Debrief collects only what it needs to write your battle reports, store your photographs, and check your Patreon status. We do not sell personal information. We count visits to the site in aggregate, without cookies or stored IP addresses. You can ask us to delete your account and everything attached to it at any time.
Debrief (“we,” “us,” or “our”) is an independent tabletop companion operated from Ontario, Canada, and is a Cocky Rooster Miniature Gaming project. Privacy questions and access or deletion requests can be sent to cocky.rooster.miniature.gaming@gmail.com.
A Firebase anonymous identifier is created when the app is first used. If you choose Google sign-in, Firebase Authentication provides your account identifier, display name, email address, and profile photo. We do not receive your Google password. Signing in from a guest session keeps the same identifier, so battles saved beforehand remain yours.
We store the battle briefs you enter — player names and pronouns, factions, commanders, unit lists, battle cards, round-by-round notes, and results — along with the generated report text. Saved content is linked to your account identifier.
Photographs you upload are resized in your browser and stored in Firebase Storage under your account identifier. They are never publicly readable: every view is served through a short-lived signed link issued by our servers. If you share a recap, anyone with that link can view its photographs and narration for as long as it stays shared.
When you request a report, your battle brief is sent through a protected Firebase function to the Anthropic API, which returns the written narration. Anthropic states that API inputs and outputs are not used to train its models by default. See Anthropic's privacy centre.
When you record narration, the report text and selected voice are sent through a protected Firebase function to the OpenAI speech API. The returned audio is saved to Firebase Storage and linked to that battle. OpenAI states that API data is not used to train its models by default; its standard abuse-monitoring logs may retain API content for a limited period. See OpenAI's API data controls. Video files are assembled entirely in your browser and are never uploaded to us.
If you connect Patreon, we receive your Patreon user identifier, membership status, entitled tier, and pledge amount for our campaign only. We store that status and a refresh token so access can be re-checked as pledges change. We do not receive or store your payment-card details; Patreon handles payments under its own Privacy Policy.
Server logs record errors and the counts used to enforce monthly limits. They include an account identifier but not your battle text, photographs, or Patreon tokens.
Google reCAPTCHA and Firebase App Check verify that requests come from the real app rather than an automated script. reCAPTCHA collects device and browsing signals under Google's Privacy Policy.
To understand how the site is used, our own servers count page visits. Each visit records the page viewed, the site you came from (if any), your browser language, and your approximate browser, operating system, and device type. To estimate how many different people visit in a day, we combine your IP address and browser details with a random secret that is replaced every day and turn the result into a one-way code. Your IP address itself is never stored, and only anonymous daily totals are kept long term. We do not use cookies or advertising trackers for this, do not follow you across other sites, and do not count visits from browsers that send a Do Not Track or Global Privacy Control signal. This applies to the Debrief app and to our public pages, including the Legion scoreboard.
We use Google Firebase for authentication, Firestore, Storage, Hosting, and Cloud Functions; Anthropic for generated report text; OpenAI for generated speech; Patreon for membership and payments; and Google reCAPTCHA for abuse prevention. These providers process information to deliver their services and may process data outside Canada. Firebase describes its role and security practices in Privacy and Security in Firebase.
We do not sell or rent personal information. We may disclose information if required by law, to protect users or the service, or as part of a business transfer with appropriate safeguards.
Saved battles, photographs, and narration audio are retained until you delete them or ask us to delete your account. Monthly usage counters reset each month. Server error logs are retained on a short rolling basis. The one-way visitor codes used for site analytics, and the daily secrets behind them, are deleted within about two days; the anonymous daily totals are kept.
To delete your account and everything attached to it, email cocky.rooster.miniature.gaming@gmail.com from the address on your account. We will remove your login, battles, report text, photographs, narration files, Patreon link, and usage records. Provider backups may take additional time to expire. Deleting your Debrief account does not cancel a Patreon pledge — cancel that through Patreon.
We use Firebase authentication, owner-based database and storage rules, protected server functions, expiring signed links for every photograph and audio file, encrypted HTTPS connections, and secrets held in Google Secret Manager. No internet service can guarantee absolute security, so please avoid entering sensitive personal, medical, financial, or confidential information into battle notes, and avoid uploading photographs containing information you would not want shared.
You can use the app as a guest, choose whether to sign in, choose whether to connect Patreon, decide whether to upload photographs or record narration, keep recaps private or share them by link, disconnect Patreon at any time, and request deletion of your account. You may also contact us to request access, correction, or information about our handling of personal information.
We aim to follow applicable Canadian privacy requirements, including the principles of accountability, consent, limiting collection and retention, safeguards, openness, and individual access described by the Office of the Privacy Commissioner of Canada.
Debrief is not directed to children under 13. If you believe a child has provided personal information without appropriate consent, contact us so it can be reviewed and removed.
We may update this policy as the service changes. The effective date will be revised, and material changes may also be announced in the app.