Privacy

Browser analytics: October 8, 2026

The wiki collects first-party aggregate activity, which I use to improve features and investigate problems: general page areas, feature clicks, searches with no results, failed requests, and slow pages or requests. These are event counts, not a count of unique people. Browser activity does not earn XP.

Analytics events contain only fixed area, feature and event labels plus a random event receipt ID. They do not include account identifiers, exact URLs, search text, item identities, notes, form contents, or recordings. No analytics cookies or persistent visitor IDs are created. Sign-in flows, administration, private workspace pages and shared lists are excluded. General collection and contribution features may report their fixed feature label and whether a request succeeded, but never their contents.

Only I can view the aggregate dashboard. Random delivery receipt IDs expire after seven days; daily aggregate counts are retained for comparing site improvements. The wiki does not load Vercel Web Analytics, Speed Insights, advertising pixels, or session-replay code.

The wiki sends a no-referrer instruction to browsers. Hosting, authentication, and security providers still process the requests needed to operate the site. The current analytics setup does not erase earlier provider records or guarantee that an older open page has refreshed. Contact me about prior records or privacy questions.

Sign-in and account information

Where enabled, Google handles your Google sign-in credentials. The wiki requests only your account identity, email address, and basic profile information. It does not request access to Gmail, Drive, or contacts. Your Google email and real name are not used as your public collector alias. Google sign-in does not itself connect a Discord account or grant community membership.

The authentication service can recognize sign-in providers with the same verified email as one wiki account. If that wiki account already has a Discord identity, the existing connection is shown in My Dispel. Connecting accounts with different emails requires authorization of both accounts. Collection connections do not grant new staff roles.

Where enabled, email sign-in uses a one-time code delivered by the authentication service and its mail provider. Email addresses are used for account access and are not used as public collector names. The email sign-in screen uses Cloudflare Turnstile to check for automated abuse; authentication and security providers process the requests needed for these checks.

Connecting Discord requires an authenticated wiki session and authorization of the Discord account. The collection connection is recorded using verified account identifiers, not an email address entered as a claim of ownership. Saved wiki items are connected automatically, existing Discord items are preserved, and imported items remain private. Original records and transfer receipts are retained privately to recover interrupted connections and prevent duplicates. Staff roles are not copied between wiki accounts.

Discord handles your sign-in credentials. Through the permissions shown on its authorization screen, the wiki receives account information such as your Discord identifier, display name, avatar information, and email address. Where a tool requires community membership or a specific role, the wiki checks those permissions separately. Signing in to manage your own lists does not make you a reviewer, Worldbuilder, or administrator.

The wiki uses this information for account linking, attribution, session management, abuse prevention, and access checks. Signing in is not consent to transfer ownership of your work or to enroll in a future partner-analytics program.

Submissions, public credits, and review notices

Contribution records can include your chosen credit, submitted text, source links, uploaded files and filenames, photograph details, timestamps, and the associated review history. Uploaded originals are held in private storage for processing and authorized review. Approved work and its public attribution can be displayed on the Archive and linked from contributor pages.

Benny can send photo-review notices to the configured private review channel. Those notices include the set, photographer credit, submission date, review stage, and a protected review link. Channel members can see the notice even when they do not have permission to open the review page. Private image originals and staff evidence are not included in those notices.

Do not put an address, private conversation, contact detail, or another person’s identity into a public credit or submission unless you have a suitable reason and permission. Image files can contain camera or location metadata: remove information you do not wish to share before uploading. Do not assume that a display-sized image has had all embedded metadata removed.

Worldbuilder pages

Publishing a Worldbuilder page makes its chosen profile content and any contact fields you publish visible to visitors. Keep a page unpublished while preparing a draft, and enter only contact details you intend to make public.

Pet photos

Familiars lets you keep one photo for each pet, with a name and optional caption. Each pet starts as Only me. You can share it with signed-in wiki members or make it Public. The editor shows the audience before you save. Your account identifier is not included in the shared gallery.

You can replace a pet’s photo, change its audience, or remove the pet. The wiki stores a resized image with embedded camera and location metadata removed. Image access is checked on each request. Changing the audience prevents new unauthorized requests but cannot recall copies someone already saved.

Your lists in the wiki and Benny

Manage Collection reads and edits the same collection, wishlist, trade, Nifty, and Do Not Want records used by Benny. These can contain catalog identities or custom names, statuses and priorities, quantities, notes, timestamps, and records needed to preserve existing commitments. The website does not create a second independently managed inventory.

The Manage Collection editing interface is limited to the signed-in collector’s own records. Choose a default audience for each list and override it for individual items: Only me, Selected people, Selected community, Wiki members, Public, or an optional Unlisted link. The editor shows who can see the selected list or item. Item overrides also apply when that collection copy appears in Tradelist. Publishing a collection photograph is a separate contribution, not permission to publish your private list.

