Sharing and Permissions
The model, in one paragraph
Everything you make — a campaign, a map, a token, a character, a party, a faction — has an owner, and the owner can do anything with it. Everyone else's access is a role you grant them, on the thing itself or on something above it: a role on a campaign reaches its maps, the tokens on them, its parties and factions, and (capped, see below) its linked characters. There is no "deny" — access is a grant, or it is nothing — which is why every line on the Effective tab has exactly one explanation.
The roles
| Role | May |
|---|---|
| Owner | Everything, including handing out roles and defining new ones. Ownership is not a role you grant: it is who made the thing, or who it was transferred to. |
| Editor | See it, play it, edit it, and share it with others — up to Editor. |
| Collaborator | See it and play it: impersonate a token, move it, change its HP and conditions, roll. |
| Viewer | See it. |
A campaign can define its own roles beside these — any mix of the six permissions (see, play, edit, delete, share, manage roles), offered on whichever kinds of thing you choose. Only someone who may manage roles (the owner, unless a custom role says otherwise) can invent one.
Two rules of the cascade that catch people out:
- A role from above is a floor, not a ceiling on maps, tokens, parties and factions: a campaign Editor is at least an Editor on every map in it, and a Viewer grant on one map does not take that away.
- Characters are the exception. A character belongs to a person, not a campaign, so what a campaign confers on its linked characters is capped at Collaborator — the GM can play your character in a session and cannot rewrite your sheet. To let someone edit a character, share the character itself.
The permissions editor
Every Share button — on a campaign, a character, a token's settings — opens the same editor, with three tabs.
Who has access
The list of people with a role here, the owner at the top (locked, and it says why). Change a role from its dropdown, remove someone with the bin, add someone by username — the box searches usernames as you type; email addresses are not shown anywhere and cannot be used to find someone. A custom role appears in the dropdown beside the built-ins when the campaign has any; a role above your own is shown but cannot be handed out.
Nothing is written when you click. Changes pile up as pending until you press Preview or Apply. Preview says exactly what would change — who gains what, who loses what, and what they lose inside the thing ("also loses access to 3 maps and 7 tokens"). Apply commits the lot at once; when anyone would lose access, it asks first. Discard throws the pending set away.
You can change the list if you may share the thing: its owner, an Editor, or a custom role that includes share. A Collaborator sees the list and cannot change it.
Effective
Everyone who can do anything here, their effective role, and where it comes from: granted here on 12 Sep, from Campaign X, owner of Campaign X, at least Editor, from Campaign X. When two grants reach the same person the tab shows the union, and both sources. Anyone who can see the thing can see this tab — knowing who else can see a character is not a secret about them.
History
Every change to this thing's permissions, newest first: who made it, what changed, how — through this editor, through a sharing invite, when a custom role was deleted, by the migration that introduced roles — and whether it was done in Superuser Mode. Filter by the person it was about. Shown to whoever may share the thing.
History outlives what it records: deleting a character does not delete its permission history. An administrator can see every entity's history, including deleted ones, and is the only one who can purge it — by age, never less than thirty days.
Inviting people to a campaign
The campaign's Share modal also carries the ways in:
| Way in | What happens |
|---|---|
| Invite link | Anyone who follows it and signs in joins as whatever New members get says. Set an expiry and a use limit. |
| An invitation sent to an address; accepting it joins the same way. | |
| Existing players | Add someone who has already played with you, directly. |
New members get is a row on the same modal — Collaborator by default, which is what "member" has always meant, or any other role including a custom one. It applies to everyone who joins from then on and changes nobody who is already in.
⚠️ An invite link is a bearer token. Anyone who has it can use it, whether or not you meant them to. Share it in a private channel, set an expiry, and set a use limit. If a link leaks, revoke it and make a new one.
Sharing a character
Characters are shared from the sheet's Share button, with the same editor. Someone who can see a character but not open it can request access; you get a notification and can grant or deny it from there.
Tokens
A token's owner is the player who controls it. A token on a map inherits the map's and the campaign's roles, and can carry its own on top — a Collaborator grant on one token is how a GM lets a player run a monster for a round. The token's settings drawer opens the same editor.
What other members can do with your content
Once you share something into a campaign, the other members can see it, and depending on their role can copy, edit, or export it. Removing someone later does not retrieve copies they already took.
Share deliberately. This is the same trade-off as handing someone a photocopy.
Public links
Some content can be shared by public link. Treat those exactly like invite links — they work for whoever holds them.
Removing access
- Remove a person from the list, or lower their role — Preview shows what they lose, Apply confirms it.
- Delete an invite link.
- Delete a custom role: the editor asks what its holders become.
None of these retrieve data already exported. All of them stop future access, and all of them are in the History tab.
Administrators
An administrator is an ordinary user until they turn on Superuser Mode, which is timed, shown as a banner, and recorded against every permission change made while it is on.