JRFortune.com

Privacy Policy

Effective Date: September 9, 2026 • Scope: All JRFortune.com Services

Welcome to JRFortune.com. Your privacy is paramount to us. This Privacy Policy governs your access to and use of https://jrfortune.com/ and all associated web applications, services, and endpoints hosted on this domain, including the Application Portal, the Tomb of Annihilation D&D campaign portal (/dnd/), the Dungeon Master Dashboard (/dm/), the experimental project Into The Deep (/intothedeep/), and event tools (/beer).

This document explains what information we collect, how that information is utilized, how it is protected, and your rights regarding your personal data.

1. Scope and Optional Authentication

Browsing the JRFortune.com portal and public web applications does not require you to create an account or log in. You may view public information, logs, and event forms as a guest.

We offer an optional Google OpenID Connect (OIDC) Single Sign-On option. Logging in with your Google account authenticates your identity across supported applications on the domain, enabling player profile associations and granting role-based access to restricted services (such as the Dungeon Master administration suite) if your email is authorized.

2. Information We Collect

When you choose to authenticate using Google OpenID Connect (OIDC), we request access to basic, limited profile information through Google's standardized OAuth/OIDC authorization scopes (openid email profile):

  • Your Full Name: Used to personalize your experience, address you within campaign tools, and display your user tag.
  • Your Email Address: Used as your unique account identifier to authenticate sessions and verify role-based permissions (e.g., administrator or player access).
  • Your Profile Picture URL: (If available) Used solely to display your avatar in the navigation bar and alongside player character records.
  • Google Subject Identifier (sub): A unique, anonymous alphanumeric ID assigned by Google to uniquely map your account without storing passwords.

What We NEVER Collect: We do not collect, access, or store your Google account password, contacts, Gmail messages, Google Drive files, browsing history, calendar entries, location data, or payment information.

Technical & Diagnostic Data

Like virtually all web servers, when you make requests to our server, standard diagnostic technical information is recorded in server access and error logs. This includes your IP address, browser user-agent, referring URL, and timestamps. This data is strictly used for network security, diagnostics, and preventing abusive automated traffic.

3. How We Use Your Information

Information collected through jrfortune.com is strictly utilized for the operation, administration, and security of our hosted services. Specifically:

  • To authenticate your identity across applications on jrfortune.com without requiring repetitive logins.
  • To enforce authorization policies, such as ensuring only designated administrator emails (e.g., alchemy77@gmail.com) can access the DM Dashboard.
  • To associate adventurer characters, notes, and session attendance with the correct individual player.
  • To maintain secure cryptographic session states.

4. Cookies and Session Storage

We utilize essential HTTP cookies to maintain secure sessions:

  • mod_auth_openidc_session: An encrypted, signed session cookie managed by the Apache mod_auth_openidc module to maintain your authentication state across domain routes.
  • portal_session: An encrypted, signed HTTP-only cookie used to retain portal-specific preferences and authenticated status.

All session cookies are transmitted exclusively over encrypted HTTPS connections (Secure flag) and are marked HttpOnly to prevent unauthorized access by third-party scripts. We do not use advertising or tracking cookies.

5. Data Storage and Retention

Your login identifiers (email, name, and Google ID) are stored securely on our dedicated host server. We retain this data only for as long as you participate in the active campaigns or projects hosted on jrfortune.com, or until you request its removal. Inactive or orphaned accounts are periodically reviewed and pruned.

6. Data Sharing and Third Parties

We take a firm, zero-compromise stance on user privacy:

  • No Data Sales: We do not sell, rent, monetize, or trade your personal data to any third parties, data brokers, or advertisers.
  • No Marketing: Your information is never used for marketing, promotional campaigns, newsletters, or tracking.
  • Service Providers: Data is only transmitted to Google's authentication infrastructure to verify your OpenID Connect credentials when you actively click the login button.

You may review Google's Privacy Policy at https://policies.google.com/privacy.

7. Data Security Measures

We implement industry-standard security protocols to protect your information:

  • End-to-End TLS/HTTPS Encryption: All traffic to and from jrfortune.com is encrypted with modern TLS certificates issued by Let's Encrypt, with HTTP Strict Transport Security (HSTS) enforced.
  • Hardened Reverse Proxy: Authentication boundaries are enforced at the web server level using Apache's vetted mod_auth_openidc module.
  • Secure Host Infrastructure: Applications run isolated in managed Linux environments with firewall rules and least-privilege service configurations.

8. Your Rights & Data Deletion

You retain full control over your personal data:

  • Revoke Access: You can revoke jrfortune.com's access to your Google Account at any time via your Google Account Security Dashboard at https://myaccount.google.com/permissions.
  • Request Deletion: To request immediate deletion of your email, character associations, or any records stored on our server, contact the administrator at jacob@jrfortune.com.
  • Access Your Data: You may request a summary of any data tied to your Google ID at any time.

9. Changes to This Policy

We may update this Privacy Policy from time to time to reflect new applications, feature enhancements, or regulatory requirements. When changes occur, the "Effective Date" at the top of this document will be updated. We encourage you to review this page periodically.

10. Contact Us

If you have questions, concerns, or feedback regarding this Privacy Policy or the security of jrfortune.com, please contact:

Jacob Fortune
Administrator & Developer, jrfortune.com
Email: jacob@jrfortune.com

Return to Portal Home → View Platform Purpose