Privacy Policy
The Token Maker makes tokens in your browser and never uploads your images. What little we collect, why, and who processes it.
This policy explains what The Token Maker ("we", "us") collects when you use thetokenmaker.com, why, who helps us process it, and the choices you have. The Token Maker is run by an independent developer. Questions: support@thetokenmaker.com.
The Token Maker is an independent fan tool. It is not affiliated with, endorsed by, or sponsored by Wizards of the Coast, Roll20, Foundry Gaming or Owlbear Rodeo.
Your images stay on your device
The token maker runs in your browser. Images you upload, paste or drop in are cropped, framed and exported on your device. They are never sent to our servers or anyone else, and we never see them. The tokens you download are saved straight from your browser.
What we collect
Usage analytics
We use PostHog to see how the site is used: pages visited, referring site, device and browser type, approximate location from your IP address, and actions such as adding images or downloading tokens (for example the size, shape and border style chosen — never the images themselves). Session replays record how you move through the site, with text typed into fields masked and token previews not captured as images. In Europe we only use analytics cookies and session replay if you accept them; see the Cookie Policy. We don't use advertising cookies.
Support messages
If you contact us, we keep your name, email address and message so we can reply.
Pro launch list
If you leave your email in the "Pro is coming" box, we keep it only to email you when Pro launches. Every email has an unsubscribe link, and you can ask us to delete your address at any time.
Technical data
Our hosting provider keeps short-term server logs (such as IP address, requested page and time) for security and troubleshooting.
How we use it
- To run and secure The Token Maker.
- To understand how the site is used and improve it.
- To answer your messages.
- To meet legal obligations.
We don't sell your personal information.
If you are in the EEA or UK, we rely on our legitimate interests (security and cookieless usage statistics), your consent (analytics cookies and session replay), and legal obligation as our legal bases.
Who processes your data
| Provider | What for | Data involved |
|---|---|---|
| Cloudflare | Hosting, security, sending emails (contact-form messages, the Pro launch email) and keeping the Pro launch list | IP address, requested pages, email address and message |
| PostHog | Usage analytics and session replay | Usage events, device and browser data, IP address |
| These providers are based in, or process data in, the United States. Where the law requires it, transfers are covered by appropriate safeguards such as Standard Contractual Clauses. |
We may also disclose information if required by law, or to protect the rights and safety of our users or others.
How long we keep it
- Analytics events and session replays (PostHog): up to 1 year.
- Support messages: as long as needed to answer and follow up.
- Your images and tokens: we never receive them.
Your choices and rights
- Access or delete your data, or ask any privacy question, by emailing support@thetokenmaker.com.
- Depending on where you live (for example the EEA, UK or California), you may have further rights, such as to object to or restrict processing, and to complain to your local data protection authority. We don't sell or share personal information for targeted advertising.
Children
The Token Maker is not directed at children under 13. If we learn that we collected personal information from a child under 13, we will delete it. Parents can contact us at support@thetokenmaker.com.
Changes
If we change this policy, we'll update the date at the top. Accounts and paid plans are not available yet; when they are, this policy will be updated before they launch.
Contact
The Token Maker, run by an independent developer. Email: support@thetokenmaker.com.