← Back to HeroStack Download the full text

HeroStack — Legal and Licensing

This file collects the licences, notices and policies that apply to HeroStack Web.

Part I covers the HeroStack software itself.
Parts II to V cover the Open Game Content the app's rules data is built on, including the full text of the Open Game License v1.0a.
Part VI is the privacy policy: what the app collects, why, who else sees it, and what you can ask us to do about it.
Parts VII and VIII — the content you create in the app, and the subscription terms — are contractual, and live in the Terms of Service.

Part I — HeroStack Software Licence

This software (the "Software") — including its source code, compiled binaries, user interface, artwork, and documentation, but excluding the Open Game Content described in Part II — is the proprietary property of the copyright holder and is protected by copyright law.

No licence is granted to any person to copy, modify, merge, publish, distribute, sublicense, sell, or create derivative works of the Software, in whole or in part, except as expressly permitted in writing by the copyright holder or under a separate commercial licence agreement.

Permission to install and use the Software is limited to what is granted under the terms of the licence or purchase agreement accompanying your copy. Absent such an agreement, no rights are granted.

THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE COPYRIGHT HOLDER BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.

Relationship to the Open Game Content

Purchasing or licensing HeroStack grants you no rights in the underlying Open Game Content beyond what the OGL already grants everyone — that content remains free to reuse under OGL terms, independently of this software. What a HeroStack licence covers is the proprietary software itself: the engine, the interface, and the specific organisation and presentation of the data.

Nothing in Part I restricts your rights under the OGL with respect to the Open Game Content described in Part II.

Part II — Open Game Content Declaration

This Part satisfies OGL v1.0a Section 8: "If you distribute Open Game Content You must clearly indicate which portions of the work that you are distributing are Open Game Content."

The Open Game Content in HeroStack is the game-rules data served from the content database and rendered in the rules browser, the character builder, and the character sheet: races, classes, archetypes, feats, spells, equipment, weapons, armour, traits, conditions, skills, languages, ability scores, domains, bloodlines, revelations, talents, evolutions, monster stat blocks, and comparable rules text and statistics.

That data is Open Game Content to the extent — and only to the extent — that the source publications it derives from declared it open under their own Section 1(d) and Section 8 declarations. Paizo's standard declaration in the relevant books reads: "Except for material designated as Product Identity … the game mechanics of this Paizo game product are Open Game Content, as defined in the Open Gaming License version 1.0a Section 1(d)."

Excluded from HeroStack's Open Game Content is anything those source publications themselves designate as Product Identity — under Paizo's standard declaration, "all trademarks, registered trademarks, proper names (characters, deities, etc.), dialogue, plots, storylines, locations, characters, artwork, and trade dress." HeroStack's data is built to omit closed content of this kind: the deity category was deliberately never populated, and no Golarion place, organisation, or named-NPC entries ship in the product.

Provenance. The rules corpus was compiled from d20pfsrd.com, which declares "All content of this site not designated as Product Identity is declared Open Game Content as described in Section 1(d) of the Open Game License Version 1.0a." Because that compilation sits between HeroStack and the original publishers, Section 15 below carries the copyright notices of the underlying source works.

A second compilation, the Archives of Nethys (aonprd.com), is the source for part of the full-text side channel — the categories listed as Archives-sourced in packages/data/content/README.md, together with the individual entries recorded in that folder's provenance manifest. Its own per-book Section 15 chains are published at the licence index cited in Appendix A. Archives pages present a short per-entry source line naming the book rather than reprinting that book's Section 15 notice, so entries taken from them carry no notice of their own; the notice for the book each one names is the one already transcribed in Section 15 below, and no notice was inferred onto an entry from a source line.

Part III — Product Identity Declaration

This Part satisfies OGL v1.0a Section 1(e).

The following are Product Identity of HeroStack and are not Open Game Content:

The name and mark "HeroStack", and the HeroStack logo.
The application's source code, user interface design, layout, icons, and artwork.
The specific JSON data schema, category taxonomy, and database organisation used to store and serve game data.
All HeroStack-original prose that does not itself reproduce Open Game Content — interface copy, tooltips, help text, error messages, and internal editorial and verification notes.

Part IV — Trademark Notice

HeroStack makes no claim of compatibility with any trademarked game system.

Pathfinder, Pathfinder Roleplaying Game, Paizo, the Paizo golem logo, and the Pathfinder logo are trademarks or registered trademarks of Paizo Inc. HeroStack is not affiliated with, endorsed by, sponsored by, or specifically approved by Paizo Inc., and no licence to use Paizo's trademarks is granted or implied by this document.

Where a Paizo product title appears in this file, or in a source citation shown inside the application, it appears solely to satisfy the attribution duty imposed by OGL v1.0a Sections 6 and 15 — not as a claim of compatibility, association, or endorsement.

Why this Part is worded the way it is

OGL v1.0a Section 7 states: "You agree not to indicate compatibility or co-adaptability with any Trademark or Registered Trademark in conjunction with a work containing Open Game Content except as expressly licensed in another, independent Agreement with the owner of such Trademark or Registered Trademark."

The independent agreement that would otherwise permit such a claim is the Paizo Compatibility License, and it is not available to HeroStack. Paizo's FAQ for that licence states: "The Paizo Compatibility License applies only to printed books, electronic books, and freely available websites, and is not available for use with apps." HeroStack is a paid application, so it falls outside the licence on both counts — it is an app, and it is not freely available.

Paizo's FAQ is explicit that the underlying content rights are unaffected by this: "You may use our game content, released as Licensed Material under the ORC or as Open Game Content under the OGL, in apps so long as you comply with those licenses." The rules data is fine. Only the trademark claim is not.

Part V — Open Game License Version 1.0a

The text below is reproduced verbatim, as OGL v1.0a Section 10 requires. It has been verified word-for-word against the Open Gaming Foundation's authorised copy.

OPEN GAME LICENSE Version 1.0a

1. Definitions: (a)"Contributors" means the copyright and/or trademark owners who have contributed Open Game Content; (b)"Derivative Material" means copyrighted material including derivative works and translations (including into other computer languages), potation, modification, correction, addition, extension, upgrade, improvement, compilation, abridgment or other form in which an existing work may be recast, transformed or adapted; (c) "Distribute" means to reproduce, license, rent, lease, sell, broadcast, publicly display, transmit or otherwise distribute; (d)"Open Game Content" means the game mechanic and includes the methods, procedures, processes and routines to the extent such content does not embody the Product Identity and is an enhancement over the prior art and any additional content clearly identified as Open Game Content by the Contributor, and means any work covered by this License, including translations and derivative works under copyright law, but specifically excludes Product Identity.

