AI Policy

Generative AI in the application

Version 1.1 of this policy said that no generative AI ships inside the application. That was not true, and this version corrects it.

The application has optional features that use generative AI. None of them runs until you use it:

• Text: generating a monster or an encounter, and suggesting a token's name.
• Images: AI fill in the image editor, and background removal by OpenAI or Gemini.
• An assistant: Bert, in the chat, which answers questions about the application and about your own game, and makes small changes you ask for.

The map generator uses no AI model. It builds maps from an algorithm and a seed, on your own device, and sends nothing to an AI provider. Its placeholder artwork is another matter: see Our artwork is not AI-generated, below.

We also publish a separate genAI module for further enhancements, such as generating artwork. It is included in our shared hosting environment and optional for self-hosted users. It is not required in order to use the application, and it is not part of the application.

Whose account an AI feature runs on

A feature that calls an AI provider uses your own API key if you have entered one for that provider in Settings → AI, billed to your own provider account. If you have not, then on our shared hosting it runs on our account with that provider (usually OpenAI), under that provider's terms with us. A self-hosted installation runs these features on whatever keys its operator has configured, or not at all.

Bert, the assistant, is the exception in this release: it runs on your own key only. Without one it answers that it needs a key and where to add it, and calls no provider.

The AI that runs in your browser

Some models run locally, in your browser.

Most are for image processing: finding a face to crop a token around, separating a subject from its background, picking out the object you click on. These models analyse; they do not generate. They read an image and return raw data (coordinates, outlines, a mask). They load from the installation you are using, which on our hosting means from us, so using them shares nothing with any third party.

One is a language model, and it generates: by default, monsters and encounters are written by a model running in your browser. What you type stays on your machine. But its weights (about two gigabytes) download from Hugging Face, and its runtime from GitHub, the first time you use it, so those two sites see that download, as they would any other.

We name the categories rather than the individual models on purpose: the models change and this policy should not need reissuing when they do. For the current specifics, see AI Features.

What leaves your browser

Every other AI feature runs on our server and sends what you gave it to an AI provider for the duration of the call:

• The generative features above, except the in-browser language model.
• Reading a character sheet: the sheet's text, or images of its pages for a scanned PDF, go to a language model, which returns the character's fields.
• Finding the walls in a map image: the image goes to a segmentation model we run and to an OpenAI model, which return the walls' outlines.
• Tagging images in your library: each image goes to a vision model, which returns tags. That is a model the installation runs itself where it has one, otherwise Gemini, Claude or OpenAI.
• Finding every object in an image at once, for extracting them in a batch: the image goes to a hosted segmentation service, currently Replicate running Meta's Segment Anything, and what comes back is masks.
• Asking Bert: your question, the conversation so far in the Bert channel, where you are asking from (the campaign, the open map, and the token you are speaking as), and whatever Bert reads on your behalf to answer — your campaigns, maps, tokens, characters, conditions, chat and Library — go to the provider you chose, on your key. Bert reads through the application's own routes as you, under the same permissions: it sees what you can see, and nothing a token hidden from you or a map you cannot open would reveal. Bert acts as you under the same permissions too: it can make small changes you ask for (a token's properties, conditions or position, a name, a chat message as you), each marked via Bert in history and undoable, except a chat message. Deleting something on a map (a token, a drawing, a placed object, the fog of war, or a token's aura, action or artwork), placing monsters or an encounter it generates, and any change you did not ask for in your own words wait for you to tap Do it. Bert is instructed to treat what it reads as information, not as instructions. When Bert generates monsters or an encounter, the description goes through the application's generation routes to the provider you chose, on your key, when Bert proposes them. Your account id and email address are not sent; the names in chat messages Bert reads are. The key is held in memory for the length of one answer and never written down.

Picking a single object by clicking on it never leaves your browser. A self-hosted installation can point the batch sweep at its own machine instead (self-hosting).