Your existing Benny visibility, matching, and explicit sharing choices continue to apply inside Discord. Wiki audiences are separate: Discord sharing does not grant wiki access, and wiki privacy changes do not suppress Discord rankings, celebrations, or shared messages. Editing an item does not publish a new share; updated content follows the audience of each service. Wiki lists without a saved audience start as Only me, with appa’s publicly shared collection as the established exception. Selected-community access on the wiki requires verified membership. Wiki-member access requires a verified email or Discord wiki account. Hidden wiki items are omitted from named shared views and matches. A single rare item can identify its owner, so review item visibility before sharing it.

Saved Collection, Wishlist, Nifty, and Do Not Want entries contribute to anonymous community totals for each set, including entries set to Only me. These totals show how many collectors have a set or their level of interest; they do not disclose names, notes, or individual lists. Named collector lists still follow their sharing permissions. Private Stash and Incoming do not contribute to these totals.

Your authenticated session is checked by the wiki and verified again by Benny before it accesses your personal workspace. The wiki forwards the session token through its server connection for this check; editing requests do not accept a different owner chosen by the browser. Shared-list reads separately check the requested list and item audiences. Notes are excluded from shared views unless you choose to include them.

Identity is a private record for one physical copy, separate from Notes. It can contain identifying details, acquisition dates and sources, money or trade costs, and attachments. Every saved Identity field and attachment passes to the next owner when that copy is transferred, so they can add to its history. Identity stays out of public or shared lists, Discord shares, matching, and ordinary exports, even when Notes are shared. The current owner can edit Identity and download its attachments; a former owner keeps the exchange history without continued access to Identity.

TXT exports are downloaded to your device and can include your notes and pending local edits. Sharing that file is your decision. The export is a readable list, not a complete backup of quantities, save receipts, or transfer history. Website bulk importing is not currently enabled.

Private Stash

Private Stash is owner-only. It is excluded from collection totals, Wiki Stats, XP awards, ordinary exports, public or shared lists, Benny collection replies, and trade matching. Moving a copy preserves its identity and notes. Earlier messages and another participant’s historical transaction record are not erased.

Incoming, Memories, and activity

Incoming organizes your manual incoming and outgoing records and the Benny transfers, trades, loans, and collection-backed listings in which you participate. Manual records can include names, origins, quantities, dates, source labels, notes, and reference links. Histories keeps manual stories and automatic records of sets you held or offered. These records have no automatic expiry; adding a manual arrival does not itself transfer ownership.

Incoming, Memories, and Activity start as Only me. Items accepted from Incoming into Collection and automatic Histories receive an item-level Only me setting until their owner changes it. Transaction participants retain the private details needed to finish their exchange. Shared personal-record views omit counterpart identities, payment details, source labels, and shipping information; they do not publish joint transaction records.

Activity visibility here applies to wiki access. Discord rankings, XP celebrations, adventures, and deliberate Discord shares retain their server audiences. Changing wiki visibility does not withdraw Discord messages. Private bids, max-bid limits, direct messages, payment details, and shipping information retain their existing protections. Copies already saved by other people cannot be recalled.

Wiki XP and the future leaderboard

Eligible list changes and contributions earn Emporium XP. Your wiki-earned progress is available only to you in My Emporium XP. Earning wiki XP does not add you to a Discord server or create a public Discord announcement. The services retain stable award receipts to prevent duplicate credit.

Leaderboard participation starts off. If you opt in, a separate generated collector alias, wiki-earned level, and place may appear after 30 opted-in collectors reach wiki Level 10. The board excludes Discord identifiers, names, avatars, server membership, Discord standings, personal lists, exact XP, and activity histories. You can opt out at any time; the board is hidden whenever fewer than 30 qualifying participants remain. Signing in or earning XP does not opt you in.

Optional Benny encounters

When Benny adventures are enabled, joining records your Discord identifier and display name, party membership, button choices, readiness, skill actions and clues, timestamps, outcome, adventure counts, and HP, discovery and XP receipts. These records let Benny resume the adventure and avoid applying a reward twice. Joining makes your participation visible in the invitation channel. Party scenes and outcomes appear in an invited Discord thread that server moderators can also access; new party adventures show each player’s choices, readiness, skill results and feedback to the party in a shared journal. Earlier adventures retain their original private-vote rules. Ordinary party discussion is not copied into Benny’s game records.

Encounter records remain with Benny’s game history until an authorized operator handles a removal request. Closing or expiring an encounter does not erase its saved choices or reward receipts. Use Contact & removal requests to discuss these records. Encounters use fictional story props; an encounter choice does not remove dice from your collection or promise a real-world prize.

If a player selects a skill check or the party chooses a group dice check, Benny adds Dice Witch to its invited thread. Dice Witch is a separate app and can access the thread under Discord’s permissions. Its roll results are visible there. Benny records the attributed player, result, source message identifier and time to apply the encounter outcome and prevent replacement rolls.

Drafts stored on this device

The list editor uses IndexedDB browser storage for an account-separated copy of the last opened lists and pending changes. Edits enter that local recovery queue before the website asks Benny to save them. “Saved on this device” is not confirmation of a server save; wait for “All changes saved to Benny” before assuming another device can see the change.