(e) "Product Identity" means product and product line names, logos and identifying marks including trade dress; artifacts; creatures characters; stories, storylines, plots, thematic elements, dialogue, incidents, language, artwork, symbols, designs, depictions, likenesses, formats, poses, concepts, themes and graphic, photographic and other visual or audio representations; names and descriptions of characters, spells, enchantments, personalities, teams, personas, likenesses and special abilities; places, locations, environments, creatures, equipment, magical or supernatural abilities or effects, logos, symbols, or graphic designs; and any other trademark or registered trademark clearly identified as Product identity by the owner of the Product Identity, and which specifically excludes the Open Game Content;

(f) "Trademark" means the logos, names, mark, sign, motto, designs that are used by a Contributor to identify itself or its products or the associated products contributed to the Open Game License by the Contributor (g) "Use", "Used" or "Using" means to use, Distribute, copy, edit, format, modify, translate and otherwise create Derivative Material of Open Game Content. (h) "You" or "Your" means the licensee in terms of this agreement.

2. The License: This License applies to any Open Game Content that contains a notice indicating that the Open Game Content may only be Used under and in terms of this License. You must affix such a notice to any Open Game Content that you Use. No terms may be added to or subtracted from this License except as described by the License itself. No other terms or conditions may be applied to any Open Game Content distributed using this License.

3. Offer and Acceptance: By Using the Open Game Content You indicate Your acceptance of the terms of this License.

4. Grant and Consideration: In consideration for agreeing to use this License, the Contributors grant You a perpetual, worldwide, royalty-free, non-exclusive license with the exact terms of this License to Use, the Open Game Content.

5. Representation of Authority to Contribute: If You are contributing original material as Open Game Content, You represent that Your Contributions are Your original creation and/or You have sufficient rights to grant the rights conveyed by this License.

6. Notice of License Copyright: You must update the COPYRIGHT NOTICE portion of this License to include the exact text of the COPYRIGHT NOTICE of any Open Game Content You are copying, modifying or distributing, and You must add the title, the copyright date, and the copyright holder's name to the COPYRIGHT NOTICE of any original Open Game Content you Distribute.

7. Use of Product Identity: You agree not to Use any Product Identity, including as an indication as to compatibility, except as expressly licensed in another, independent Agreement with the owner of each element of that Product Identity. You agree not to indicate compatibility or co-adaptability with any Trademark or Registered Trademark in conjunction with a work containing Open Game Content except as expressly licensed in another, independent Agreement with the owner of such Trademark or Registered Trademark. The use of any Product Identity in Open Game Content does not constitute a challenge to the ownership of that Product Identity. The owner of any Product Identity used in Open Game Content shall retain all rights, title and interest in and to that Product Identity.

8. Identification: If you distribute Open Game Content You must clearly indicate which portions of the work that you are distributing are Open Game Content.

9. Updating the License: Wizards or its designated Agents may publish updated versions of this License. You may use any authorized version of this License to copy, modify and distribute any Open Game Content originally distributed under any version of this License.

10. Copy of this License: You MUST include a copy of this License with every copy of the Open Game Content You Distribute.

11. Use of Contributor Credits: You may not market or advertise the Open Game Content using the name of any Contributor unless You have written permission from the Contributor to do so.

12. Inability to Comply: If it is impossible for You to comply with any of the terms of this License with respect to some or all of the Open Game Content due to statute, judicial order, or governmental regulation then You may not Use any Open Game Material so affected.

13. Termination: This License will terminate automatically if You fail to comply with all terms herein and fail to cure such breach within 30 days of becoming aware of the breach. All sublicenses shall survive the termination of this License.

14. Reformation: If any provision of this License is held to be unenforceable, such provision shall be reformed only to the extent necessary to make it enforceable.

15. COPYRIGHT NOTICE

The notices below are transcribed, unaltered, from four sources, in order of authority:

1. The printed books themselves — the Section 15 page of 213 Pathfinder PDFs, read directly. This is the primary source: Section 6 asks for the exact text of each work's copyright notice, and this is that text. 2. Paizo Inc.'s own Pathfinder Roleplaying Game Reference Document licence page. 3. The Archives of Nethys licence index, which publishes a per-book notice chain. 4. The copyright-notice list published by d20pfsrd.com — the compilation this corpus was built from.

Every entry was validated to the shape Title © Year, Holder[; Author(s)] — text extraction otherwise sweeps in the back-cover advertising and trademark statements printed on the same page, and none of that belongs in Section 15.

These cover 98.1% of the source citations carried in the bundled data.

Adherer from the Tome of Horrors Complete © 2011, Necromancer Games, Inc., published and distributed by Frog God Games; Authors: Scott Greene and Clark Peterson, based on original material by Guy Shearer.

Pathfinder Roleplaying Game Advanced Class Guide © 2014, Paizo Inc.; Authors: Dennis Baker, Ross Byers, Jesse Benner, Savannah Broadway, Jason Bulmahn, Jim Groves, Tim Hitchcock, Tracy Hurley, Jonathan H. Keith, Will McCardell, Dale C. McCoy, Jr., Tom Phillips, Stephen Radney-MacFarland, Thomas M. Reid, Sean K Reynolds, Tork Shaw, Owen K.C. Stephens, and Russ Taylor.

Pathfinder Roleplaying Game Advanced Race Guide. © 2012, Paizo Publishing, LLC; Authors: Dennis Baker, Jesse Benner, Benjamin Bruck, Jason Bulmahn, Adam Daigle, Jim Groves, Tim Hitchcock, Hal MacLean, Jason Nelson, Stephen Radney-MacFarland, Owen K.C. Stephens, Todd Stewart, and Russ Taylor.

Pathfinder Roleplaying Game Adventurer’s Guide © 2017, Paizo Inc.; Authors: Benjamin Bruck, John Compton, Crystal Frasier, Tim Hitchcock, Jenny Jarzabski, Isabelle Lee, Joe Pasini, Jessica Price, David Schwartz, and Josh Vogt.

Aerial Servant from the Tome of Horrors Complete, © 2011, Necromancer Games, Inc.; Published and distributed by Frog God Games; Authors: Clark Greene and Clark Peterseon, based on original material by Gary Gygax.

Pathfinder Player Companion: Antihero's Handbook © 2017, Paizo Inc.; Authors: Emily Brumfield, Violet Hargrave, Susann Hessen, Mikko Kallio, Lyz Liddell, Adrian Ng, Joe Pasini, Lacy Pellazar, Kyle T. Raes, David N. Ross, and Kendra Leigh Speedling.

Bat, Mobat from the Tome of Horrors Complete © 2011, Necromancer Games, Inc., published and distributed by Frog God Games; Authors: Scott Greene and Clark Peterson, based on original ma terial by Gary Gygax.