Our artwork is not AI-generated, with one temporary exception

We did not use generative AI to create any image in the application, or in any of our first-party modules, except the one below. Artists were employed for the (somewhat limited) artwork we have.

The map generator's placeholder art is AI-generated. The trees, rocks, bushes, road markings and ground textures the map generator draws are drawn by code that an AI wrote, so we treat them as AI-generated. They are placeholders: they let us build and test the generator before its real art exists. Art made by human artists replaces them before the map generator is generally available, and no AI-generated image will remain in the application when it does. When the art changes, a map you generated keeps every tree, rock and road exactly where it is; only its look changes.

Where a module ships purchased assets, it says so: the Scenes module notes that we bought its assets from an artist, and so does the vtt-assets module when it is installed.

We do use AI to build the software

Our software engineering is assisted by AI agents, including Anthropic's Claude Code and Google's Gemini. Humans review and are accountable for what ships.

When you use your own API key

If you supply your own key, your prompts and inputs go to that provider, under that provider's terms and privacy policy — not ours. What they retain, and whether they train on it, is between you and them.

What we keep

Whoever's key a feature runs on, we do not store your prompts, or the providers' raw responses, with one exception. We transform a response into the native objects it was asked for (a Character, a Token, an image, a set of tags) and keep only those, exactly as if you had made them by hand.

The exception is the earlier, AI-based map generator, which this version retires. Maps made with it keep the description that was typed and the layout the model returned, so that the generation can be removed as a batch; nothing new is written. The map generator that replaces it uses no AI model.

Bert is the other exception, and a small one: your question and Bert's answer are chat messages, kept as any message in the chat is, for as long as it is. With the answer we keep a list of what Bert read to give it — each lookup's name and a short description, such as "map Old Keep", and, when one failed, a short error message — and which provider and model answered and how many tokens it used. We keep the list, not the contents of what Bert read. When Bert changes something or proposes a change, the answer also keeps what it changed or proposes (for generated creatures, the names and statistics it would place), so that Undo and Do it work. Nothing else of the exchange is kept: not the key, and not the provider's raw replies.

For everything else we store about you, see the Privacy Policy.

Changes to this policy

This document carries a version and a date, at the top. When it changes materially, both change, and the previous text stays in the repository's history.

• 1.5, 2 November 2026 — Bert makes small changes you ask for, as you under the same permissions, each marked via Bert and undoable; deleting, placing what it generates and any change you did not ask for in your words wait for your Do it; what it sends to generate monsters goes to your provider on your key (Generative AI in the application, What leaves your browser); an answer keeps what Bert changed or proposes (What we keep).
• 1.4, 27 October 2026 — Bert, the assistant in the chat: listed under Generative AI in the application; runs on your own key only (Whose account an AI feature runs on); what a question sends, and that Bert reads as you under the same permissions (What leaves your browser); a question and its answer are kept as chat messages, with a list of what Bert read (not its contents), the provider, the model and the token counts, and nothing else of the exchange is (What we keep).
• 1.3, 15 October 2026 — the map generator's placeholder art is AI-generated, and is replaced by human-made art before the generator is generally available (Our artwork is not AI-generated, with one temporary exception). The earlier map generator, which asked a language model to describe a map and drew artwork with the genAI module, is retired: removed from Generative AI in the application, and its stored descriptions are kept only for maps it already made.
• 1.2, 8 October 2026 — corrected claims the application contradicted: generative AI does ship in it (text and images, listed under Generative AI in the application), and runs on our provider account when you have not entered a key; the in-browser language model generates, and downloads its weights from Hugging Face; wall detection runs on our server, not in your browser; the map generator keeps its prompts. Replaced The one analysis that can leave your browser with What leaves your browser, which lists every feature that sends your input to a provider. The face detector's weights are now served by us rather than fetched from Google.
• 1.1, 10 September 2026 — added The one analysis that can leave your browser: the batch object sweep runs on a hosted segmentation service.
• 1.0, 23 August 2026 — first version.