Signing out hides the editor but does not erase its stored device copy. Account separation is not a guarantee of confidentiality from someone who can use your browser profile or device. Avoid shared devices for private list work. Clearing site data removes both cached lists and pending drafts; browser eviction, private-browsing restrictions, or device loss can also remove this recovery copy.

The signed-out demonstration contains sample rows only. It stays in the open tab and is not imported into your account when you sign in.

Photo preparation uses a different workflow. File selections and descriptions are not saved as recoverable drafts across page reloads. Keep the preparation tab open until each photo is confirmed submitted; an exit warning is only a reminder, not a backup or a promise that uploads continue after the tab closes.

Save receipts and deletion limits

Benny retains a record of each website save so that a retried request is recognized rather than applied twice. A receipt contains the operation identity, request fingerprint, timestamp, and saved result, which can include an item name, modifier, and notes. These records currently have no automatic expiry.

Deleting an item from a list does not also erase its prior save receipts, the browser’s cached copy, or relevant transaction history. A request to remove account data must consider those records as well as current list entries. The site does not yet provide a self-service tool that erases every copy; use Contact & removal requests for that separate request.

Shared pages and arrangement links

An unlisted collector link grants access to anyone who receives it. Its secret is stored as a hash and sent from the link fragment through a request header. Rotate the link to revoke the old one. Collector share pages request no indexing or caching; this cannot prevent someone from copying or photographing information they can view.

Set Palette comparison links include the selected public catalog slugs in the URL. Anyone receiving that link can see the selected arrangement. The comparison tool does not submit a photograph or publish your private list. Public contributor pages and approved works can be copied or indexed by visitors and search engines.

Following an external source, product, contributor, or contact link takes you to another service, which can receive technical request information under its own privacy practices. Only share a link or downloaded list when you intend its contents to reach the recipient.

Making collector tools better

I measure completed collection actions, return visits to collection tools, optional Easy/Okay/Hard ratings, and giveaway entries and claims. Internal account identifiers connect these outcomes over time; my dashboard shows aggregate counts. Item names, notes, list contents, and Private Stash are excluded from these measurements. Browser activity uses fixed event labels, and official Dispel product links include wiki referral tags. A store click does not establish a sale. These internal product measurements are not shared with partners as individual activity.

Removed collection items can be restored from Trash for 30 days. Unfinished personal entries remain device drafts until Add. Giveaway entry information is available to the host; published results use wiki aliases. A private draw record lets the host review entries and winner selection.

Services that operate the platform

Vercel hosts the wiki. Supabase provides wiki authentication, database services, and file storage. Benny runs on Google Cloud and uses Firestore; Discord provides sign-in and the messaging interface. These providers process information needed to deliver their part of the service under their own terms and privacy practices.

Hosting, authentication, and security services may process technical information such as IP addresses, request times, device/browser information, and error records. Authorized operators may use operational records to diagnose failures and protect the service. Infrastructure logs may contain personal information.

Session cookies and return navigation

Essential session cookies keep you signed in and support secure authentication. Production sign-in also uses a host-only, Secure, HttpOnly, SameSite=Lax navigation cookie named benny-oauth-next, scoped to /auth/callback. It remembers the destination page for up to ten minutes and is cleared when the callback handles it. It is a navigation hint, not permission to access a private page.

Blocking essential cookies can prevent sign-in or return navigation from working. These policy pages do not load advertising pixels or analytics SDKs, or set optional tracking cookies.

No automatic partner-data permission

Sharing a contribution or signing in does not opt you into partner analytics. This policy does not authorize selling or licensing private member lists, account identifiers, private submissions, or person-level activity to Dispel or other partners.

A restricted, view-only Dispel demonstration may show a fixed snapshot of broad anonymous totals from existing Benny and wiki records. It does not show member identities, individual sets, private lists, prices, addresses, or server membership. Small groups are withheld, exports are disabled, and reviewers must accept confidentiality and demonstration-only terms.

This limited demonstration does not enroll users in an ongoing analytics program or grant commercial licensing rights. Any future optional aggregate-insights program needs its own explanation, an explicit participation choice, and safeguards against identifying people from small groups. Your existing contribution permission does not authorize that program.

Retention and requests

I keep contribution and review records to run the Archive, preserve attribution and editorial history, and address abuse or disputes. There is no published fixed automatic-deletion schedule for all records. Account closure or removal of a public page is not a promise that every backup, moderation record, search cache, or copy made by a visitor disappears at the same time.

You can contact me about access, correction, removal, or account-related data through Contact & removal requests. Describe the record and requested action; I may need to verify identity or ownership. The site does not currently offer a self-service account-erasure tool. Relevant records may need limited retention for security, legal obligations, or a dispute. Contact me to discuss how those limits apply to your request. I cannot promise a deletion deadline until I have checked the records involved.

Changes to this notice

The version and revision date identify the text you are reading. They are not proof that a particular person accepted a particular version. Materially different uses of private data require an appropriate separate choice. Updating this page does not create consent for earlier submissions.