Pathfinder Roleplaying Game Bestiary 2. © 2010, Paizo Publishing, LLC; Authors Wolfgang Baur, Jason Bulmahn, Adam Daigle, Graeme Davis, Crystal Frasier, Joshua J. Frost, Tim Hitchcock, Brandon Hodge, James Jacobs, Steve Kenson, Hal MacLean, Martin Mason, Rob McCreary, Erik Mona, Jason Nelson, Patrick Renie, Sean K Reynolds, F. Wesley Schneider, Owen K.C. Stephens, James L. Sutter, Russ Taylor, and Greg A. Vaughan, based on material by Jonathan Tweet, Monte Cook, and Skip Williams.

Pathfinder Roleplaying Game Bestiary 3. © 2011, Paizo Publishing, LLC; Authors: Jesse Benner, Jason Bulmahn, Adam Daigle, James Jacobs, Michael Kenway, Rob McCreary, Patrick Renie, Chris Sims, F. Wesley Schneider, James L. Sutter, and Russ Taylor, based on material by Jonathan Tweet, Monte Cook, and Skip Williams.

Pathfinder Roleplaying Game Bestiary 4. © 2013, Paizo Publishing, LLC; Authors: Dennis Baker, Jesse Benner, Savannah Broadway, Ross Byers, Adam Daigle, Tim Hitchcock, Tracy Hurley, James Jacobs, Matt James, Rob McCreary, Jason Nelson, Tom Phillips, Stephen Radney- MacFarland, Sean K Reynolds, F. Wesley Schneider, Tork Shaw, and Russ Taylor.

Pathfinder Roleplaying Game Bestiary 5. © 2015, Paizo Inc.; AUthors: Dennis Baker, Jesse Benner, John Bennett, Logan Bonner, Creighton Broadhurst, Robert Brookes, Benjamin Bruck, Jason Bulmahn, Adam Daigle, Thurston Hillman, Eric Hindley, Joe Homes, James Jacobs, Amanda Hamon Kunz, Ben McFarland, Jason Nelson, Thom Phillips, Stephen Radney-MacFarland, Alistair Rigg, Alex Riggs, David N. Ross, Wes Schneider, David Schwwartz, Mark Seifter, Mike SHel, James L. Sutter, and Linda Zayas-Palmer.

Pathfinder Chronicles Campaign Setting. Copyright 2008, Paizo Publishing, LLC; Authors: Mike McArtor, Keith Baker, Wolfgang Baur, Clinton J. Boomer, Jason Bulmahn, Joshua J. Frost, Ed Greenwood, Stephen S. Greer, Jeff Grubb, James Jacobs, Michael Kortes, Tito Leati, Mike McArtor, Rob McCreary, Erik Mona, Jason Eric Nelson, Jeff Quick, Sean K Reynolds, F. Wesley Schneider, Leandra Christine Schneider, David Schwartz, Amber E. Scott, Stan!, Owen K.C. Stephens, Todd Stewart, James L. Sutter, Greg A. Vaughan, Jeremy Walker, JD Wiker.

Cave Moray from the Tome of Horrors Complete © 2011, Necromancer Games, Inc., published and distributed by Frog God Games; Author Scott Greene and Clark Peterson, based on original material by Gary Gygax.

Classic Monsters Revisited. Copyright 2008, Paizo Publishing, LLC; Authors: Wolfgang Baur, Jason Bulmahn, Joshua J. Frost, James Jacobs, Nicolas Logue, Mike McArtor, James L. Sutter, Greg A. Vaughan, Jeremy Walker.

Pathfinder Chronicles: Classic Treasures Revisited. Copyright 2010, Paizo Publishing, LLC; Authors: Jacob Burgess, Brian Cortijo, Jonathan H. Keith, Michael Kortes, Jeff Quick, Amber Scott, Todd Stewart, and Russ Taylor.

Pathfinder Campaign Setting: Construct Handbook © 2018, Paizo Inc.; Authors: Brian Duckwitz, Andrew Hoskins, Nathan King, Kris Leonard, Luis Loza, Adrian Ng, Tom Phillips, Alex Riggs, and Nicholas Wasko.

Pathfinder Adventure Path: Curse of the Crimson Throne © 2016, Paizo Publishing Inc.; Authors: Nicolas Logue, F. Wesley Schneider, Richard Pett, Michael Kortes, Greg A. Vaughan, Tito Leati, and James Jacobs.

Daemon, Ceustodaemon (Guardian Daemon) from the Tome of Horrors Complete © 2011, Necromancer Games, Inc., published and distributed by Frog God Games; Author: Scott Greene, based on original material by Ian McDowall.

Pathfinder Module: Daughters of Fury © 2015, Paizo Inc.; Authors: Victoria Jaczko, with Tyler Beck, Robert Brookes, J. R. Casey, Casey Clements, Clay Clouser, Tyler Cowart, Terry Dutton, Kenneth “Tripp” Elliott, Brian J. Fruzen, Emmanuel Greene, Sam Harris, Peter Johansen, Mikko Kallio, Joseph L. Kellogg, Mike Kimmel, Michele La Barbera, Brian Lefebvre, Richard Malena, Andrew Marlowe, Jacob W. Michaels, Mark Nordheim, Kalervo Oikarinen, Michael Patrick, Iain Reid, Calder Rooney, Mikael Sebag, Andrew Shumate, Jesse Southwick, Andrew Umphrey, and Christopher Wasko. Dawn of the Scarlet Sun Pathfinder Module: Dawn of the Scarlet Sun © 2012, Paizo Publishing, LLC; Author: James Jacobs. Demon Hunter's Handbook Demon, Nabasu from the Tome of Horrors Complete © 2011, Necromancer Games, Inc., published and distributed by Frog God Games; Author: Scott Greene, based on original material by Gary Gygax.

Dead Man’s Chest © 2005 Necromancer Games, Inc.; Authors: Lance Hawvermale, Rob Mason, Robert Hunter, Patrick Goulah, Greg Ragland, Matt McGee, Chris Bernhardt, Casey W. Christofferson, Chad Coulter, Skeeter Green, and Travis Hawvermale, with additional contributions by Erica Balsley, Lindsey Barrentine, Jay Decker, Rachel Mason, and Nadine Oatmeyer.

Demon Lord, Orcus from the Tome of Horrors Complete © 2011, Necromancer Games, Inc., published and distributed by Frog God Games; Author: Scott Greene and Clark Peterson, based on material by Gary Gygax.

Pathfinder Campaign Setting: Distant Shores © 2015, Paizo Inc.; Authors: John Compton, Adam Daigle, Crystal Frasier, Amanda Hamon Kunz, Rob McCreary, Mark Moreland, James L. Sutter, and Owen K.C. Stephens.

