflare. Cloudflare's Data Processing Addendum, which applies the EU Standard Contractual Clauses as amended by the UK Addendum, and their certification under the EU-US Data Privacy Framework and its UK extension.
These describe each company’s published terms as at 21 August 2026. They are stated here because they are checkable against each company’s published terms.
Not on this list
Session recording. Nothing records your screen or what you type. PostHog is on the list above for errors and for basic usage analytics, and its session-replay feature is switched off in code.
Changes
Adding a sub-processor means updating this page. It carries the date it was last checked against the code, at the top.
Contact
Questions about anything here: support@rolegend.com.