Privacy notice
TirateIniziativa · last updated 27 September 2026
In short: the TirateIniziativa tools run entirely in your browser. What you write into them — parties, encounters, maps, readings — is never sent to any server: it stays on your device. We use no cookies, we do not profile you, there is no account to create, and there is nothing we could hand back or delete on request, because we hold nothing of yours.
What this covers
This notice applies to tirateiniziativa.com and to every tool hosted on its subdomains: the D&D Encounter Balancer, HexJourney and the Curse of Strahd Tarokka Randomizer. The last two do not answer at those addresses yet; when they do, what is written here already applies to them.
Who is responsible
The data controller is TirateIniziativa, which runs this project as non-commercial fan content. Contact: tirateiniziativa@gmail.com.
What stays in your browser
The app saves two entries in the browser's local storage. These are not cookies and are never transmitted.
| entry | what it holds | why |
|---|---|---|
one entry per tool, e.g. balancer.state.v1 |
the document you wrote in that tool, with the chosen language and its preferences | so your work is still there after you close the tab: it is the very service you asked for by opening it |
ti.lastVisitDay and similar |
a date, e.g. 2026-09-27 |
so the same visit is not counted twice on the same day |
You can clear everything at any time, from inside the tool — each has a command that empties the document — or by clearing the site data in your browser. Neither requires telling us, because we know nothing about it.
If you export a JSON file or a link, your browser produces them and they go wherever you send
them. In the case of a link, the document travels in the part of the address after the
#, which browsers never transmit to a server — not even we can see it.
What reaches us: the visit counter
At the bottom of the page there is a public visit counter. When you open the app, your browser
sends our server a request that says only "one more visit". The server keeps
monthly totals only — for example 2026-09: 412 — plus the running
total. No IP addresses, identifiers, cookies, device or referrer information are stored, and
there is no way, not even for us, to trace those numbers back to a person or to know how many
pages anyone viewed. The "once a day" de-duplication happens in your browser, using the date
described above, and is never sent.
Hosting
The site and the counter run on Cloudflare infrastructure (Cloudflare, Inc., United States), acting as data processor. Like any hosting provider, Cloudflare transiently processes the technical data needed to deliver pages and protect the service from abuse, including the request's IP address. See Cloudflare's privacy policy.
Typefaces
The pages load two typefaces (Cinzel and EB Garamond) from Google Fonts. To
deliver them, your browser contacts Google's servers (fonts.googleapis.com and
fonts.gstatic.com), which at that moment receive the request's IP address and your
browser's technical information. This is the only third-party connection on the site. See
Google's privacy policy.
Google Drive, if you connect it
Connecting Google Drive is optional and never automatic: it starts only when you press “Sign in with Google”, and until you do, the site does not contact Google at all — not even the sign-in script is loaded.
If you do connect it:
-
one permission is requested, the
drive.filescope, which grants access solely to files this app created and to nothing else in your Drive: the rest of your files stay invisible to us; - no name, email address or other profile data is requested. Writing a file into the Drive of whoever authorised it does not require knowing who they are;
- documents travel straight from your browser to Google, never through us: we keep no copy and never see them;
- the access token lives in memory for the session, is never written to disk and expires within an hour. All that stays in the browser is the fact that you said yes, plus the folder identifiers, which open nothing on their own;
-
files are created in the
TirateIniziativa_AppDataStoragefolder of your Drive. They are yours: move, rename or delete them whenever you like, and “Disconnect” revokes the permission without touching them.
Use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
Transfers, retention, minors
The monthly visit totals contain no personal data and are kept indefinitely, since their purpose is to show how often the tool has been used. The data in your browser is kept by you, for as long as you like. The service is not specifically directed at children and does not knowingly collect data about them — it does not knowingly collect data about anyone.
Your rights
Regulation (EU) 2016/679 gives you rights of access, rectification, erasure, restriction, objection and portability. In practice there is no personal data here to exercise them against: what you write is on your device and you delete it yourself. If you think something is wrong you can write to the address above, or lodge a complaint with the Italian Data Protection Authority.
Cookies
This site uses no cookies — neither technical nor profiling, neither first- nor third-party. The two local-storage entries described above exist solely to provide the function you requested by opening the app, which is why no consent banner is shown.