Pathfinder Campaign Setting: Dragon Empires Gazetteer © 2011, Paizo Publishing, LLC; Authors: Matthew Goodall, Dave Gross, James Jacobs, Steve Kenson, Michael Kortes, Colin McComb, Rob McCreary, Richard Pett, F. Wesley Schneider, Mike Shel, and Todd Stewart.

Dragon, Faerie from the Tome of Horrors Complete © 2011, Necromancer Games, Inc., published and distributed by Frog God Games; Author: Scott Greene, based on original material by Brian Jaeger and Gary Gygax.

Pathfinder Campaign Setting: Druma, Profit and Prophecy © 2019, Paizo Inc.; Authors: John Compton and Thurston Hillman. Dungeon Denizens Revisited Pathfinder Chronicles: Dungeon Denizens Revisited. Copyright 2009, Paizo Publishing, LLC; Authors: Clinton Boomer, Jason Bulmahn, Joshua J. Frost, Nicolas Logue, Robert McCreary, Jason Nelson, Richard Pett, Sean K Reynolds, James L. Sutter, and Greg A. Vaughan. Dungeoneer's Handbook Russet Mold from the Tome of Horrors Complete © 2011, Necromancer Games, Inc., published and distributed by Frog God Games; Author: Scott Greene, based on original material by Gary Gygax.

Pathfinder Chronicles: Dungeon Denizens Revisited. Copyright 2009, Paizo Publishing, LLC; Authors: Clinton Boomer, Jason Bulmahn, Joshua J. Frost, Nicolas Logue, Robert McCreary, Jason Nelson, Richard Pett, Sean K Reynolds, James L. Sutter, and Greg A. Vaughan.

Pathfinder Module: Emerald Spire, © 2014, Paizo Publishing, LLC; Authors: Keith Baker, Richard Baker, Wolfgang Baur, Jason Bulmahn, Ed Greenwood, Tim Hitchcock, James Jacobs, Nick Logue, Frank Mentzer, Erik Mona, Chris Pramas, Sean K Reynolds, F. Wesley Schneider, Michael A. Stackpole, Lisa Stevens, and James Sutter.

Pathfinder Adventure Path #140: Eulogy for Roslar’s Coffer © 2019, Paizo Inc.; Authors: Jason Keeley, with Eleanor Ferron, Sarah E. Hood, Lyz Liddell, Luis Loza, Crystal Malarsky, Jen McTeague, and Mikhail Rekun.

Pathfinder Player Companion: Faiths & Philosophies © 2013, Paizo Publishing, LLC; Authors: Savannah Broadway, Paris Crenshaw, Neall Raemonn Price, David Ross, Owen K. C. Stepehens, and James L. Sutter.

Flumph from the Tome of Horrors Complete © 2011, Necromancer Games Inc., published and distributed by Frog God Games; Author: Scott Greene, based on original material by Ian McDowell and Douglas Naismith.

Pathfinder Adventure Path #106: For Queen & Empire © 2016, Paizo Inc.; Authors: Stephen Radney-MacFarland, with Adam Daigle, Crystal Frasier, Dave Gross, Garrett Guillotte, Steven T. Helt, Luis Loza, and Josh Vogt.

Pathfinder Roleplaying Game GameMastery Guide. © 2010, Paizo Publishing, LLC; Author: Cam Banks, Wolfgang Buar, Jason Bulmahn, Jim Butler, Eric Cagle, Graeme Davis, Adam Daigle, Joshua J. Frost, James Jacobs, Kenneth Hite, Steven Kenson, Robin Laws, Tito Leati, Rob McCreary, Hal Maclean, Colin McComb, Jason Nelson, David Noonan, Richard Pett, Rich Redman, Sean K reynolds, F. Wesley Schneider, Amber Scorr, Doug Seacat, Mike Selinker, Lisa Stevens, James L. Sutter, Russ Taylor, Penny Williams, Skip Williams, Teeuwynn Woodruff.

Pathfinder Chronicles: Guide to the River Kingdoms. Copyright 2010, Paizo Publishing, LLC; Authors: Eric Bailey, Kevin Carter, Elaine Cunningham, Adam Daigle, Mike Ferguson, Joshua J. Frost, Steve Kenson, Rob Manning, Alison McKenzie, Colin Moulder-McComb, China Miéville, Brock Mitchel-Slentz, Jason Nelson, Richard Pett, Chris Pramas, Je' Quick, Sean K Reynolds, F. Wesley Schneider, Lisa Stevens, Neil Spicer, Matthew Stinson, and John Wick.

Pathfinder Campaign Setting: Heaven Unleashed © 2016, Paizo Inc.; Authors: Judy Bauer, Crystal Frasier, Jim Groves, Amanda Hamon Kunz, Jenny Jarzabski, Jason Keeley, Luis Loza, Ron Lundeen, and Jessica Price.

Hippocampus from the Tome of Horrors Complete © 2011, Necromancer Games Inc., published and distributed by Frog God Games; Authors: Scott Greene and Erica Balsley, based on original material by Gary Gygax.

Pathfinder Roleplaying Game Horror Adventures © 2016, Paizo Inc.; Authors: John Bennett, Clinton J. Boomer, Logan Bonner, Robert Brookes, Jason Bulmahn, Ross Byers, Jim Groves, Steven Helt, Thurston Hillman, Eric Hindley, Brandon Hodge, Mikko Kallio, Jason Nelson, Tom Phillips, Stephen Radney-MacFarland, Alistair Rigg, Alex Riggs, David N. Ross, F. Wesley Schneider, David Schwartz, Mark Seifter, and Linda Zayas-Palmer.

Pathfinder Campaign Setting: Inner Sea Gods © 2014, Paizo Publishing, LLC; Authors: Sean K Reynolds, with Amanda Hamon, James Jacobs, John Ling, Mark Moreland, David N. Ross, F. Wesley Schneider, Amber E. Scott, Tork Shaw, James L. Sutter, Jerome Virnich.

Pathfinder Campaign Setting: Inner Sea Races © 2015, Paizo Inc.; Authors: Ross Byers, John Compton, Adam Daigle, Crystal Frasier, Matthew Goodall, Alex Greenshields, James Jacobs, Amanda Hamon Kunz, Ron Lundeen, Rob McCreary, Jessica Price, David N. Ross, Owen K.C. Stephens, James L. Sutter, Russ Taylor, and Jerome Virnich.

Pathfinder Adventure Path #122: Into the Shattered Continent © 2017, Paizo Inc.; Authors: Robert Brookes, with Ayla Arthur, Adam Daigle, Lucas J.W. Johnson, Robin Loutzenhiser, Ron Lundeen, and Mark Moreland.

Jackalwere from the Tome of Horrors Complete © 2011, Necromancer Games, Inc., published and distributed by Frog God Games; Author: Scott Greene, based on original material by Ian McDowell and Douglas Naismith.

