Last updated: 21 July 2026
This policy applies to Sanity Check and any other applications published by Rune & Pixel.
All data is stored on secured servers with AES-256 encryption at rest. Passwords are encrypted using bcrypt hashing. All connections use HTTPS with TLS 1.2 minimum and HSTS headers. We do not sell or share your data.
We only send emails for password reset codes, email verification, and account alerts. We do not send marketing emails, newsletters, or promotional content. Emails are sent from noreply@runeandpixel.me.
The app includes an optional, paid feature that generates character portraits from a short description you write. When you use it, your description is sent to a third-party AI service to produce the image, and a copy is kept on our servers so you can view it in your gallery. Everything is deleted when you delete your account, except where a legal-hold applies (see Data Retention below).
Under UK GDPR, you have the right to:
Your data is kept for as long as your account exists. When you delete your account, all associated data — including AI-generated portraits and image files — is permanently and immediately removed from our servers. Dice rolls and campaign notes you left in other people's campaigns stay in those campaigns, attributed to "Deleted user" so the remaining players' history is preserved.
We keep an anonymised audit record ("tombstone") of deleted accounts for 30 days to help resolve support queries. After that window it is permanently removed.
Where required by UK law we may retain content and account data indefinitely, and refuse right-to-erasure requests, under UK GDPR Article 17(3)(b) (compliance with a legal obligation). This applies only in narrow, serious cases where a user attempts to generate content that is illegal to produce or distribute under UK law. In those cases we are required to preserve evidence, cooperate with the relevant authorities, and place the account under a legal hold that prevents deletion.
This exception is not used for any other purpose. Ordinary content moderation blocks, suspensions, and support disputes are not covered — those accounts can still be deleted normally.
Your data is processed by trusted providers on our behalf for the following purposes only:
Some of these providers may be based outside the UK, including in the United States and the European Economic Area. Where your data is transferred outside the UK, we rely on the UK's international data transfer safeguards (adequacy decisions, the UK-US Data Bridge, or Standard Contractual Clauses).
No analytics, tracking, or advertising services are used. If you would like details of the specific providers we use, contact support@runeandpixel.me.
This app is not directed at children under 13. We do not knowingly collect personal data from children.
For any privacy-related questions, contact support@runeandpixel.me