jonbarson.cz is a personal, non-commercial set of tools for tabletop Dungeons & Dragons. This page explains what data the site processes, the terms of use, and the licenses of third-party content.
Jan Barták, company ID (IČO) 30053102, place of business Ledčice 146, 277 08 Ledčice, Czech Republic, registered in the Czech Trade Register. He operates both websites, tablemimic.com and jonbarson.cz: they share one user account and this policy applies to both. Contact: hello@tablemimic.com, +420 605 749 238. No data protection officer has been appointed (one is not required for the scope of our processing).
| Data | Why |
|---|---|
| E-mail and account ID (uid) | Sign-in and linking your data to your account |
| Your content (campaigns, notes, library, settings, pets) | Running the tools and syncing across your devices |
| The character sheet you send to a DM table (name, class, race, level, AC, hit points, conditions, concentration, inspiration, initiative, death saves, resistances, immunities, vulnerabilities, active effects, summons) | Running the game: only that table's DM can read it, the other players cannot reach it. It is sent only once you join a table yourself; leaving stops the updates and the last state stays at the table until the DM removes you from it. |
| A small card for the party at the same table (name, class, race, level, whether you are connected; hit points only while you share them) | The Party roster module: the other signed-in players at that table read it, and they keep that access until the DM removes them from the table; their own disconnect does not end it. It is a separate record, not a slice of the DM's card, so nothing else about your character reaches them. You can switch the hit points off in the table chip on your character sheet; they are then not in this card at all, and leaving the table takes them off it too. The DM sees them either way, in the card above. |
| The DM's session brief (a short recap your DM sends to the table) | The DM writes it in the Campaign Planner and puts it on the table with an explicit button; their private session notes are not part of it. Only signed-in players at that table read it. The last brief you received is stored on your character sheet and synced across your devices so it stays readable after you leave the table; only the next brief replaces it. |
| Handouts from the DM (a title, text and a link to an image in the DM's storage) | The DM sends a handout into your private channel at that table, which only the two of you can see. Keep stores it on your character sheet, where it syncs across your devices and stays until you delete it; Close stores nothing. The image itself stays in the DM's storage, so if the DM deletes it, it stops showing for you too. |
| Uploaded maps / images (Connector) | Shown on your table display. The map is stored on our hosting under a random, unguessable address known to your display and to whoever you show it to. Uploading a new map deletes the previous one; the last one is deleted when you delete your account. |
| Technical visit data (page path, device category, source bucket, hour; IP only truncated and transiently) | Cookieless server-side traffic statistics and bot filtering |
| Anonymous usage data (only with your consent) | Traffic statistics — which tools get used |
Data at the table (the DM card, the party card, the brief and handouts) is made available to the DM and fellow players at your request, i.e. when you join a table or explicitly send something. It is part of the service you ask for (Art. 6(1)(b) GDPR). The last state of your card stays at the DM’s table until the DM removes you from the table, deletes the table, or you delete your account. You can also ask us to remove it via the contact above; we will do so within one month.
We measure traffic in two ways. (1) Our own cookieless server-side measurement: it stores only the page path, a coarse device category, a source bucket (e.g. “google”), the hour, a coarse country (derived server-side from the IP, which is discarded right away), the browser language, a human/bot class, aggregate page-load speed (Web Vitals) and aggregate script-error counts (type and file, never message contents) — never your IP address, user-agent or any identifier on your device. To tell short visits (sessions) apart, the server derives a transient pseudonym from a truncated IP (IPv4 /24, IPv6 /48) and the browser; the key rotates daily and the pseudonym is deleted within 24 hours, so you cannot be linked across days. Such a pseudonym is still personal data: we process it on the basis of legitimate interest (traffic statistics, security, bot filtering) and you can object to it. (2) Google Analytics runs only with your consent (the banner on your first visit) — without consent it does not start. We do not use advertising cookies and we do not sell or share data with anyone beyond the processors below.
The card-game apps on jonbarson.cz (Riftbound, Manaforge) work without signing in — your data (card collection, decks) then stays only in your browser's storage and is not sent anywhere. After signing in it syncs to Firebase under your account (keys such as collection, decks, preferences) so you have it on all your devices. Submitted feedback stores the uid, name and e-mail of your account so we can reply to you.