Kobold Quarterly Issue 7, © 2008, Open Design LLC, www.koboldquarterly.com; Authors: John Baichtal, Wolfgang Baur, Ross Byers, Matthew Cicci, John Flemming, Jeremy Jones, Derek Kagemann, Phillip Larwood, Richard Pett, and Stan!.

Pathfinder Adventure Path #141: Last Watch © 2019, Paizo Inc.; Authors: Larry Wilhelm, with Alexander Augunas, Mike Headley, Isabelle Lee, Meagan Maricle, Patchen Mortimer, Kendra Leigh Speedling, and Greg A. Vaughan.

Pathfinder Companion: Legacy of Fire Player’s Guide. Copyright 2009, Paizo Publishing, LLC; Authors: Brian Cortijo, Stephen S. Greer, James Jacobs, Jonathan H. Keith, F. Wesley Schneider, Amber E. Scott, and James L. Sutter.

Pathfinder Player Companion: Legacy of the First World © 2017, Paizo Inc.; Authors: Jake Alley, Judy Bauer, John Compton, Mikko Kallio, Jason Keeley, Joe Pasini, Mark Seifter, Kendra Leigh Speedling, Josh Vogt, and Linda Zayas-Palmer.

Pathfinder Campaign Setting: Lost Treasures © 2014, Paizo Inc.; Authors: Judy Bauer, Savannah Broadway, John Compton, Ron Lundeen, Levi Miles, Justin Riddler, F. Wesley Schneider, Mike Shel, Christina Stiles, James L. Sutter, and Jerome Virnich.

Pathfinder Player Companion: Martial Arts Handbook © 2018, Paizo Inc.; Authors: Thurston Hillman, Mikko Kallio, Jacob W. Michaels, Matt Morris, Daniel Reed, Mikhail Rekun, Mark Seifter, and Jeffrey Swank.

Pathfinder Player Companion: Merchant’s Manifest © 2018, Paizo Inc.; Authors: John Compton, Eleanor Ferron, Thurston Hillman, Nathan King, Isabelle Lee, Jacob W. Michaels, Adrian Ng, David N. Ross, and Mike Welham.

Midgard Bestiary for Pathfinder RPG © 2012 Open Design LLC; Author: Adam Daigle with Chris Harris, Michael Kortes, James Mackenzie, Rob Manning, Ben McFarland, Carlos Ovalle, Jan Rodewald, Adam Roy, Christina Stiles, James Thomas, and Mike Welham.

Pathfinder Adventure Path #144: Midwives to Death © 2019, Paizo Inc.; Authors: John Compton, with Adam Daigle, Eleanor Ferron, Thurston Hillman, James Jacobs, Jason Keeley, Luis Loza, Ron Lundeen, Robert G. McCreary, Erik Mona, Michael Sayre, Owen K. C. Stephens, Mark Seifter, and Linda Zayas-Palmer.

Mite from the Tome of Horrors Complete © 2011, Necromancer Games, Inc., published and distributed by Frog God Games; Author: Scott Greene, based on original material by Ian Livingstone and Mark Barnes.

Pathfinder Roleplaying Game Monster Codex. © 2014, Paizo Inc.; Authors: Dennis Baker, Jesse Benner, Logan Bonner, Jason Bulmahn, Ross Byers, John Compton, Robert N. Emerson, Jonathan H. Keith, Dale C. McCoy, Jr., Mark Moreland, Tom Phillips, Stephen Radney-MacFarland, Sean K Reynolds, Thomas M. Reid, Patrick Renie, Mark Seifter, Tork Shaw, Neil Spicer, Owen K.C. Stephens, and Russ Taylor.

Pathfinder Roleplaying Game Mythic Adventures © 2013, Paizo Publishing, LLC; Authors: Jason Bulmahn, Stephen Radney-MacFarland, Sean K Reynolds, Dennis Baker, Jesse Benner, Ben Bruck, Jim Groves, Tim Hitchcock, Tracy Hurley, Jonathan Keith, Jason Nelson, Tom Phillips, Ryan Macklin, F. Wesley Schneider, Amber Scott, Tork Shaw, Russ Taylor, and Ray Vallese.

Pathfinder Roleplaying Game NPC Codex. © 2012, Paizo Publishing, LLC; Authors: Jesse Benner, Jason Bulmahn, Adam Daigle, Alex Greenshields, Rob McCreary, Mark Moreland, Jason Nelson, Stephen Radney-MacFarland, Patrick Renie, Sean K Reynolds, and Russ Taylor.

Pathfinder Roleplaying Game Occult Adventures. © 2015, Paizo Inc.; Authors: John Bennett, Logan Bonner, Robert Brookes, Jason Bulmahn, Ross Byers, John Compton, Adam Daigle, Jim Groves, Thurston Hillman, Eric Hindley, Brandon Hodge, Ben McFarland, Erik Mona, Jason Nelson, Tom Phillips, Stephen Radney-MacFarland, Thomas M. Reid, Alex Riggs, Robert Schwalb, Mark Seifter, Russ Taylor, and Steve Townshend.

Pathfinder Campaign Setting: Occult Bestiary © 2015, Paizo Inc.; Authors: Josh Colon, John Compton, Paris Crenshaw, Adam Daigle, Eleanor Ferron, James Jacobs, Joe Homes, Mikko Kallio, Mike Kimmel, Ron Lundeen, Kate Marshall, Kalervo Oikarinen, Stephen Radney-MacFarland, and F. Wesley Schneider.

Pathfinder Roleplaying Game Planar Adventures © 2018, Paizo Inc.; Authors: Robert Brookes, John Compton, Paris Crenshaw, Eleanor Ferron, Thurston Hillman, James Jacobs, Isabelle Lee, Lyz Liddell, Ron Lundeen, Joe Pasini, Lacy Pellazar, Jessica Price, Mark Seifter, F. Wesley Schneider, Todd Stewart, James L. Sutter, and Linda Zayas-Palmer.

Pathfinder Player Companion: Plane-Hopper’s Handbook © 2018, Paizo Inc.; Authors: James Case, John Compton, Leo Glass, Avi Kool, Adrian Ng, Lacy Pellazar, Daniel Reed, Mikhail Rekun, Amber E. Scott, Tork Shaw, and Linda Zayas-Palmer.

Pathfinder Adventure Path #119: Prisoner of the Blight © 2017, Paizo Inc.; Authors: Amanda Hamon Kunz, with Paris Crenshaw, Crystal Frasier, Jason Keeley, Isabelle Lee, and Larry Wilhelm. Pathfinder #12: Crown of Fangs Pathfinder 12: Crown of Fangs. Copyright 2008, Paizo Publishing, LLC; Author: Tito Leati. Pathfinder #120: Vault of the Onyx Citadel Atomie from the Tome of Horrors Complete © 2011, Necromancer Games, Inc., published and distributed by Frog God Games; Author: Scott Greene, based on original material by Gary Gygax.

