Legal

1. Privacy Policy

Effective date: June 2025. This policy describes what personal data Nat20 collects, why, and your rights under the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA).

Data we collect

• Account data: email address and username, provided when you register.
• OAuth identities: if you sign in with a third-party provider (e.g. Google), we store the provider name and your provider-side user ID. We do not store your OAuth tokens.
• Content you create: campaigns, sessions, entity instances (characters, spells, items, etc.), and proposals you submit.
• Server logs: request paths, HTTP status codes, and timestamps for operational monitoring. We do not log full URLs (which may carry tokens) or personally identifiable query parameters.

How we use it

• To operate your account and authenticate you.
• To display your public profile and the content you choose to publish.
• To send transactional emails (password reset, invite notifications).
• To detect and respond to abuse or security incidents.

We do not sell, rent, or trade your personal data to third parties. We do not use your data for advertising profiling.

Legal basis (GDPR)

• Contract: processing your account data to provide the service you signed up for.
• Legitimate interest: server logging for security and operational monitoring.

Your rights (GDPR & CCPA)

• Access: request a copy of the data we hold about you.
• Rectification: correct inaccurate data.
• Erasure: ask us to delete your account and associated data.
• Portability: receive your data in a structured, machine-readable format.
• Objection: object to processing based on legitimate interest.
• CCPA — Do not sell: we do not sell personal information. California residents may still submit a data request via the contact link below.

To exercise any right, contact us at the contact page. We will respond within 30 days.

Data retention

Account data is retained for as long as your account is active. Server logs are retained for up to 90 days. You may request deletion at any time.

Third-party services

We may use third-party infrastructure providers (hosting, object storage, email delivery) to operate the platform. These providers act as data processors under GDPR and are bound by data processing agreements.

2. Cookie Notice

Nat20 uses strictly necessary cookies only. These cookies are essential for the site to function and cannot be disabled without breaking core features. Under GDPR they do not require your consent.

Both cookies are HttpOnly (not accessible from JavaScript) and SameSite=Lax. We do not use analytics, advertising, or tracking cookies.

3. Dungeons & Dragons SRD 5.2

Nat20 includes spell, rule, and game-mechanic data drawn from the System Reference Document 5.2 (“SRD 5.2”) by Wizards of the Coast LLC. The SRD 5.2 is licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0).

This work includes material taken from the System Reference Document 5.2 (“SRD 5.2”) by Wizards of the Coast LLC, available at https://www.dndbeyond.com/srd. The SRD 5.2 is licensed under the Creative Commons Attribution 4.0 International License, available at https://creativecommons.org/licenses/by/4.0/.

4. Trademarks

Dungeons & Dragons, D&D, and related marks and logos are trademarks of Wizards of the Coast LLC in the USA and other countries. © 2024 Wizards of the Coast LLC. All rights reserved.

Nat20 is not affiliated with, endorsed by, or in any way officially connected to Wizards of the Coast LLC or its parent company Hasbro, Inc.

5. User Content

Content created by users on this platform (homebrew characters, items, spells, campaigns, etc.) belongs to its respective creators. Nat20 makes no claim of ownership over user-generated content and provides no warranty regarding its accuracy or legality.

If you believe any content on this platform infringes your intellectual property rights, please contact us.