Separately from your personal data, the site serves a public game-reference database (the Compendium — monsters, spells, items and equipment, built from SRD 5.1, SRD 5.2.1 and Open5e). It is static reference content, contains no personal data and is not tied to any account. Its sources and licenses are listed in section 3 below.
We process the data to provide the service you sign up for (Art. 6(1)(b) GDPR). Your data is kept as long as your account exists; when you delete the account, the associated data is deleted too. Copies may remain in our (daily and monthly) backups for up to 12 months, used only to restore the service after a failure. A guest (anonymous) account stores data only in your browser; clearing your browser data deletes it irreversibly.
Cookieless traffic measurement and abuse protection (rate limits, bot filtering) rely on legitimate interest (Art. 6(1)(f) GDPR). Traffic records without identifiers (path, device, source, hour) are kept for 90 days, the transient session pseudonym for 24 hours at most and rate-limit buckets for a few days at most. You can object to processing based on legitimate interest at any time via the contact above.
Account usage measurement (tablemimic.com only, signed-in accounts only): to learn whether the product gets used and what people come back to, we store per account and calendar week only flags for which parts were used (DM dashboard, player dashboard, planner, table display, standalone tools, saving to the account, connecting to a table). We do not store times, pages, campaign content or anything you type into the tools. In this data the account is kept under a pseudonym (a keyed hash of the account ID, not your e-mail or name); for cohort reports it is combined only with the sign-up date and last sign-in date from the authentication service. The legal basis is our legitimate interest in developing the service (Art. 6(1)(f) GDPR). Weekly flags are kept for at most 180 days, after which only aggregate numbers without any link to an account remain; they are deleted immediately when you delete your account. You can object to this measurement at any time via the contact above, after which nothing is stored for your account.
The service is intended for people aged 15 and over. Younger children may use it only through an account created and managed by their legal guardian (see the Terms of Use, Section 3.2).
Google and Cloudflare belong to US-based groups and may access part of the data from there (mainly sign-in via Firebase Authentication, reCAPTCHA and Google Analytics). Such transfers rely on the European Commission’s adequacy decision (EU-U.S. Data Privacy Framework), under which both companies are certified, and additionally on the standard contractual clauses in their data processing terms: Firebase Data Processing Terms (list of subprocessors) and the Cloudflare DPA.
Data is transferred encrypted (HTTPS). Access to data in the database is governed by security rules bound to your account, so nobody can read someone else’s data, and administration is protected by authentication. If a security breach posed a risk to your rights, we would notify the Office for Personal Data Protection within 72 hours and, where the risk is high, you as well.
Under the GDPR you have the right to access, rectify, delete (“be forgotten”), export (portability), restrict and object to the processing of your data. To exercise them, write to the contact above; we will reply without undue delay and within one month at the latest (in complex cases this may be extended by two further months, and we will tell you). You can withdraw your consent to Google Analytics at any time (below); withdrawal does not affect the lawfulness of processing before it. You also have the right to lodge a complaint with the Office for Personal Data Protection (Pplk. Sochora 27, 170 00 Prague 7, Czech Republic).
We only use technical local storage that is necessary for the tools to work — the interface language, the sign-in token and your saved content. If you allow traffic measurement in the banner, Google Analytics additionally stores its cookies. In the tools that use an account, Google reCAPTCHA (bot protection, see Processors) may store a technical security cookie. You can change or withdraw your consent at any time with the button below (or in your account settings); withdrawing also deletes the Google Analytics cookies. No third-party advertising cookies.
The use of the tools on both websites, tablemimic.com and jonbarson.cz, is governed by the single Terms of Use. Their Czech version is binding.
IP geolocation for traffic statistics: DB-IP Country Lite (CC BY 4.0) — coarse country only, the IP is never stored.
The full Open Game License 1.0a text and the complete Section 15 — generated from each source's metadata — are on the dedicated licenses & attributions page.
Reproduced as required by the licenses. Full license texts: Open Game License 1.0a — open5e.com/legal; CC-BY-4.0 — creativecommons.org/licenses/by/4.0; ORC License — paizo.com/orclicense.