Pathfinder Adventure Path: Rise of the Runelords Anniversary Edition © 2012, Paizo Publishing, LLC; Authors: Wolfgang Baur, Stephen S. Greer, James Jacobs, Nicolas Logue, Richard Pett, and Greg A. Vaughan.

Rot Grub from the Tome of Horrors Complete © 2011, Necromancer Games, Inc., published and distributed by Frog God Games; Author: Scott Greene and Clark Peterson, based on original material by Gary Gygax.

Pathfinder Adventure Path #81: Shifting Sands © 2014, Paizo Inc.; Authors: Richard Pett, with Benjamin Bruck, Adam Daigle, Thurston Hillman, Michael McCarthy, Patrick Renie, Amber E. Scott, and Russ Taylor.

Spriggan from the Tome of Horrors Complete © 2011, Necromancer Games, Inc., published and distributed by Frog God Games; Author: Scott Greene and Erica Balsley, based on original material by Gary Gygax.

Pathfinder Module: The House on Hook Street © 2015, Paizo Inc.; Author: Brandon Hodge. The Midnight Mirror Pathfinder Module: The Midnight Mirror © 2012, Paizo Publishing, LLC; Author: Sam Zeitlin. The Moonscar Pathfinder Module: The Moonscar © 2012, Paizo Publishing, LLC; Author: Richard Pett. The Pact Stone Pyramid Pathfinder Module J4: The Pact Stone Pyramid. Copyright 2008, Paizo Publishing, LLC. Author: Michael Kortes. The Ruby Phoenix Tournament Pathfinder Module: The Ruby Phoenix Tournament © 2012, Paizo Publishing, LLC; Author: Tim Hitchcock. The Witchwar Legacy Pathfinder Module: The Witchwar Legacy. © 2010, Paizo Publishing, LLC; Author: Greg A. Vaughan. The Worldwound The Book of Fiends © 2003, Green Ronin Publishing; Authors: Aaron Loeb, Erik Mona, Chris Pramas, and Robert J. Schwalb.

Pathfinder Campaign Setting: The Inner Sea World Guide. © 2011, Paizo Publishing, LLC; Authors: Keith Baker, Wolfgang Baur, Clinton J. Boomer, Jason Bulmahn, Joshua J. Frost, Ed Greenwood, Stephen S. Greer, Jeff Grubb, James Jacobs, Michael Kortes, Tito Leati, Mike McArtor, Rob McCreary, Erik Mona, Jason Eric Nelson, Jeff Quick, Sean K Reynolds, F. Wesley Schneider, Leandra Christine Schneider, David Schwartz, Amber E. Scott, Stan!, Owen K.C. Stephens, Todd Stewart, James L. Sutter, Greg A. Vaughan, Jeremy Walker, and JD Wiker.

Pathfinder Adventure Path #101: The Kintargo Contract © 2015, Paizo Inc.; Authors: Jim Groves, with Robert Brookes, Stephanie Lorée, Kalervo Oikarinen, David N. Ross, F. Wesley Schneider, and Todd Stewart.

Pathfinder Adventure Path #83: The Slave Trenches of Hakotep © 2014, Paizo Inc.; Authors: Michael Kortes, with Robert Brookes, Adam Daigle, Tim Hitchcock, David N. Ross, Amber E. Scott, and Neil Spicer.

The Tome of Horrors 4 © 2013 Frog God Games, LLC. Authors: Erica Balsley, Casey Christofferson, Jim Collura, Lance Hawvermale, Patrick Lawinger, Phillip Larwood, Greg A. Vaughan, and Bill Webb, based on material by Jonathan Tweet, Monte Cook, and Skip Williams.

Tome of Horrors. © 2002, Necromancer Games, Inc.; Authors: Scott Greene, with Clark Peterson, Erica Balsley, Kevin Baase, Casey Christofferson, Lance Hawvermale, Travis Hawvermale, Patrick Lawinger, and Bill Webb; Based on original content from TSR.

Troll, Two-Headed from the Tome of Horrors Complete © 2011, Necromancer Games, Inc., published and distributed by Frog God Games; Author: Scott Greene, based on original material by Oliver Charles MacDonald.

Pathfinder Roleplaying Game Ultimate Campaign. © 2013, Paizo Publishing, LLC; Authors: Jesse Benner, Benjamin Bruck, Jason Bulmahn, Ryan Costello, Adam Daigle, Matt Goetz, Tim Hitchcock, James Jacobs, Ryan Macklin, Colin McComb, Jason Nelson, Richard Pett, Stephen Radney-MacFarland, Patrick Renie, Sean K Reynolds, F. Wesley Schneider, James L. Sutter, Russ Taylor, and Stephen Townshend.

Pathfinder Roleplaying Game Ultimate Combat. © 2011, Paizo Publishing, LLC; Authors: Dennis Baker, Jesse Benner, Benjamin Bruck, Jason Bulmahn, Brian J. Cortijo, Jim Groves, Tim Hitchcock, Richard A. Hunt, Colin McComb, Jason Nelson, Tom Phillips, Patrick Renie, Sean K Reynolds, and Russ Taylor.

Pathfinder Roleplaying Game Ultimate Equipment. © 2012 Paizo Publishing, LLC; Authors: Dennis Baker, Jesse Benner, Benjamin Bruck, Ross Byers, Brian J. Cortijo, Ryan Costello, Mike Ferguson, Matt Goetz, Jim Groves, Tracy Hurley, Matt James, Jonathan H. Keith, Michael Kenway, Hal MacLean, Jason Nelson, Tork Shaw, Owen KC Stephens, and Russ Taylor.

Pathfinder Roleplaying Game Ultimate Intrigue © 2016, Paizo Inc.; Authors: Jesse Benner, John Bennett, Logan Bonner, Robert Brookes, Jason Bulmahn, Ross Byers, Robert N. Emerson, Amanda Hamon Kunz, Steven Helt, Thurston Hillman, Tim Hitchcock, Mikko Kallio, Rob McCreary, Jason Nelson, Tom Phillips, Stephen Radney-MacFarland, Thomas M. Reid, Alexander Riggs, David N. Ross, David Schwartz, Mark Seifter, Linda Zayas-Palmer.

Pathfinder Roleplaying Game Ultimate Magic. © 2011, Paizo Publishing, LLC; Authors: Jason Bulmahn, Tim Hitchcock, Colin McComb, Rob McCreary, Jason Nelson, Stephen Radney-MacFarland, Sean K Reynolds, Owen K.C. Stephens, and Russ Taylor.

Pathfinder Roleplaying Game Ultimate Wilderness © 2017, Paizo Inc.; Authors: Alexander Augunas, John Bennett, Robert Brookes, John Compton, Dan Dillon, Steven T. Helt, Thurston Hillman, Eric Hindley, Mikko Kallio, Jason Keeley, Isabelle Lee, Jason Nelson, Stephen Radney-MacFarland, Alex Riggs, David N. Ross, David Schwartz, Mark Seifter, Jeffery Swank, and Linda Zayas-Palmer.

Pathfinder Roleplaying Game Pathfinder Unchained. © 2015, Paizo Inc.; Authors: Dennis Baker, Jesse Benner, Ross Byers, Logan Bonner, Jason Bulmahn, Robert Emerson, Tim Hitchcock, Jason Nelson, Tom Phillips, Stephen Radney-MacFarland, Thomas M. Reid, Robert Schwalb, Mark Seifter, and Russ Taylor.

Pathfinder Roleplaying Game Villain Codex © 2016, Paizo Inc.; Authors: Alexander Augunas, Logan Bonner, Paris Crenshaw, Dan Dillon, Crystal Frasier, Amanda Hamon Kunz, Eric Hindley, Mikko Kallio, Dale C. McCoy, Jr., Stephen Radney-MacFarland, Thomas M. Reid, Alistair Rigg, Alex Riggs, Mark Seifter, and Linda Zayas-Palmer.

Pathfinder Player Companion: Wilderness Origins © 2019, Paizo Inc.; Authors: Kim Frandsen, Sasha Hall, Violet Hargrave, Andrew Mullen, Jessica Redekop, Mikhail Rekun, Sean K. Reynolds, and Rodney Sloan.

END OF LICENSE

Part VI — Privacy Policy

Last updated: 23 August 2026. Effective date: 23 August 2026.

Data controller: Bower Family Electric LLC, trading as HeroStack, 7417 Grover Street, Omaha, Nebraska 68124, United States. Privacy contact: privacy@hero-stack.com.

This Part describes what HeroStack Web collects, why, who else sees it, and what you can ask us to do about it. It describes the hosted web application only. It is written against what the software actually does: every item below corresponds to a column, a cookie, or a request the code really makes.

1. What we collect

When you create an account (stored in the users table):

What	Why
Your email address, lowercased	Signing in, confirming the address, resetting a password, and service messages about your own account
Your password	Signing in. See below — we do not store the password itself
A display name, if you choose to set one	Shown to you on your own account page. Optional, and you can clear it at any time
The date the account was created	Account administration
Whether the address has been confirmed, and whether the account has access	Deciding what the account may use

We never store your password. We store a PBKDF2-HMAC-SHA-256 hash of it, with a random per-account salt and 600,000 iterations. The password itself is not written to the database, not written to a log, and cannot be recovered from what is stored — by us or by anyone who obtains a copy of the database.

While you are signed in (the sessions table): one cookie named hs_session holding a random token. The server stores only a SHA-256 digest of that token, never the token itself, alongside your account id and the session's start and expiry. Sessions expire after 30 days.

When you confirm an address or reset a password (the email_tokens table): a digest of the single-use token that was emailed, the address it was sent to, which of the two purposes it serves, and its issue, expiry and redemption times. As with sessions, the value that reaches your inbox is not the value we keep.

To stop password guessing and signup floods (the rate_limits table): a counter keyed on either the email address a sign-in was attempted against, or the IP address the request came from, with the time its window opened. This is the one place your IP address is deliberately recorded by the application. Counters are deleted within about 24 hours of their window closing, and a successful sign-in deletes the counter for that address immediately.

What you create in the app (the characters and content tables): the characters you save and any custom rules content you author, stored against your account id. You keep ownership of this material, and you also grant us a limited licence to use it — to run the service, and to show what the app can do. That licence is set out in [section 15 of the Terms of Service](/terms#15-your-content), and you should read it. This Part covers what happens to your data; section 15 covers what may happen to your creations, and they are different questions.

Server logs. Requests to the application pass through Cloudflare, which keeps its own operational logs. Separately, if an email cannot be sent — or if the service is running without a mail provider configured — the message, including the recipient address, is written to the application log so the failure can be diagnosed.

When you subscribe or start a free trial (stored on your row in the users table):

What	Why
Your Paddle customer and subscription identifiers	Matching Paddle's notices about your subscription to your account, and opening your billing portal
The subscription's status — trialing, active, past due, paused or cancelled	Deciding whether your account has access, and what to show you about it
When your free trial ends, and when it began	Showing the countdown, ending access when it lapses, and making the free trial one per account
The date a cancellation you have asked for takes effect, if you have cancelled	Telling you how long your access runs, and not offering you a cancel button for something you have already cancelled
The date of your next renewal charge	Working out when to send you the advance notices described in section 6 of the Terms of Service
Which of those notices we have already sent you, and whether each was delivered	Making sure you are told once and not repeatedly, and letting us find the ones that failed

When you redeem an access code, we store which code it was, when you redeemed it, what it granted, and the date your access ends (or that it has no end). We do not store the code itself in a readable form — only a one-way hash of it — so a copy of our database yields no usable codes.

We do not receive or store your card details, your billing address, or the amount you were charged. Your invoices and payment history live in Paddle's customer portal, which you can reach from your Account page.

2. What we do not collect

We want to be specific here rather than merely reassuring, because the list is unusually short:

No analytics and no tracking of any kind. No tag manager, no analytics package, no session recorder, no advertising or tracking pixels. There is nothing in the page that reports your behaviour to anyone.
One third-party script, on one action. When — and only when — you choose to start a subscription or open the billing portal, the page loads Paddle's checkout script from cdn.paddle.com so their payment form can open. It is not loaded on the home page, the rules database, or any character page, and it is not loaded at all for an account that never goes to checkout. See section 4.
No advertising, no profiling, and no automated decision-making that produces legal or similarly significant effects.
We do not sell, rent, or share your personal data with anyone for their own purposes, and never for marketing.
No payment details. Subscriptions are sold and processed by Paddle (see section 4). Your card number, expiry, security code and billing address are entered on Paddle's own checkout and go to Paddle, not to us. HeroStack neither receives nor stores any of them, and nothing in the application is capable of charging you. What we store about your subscription is listed in section 1 under "When you subscribe" — an identifier, a status, and two dates.
No location data, no contacts, no device fingerprinting, no advertising identifiers.

3. Cookies and local storage

One cookie. hs_session — strictly necessary, set only after you sign in, removed when you sign out, and expiring after 30 days. It is HttpOnly (script on the page cannot read it) and Secure (it is only ever sent over HTTPS). It exists solely to keep you signed in.

We set no analytics, advertising, or preference cookies, so there is no consent banner to click through — there is nothing to consent to beyond the cookie that makes signing in work at all.

One item of browser local storage. herostack-theme records whether you chose the light or dark theme. It stays on your device, is never transmitted to the server, and contains nothing personal.

4. Who else processes your data

Two providers act on our instructions as processors:

Cloudflare, Inc. — hosts the application and the database (Cloudflare Workers and D1). All account data, sessions, characters and custom content described above are stored on Cloudflare's infrastructure, and all requests to the service pass through their network.
Resend — sends transactional email, and only that: address-confirmation and password-reset messages. Your address is disclosed to Resend for the purpose of delivering those messages. We send no marketing email, so there is no mailing list to be on and nothing to unsubscribe from.

A third, Paddle.com Market Ltd, is not a processor acting for us. Paddle is the merchant of record for HeroStack subscriptions: they are the seller on your receipt, they take the payment, and they register for and remit any sales tax or VAT. For the payment itself they are an independent controller of your payment data, under their own privacy policy and buyer terms.

What that means in practice:

Your card details, billing address and invoice history are held by Paddle. We never see them.
We disclose your email address to Paddle so a subscription can be created against your account and so their receipts and renewal notices reach you.
Paddle tells us when your subscription starts, renews, falls into arrears or ends. We store the identifiers, status and dates listed in section 1.
Paddle's checkout script sets its own cookies on its own domain when the checkout opens. Those are Paddle's, governed by their policy, and we cannot read them.
To cancel, use Cancel subscription on your Account page. To change the card on file, use Manage billing on the same page — it opens Paddle's portal.

All three providers process data in the United States or the United Kingdom, and HeroStack Web is operated from the United States. Where a transfer is subject to UK or EU data protection law, it is made under the Standard Contractual Clauses incorporated into those providers' data processing agreements.

We may also disclose data where we are legally required to, or where it is necessary to establish or defend a legal claim.

5. Why we are allowed to hold it (legal bases)

Where the UK GDPR or EU GDPR applies:

Performance of a contract — your email address, password hash, display name, sessions, characters and custom content. These are what providing the service consists of; without them there is no account.
Legitimate interests — the rate-limit counters (including IP addresses) and server logs, for the security and integrity of the service. We consider this proportionate: the data is minimal, it is used for nothing else, and it is deleted quickly. Its purpose is to protect your account from someone guessing its password.
Legal obligation — where we must retain or disclose something to comply with the law.

We do not rely on consent for anything described here, because nothing here is optional to the service. That also means there is no consent to withdraw — the way to stop the processing is to close the account.

6. How long we keep it

Data	Retention
Account record	Until you ask us to delete the account
Characters and custom content	Until you delete them, or the account
Sessions	30 days, or until you sign out; "sign out everywhere" removes all of them at once
Confirmation and reset tokens	The link works for 24 hours (confirmation) or 1 hour (reset). The row is kept afterwards as the record that a message was sent, so the send limit can count it, and is cleared on a rolling basis
Rate-limit counters	Deleted within about 24 hours of the window closing; sooner on a successful sign-in
Application and provider logs	As long as our providers retain them under their own policies

7. Your rights

Where the UK GDPR or EU GDPR applies you have the right to ask for access to your personal data, correction of it, erasure, restriction of processing, portability of the data you gave us, and to object to processing carried out on the basis of legitimate interests. Residents of some other places — California among them — have comparable rights, including the right not to be discriminated against for exercising them. We do not sell personal data under any definition of that phrase.

Some of this you can do yourself in the app today: change your display name, change your password, and sign out of every device from the account page.

Deletion and export are by request, not self-service. The application does not yet have a "delete my account" or "download my data" button. Until it does, email privacy@hero-stack.com and we will action the request. We aim to respond within 30 days, which is the outer limit the GDPR allows.

If you think we have handled your data badly, please tell us first — but you are entitled to complain directly to a supervisory authority. In the UK that is the Information Commissioner's Office (ico.org.uk). In the EU it is the authority for the country you live in.

8. How it is protected

Concretely, and only claiming what is true:

Passwords are stored as salted PBKDF2-HMAC-SHA-256 hashes at 600,000 iterations, never in a recoverable form.
Session tokens and emailed confirmation/reset tokens are stored as SHA-256 digests, so a copy of the database does not yield a working credential for any account.
The session cookie is HttpOnly and Secure; all traffic is over HTTPS.
Sign-in attempts are rate limited per account and per source address, and account creation and password-reset requests are rate limited per source address.
The API accepts credentialed requests only from the application's own origin.

No system is perfectly secure, and we do not claim otherwise. If we become aware of a breach affecting your personal data and the law requires it, we will notify the relevant supervisory authority within 72 hours of becoming aware of it, and will tell you directly where the breach is likely to result in a high risk to your rights and freedoms.

9. Children

HeroStack Web is not directed at children and we do not knowingly collect personal data from anyone under 13 (or under the minimum age set by local law where that is higher). If you believe a child has given us personal data, write to privacy@hero-stack.com and we will delete it.

10. Changes to this Part

If this Part changes materially — a new processor, a new category of data, a new purpose — we will update the "last updated" date above and tell account holders by email before the change takes effect. Adding payment processing is expressly one of those cases.

Part VII — User Content and Licence

Part VIII — Subscription Terms

Both of these are contractual terms rather than notices: they are the agreement you enter into, not a statement about licensing. They live in the [Terms of Service](/terms), which is presented for agreement when you create an account and which is the single document governing your use of HeroStack Web.

What you create in the app — what stays yours, and what licence you grant us by saving it here — is section 15.
The subscription — price, the free trial, access codes, renewal notices, cancelling, refunds and the 14-day right of withdrawal — is sections 4 to 11.

They were previously reproduced here in full. They are not any more, because two copies of a contract are two copies that will eventually disagree, and the one people are asked to agree to is the one that has to be right.

Appendix A — Sources consulted

Open Gaming Foundation, Open Game License v1.0a — the copy carrying Wizards' redistribution permission; used for the verbatim check.
Paizo Inc., Pathfinder Roleplaying Game Reference Document licence page — 145 Section 15 notices for the core line.
Archives of Nethys licence index — per-book Section 15 chains for 411 Paizo works; also the compilation from which part of the full-text side channel derives (see Part II, Provenance).
d20pfsrd.com, Legal Information and its published copyright-notice list — 1,185 notices; the compilation this corpus derives from.
Paizo Inc., Paizo Compatibility License and Compatibility License FAQ — scope, and the exclusion of apps.
Paizo Inc., New and Revised Licenses, 22 July 2024 — Community Use Policy replaced by the Fan Content Policy.
Wizards backtracks on OGL deauthorisation, 27 January 2023 — OGL v1.0a left in force.
Pathfinder Roleplaying Game — 1st Edition remains under OGL v1.0a; 2nd Edition moved to ORC.