Privacy

The short version: your campaign is yours, on your disk.

Campaign Familiar keeps your campaign in a database file on your own machine. There is no account to create, no sync, and no copy of your world on any server I run. I cannot read your campaign, because I do not have it.

Some things do leave your machine. This page says exactly what, when, where it goes, and what happens to it there.

This page covers two separate things, and they make very different promises. Part one is the desktop app you install. Part two is this website. The app is local-first and needs no account. A website cannot claim either of those about itself, so the two are kept apart rather than blended. If you came here from inside the app, part one is the one you want.

Everything in this part describes Campaign Familiar, the application installed on your computer. None of it describes this website.

What leaves your machine

Three things, and you set off all three yourself. Nothing about your campaign is sent on a timer, in the background, or while you sleep.

When you ask for a draft. The slice of campaign context that draft needs goes to Anthropic, whose model writes it. Not your whole campaign, but a real and sometimes substantial part of it.

When your campaign is indexed so the app can recall it. Six layers of your campaign are turned into embeddings, which is the machinery behind recalling your own material. Four of those layers are invented fiction: your characters, the web of who knows whom, the themes, and where things sit on the timeline. Two are not. Session context carries excerpts from your session records, so if you paste raw transcripts it includes whatever was actually said at your table. DM annotations carries your private strategic notes, the ones you write for yourself. All six go to a second vendor, Voyage AI.

This is worth being precise about, because "indexed" sounds like something that happens quietly. It does not. Indexing runs when you press Regenerate AI Embeddings in Settings, when you ask a question in Ask Campaign (the question itself is embedded so the app knows what you are asking about), and as part of generating, the first time the app works out what kind of thing you are making. A layer is only re-sent if its text actually changed since last time.

When you import a PDF. The text of the book goes off your machine, to Anthropic. I want to be blunt about this one, because "import" usually means the file stays put, and here it does not. The file itself never moves. The text extracted from it does.

What does not leave, and what people assume does

Your private DM notes and your session records go to Voyage for indexing, and not to Anthropic. The drafting side works from a shallower slice that does not include them.

Requests to Anthropic carry no identifier of any kind. No account, no user ID, no campaign ID, nothing tying one request to another or to you. There is no account to tie them to.

There is no licence check, no phone-home, and no usage report. The app counts your AI use in the local database so you can see it in Settings, and that count stays on your machine. Campaign search does not use AI at all; it reads your local database directly.

Two things that leave on their own

Neither carries a word of your campaign, but both are requests to someone else's server, so they belong on this page.

The update check. A few seconds after the app starts it fetches a small file from an Amazon S3 bucket I control, to see whether a newer version exists. The request carries no version number, no platform, and no identifier of any kind — it is a plain fetch of one small public file. I have not enabled access logging on that bucket, there is no audit trail configured for it, and there is no content delivery network in front of it, so I hold no record of which machines checked for an update or when. Amazon operates the storage itself and its own internal records are not mine to describe. Verified against the bucket's configuration on 14 August 2026.

Fonts. The app loads four typefaces from Google Fonts when its window opens. As with any web request, Google sees your IP address and the fact that a request was made. I would rather ship these fonts inside the app so this stops being true, and that is a fix, not an excuse — this website already serves the same four typefaces from its own server, so the app is the half still to be fixed.

Those two are the whole list of automatic calls. I checked every way the app's window can request something from outside itself, not just the ways code fetches data: stylesheets and other link tags, scripts, images and media, CSS imports, embedded frames, connection hints, and service workers. Google Fonts was the only external recipient found.

What happens to it there

Anthropic

Under Anthropic's commercial terms, content sent through the API is not used to train their models, and inputs and outputs are deleted from their backend systems within 30 days by default. Content their safety systems flag can be held longer than that.

Anthropic uses sub-processors of its own, and they are recipients too, so naming two vendors does not finish the answer. Its published list had twenty entries when I last checked it on 13 August 2026, of which sixteen apply to the API tier this app uses. The ones that actually carry your campaign context are Anthropic's cloud infrastructure, which is Google Cloud, Amazon Web Services and Microsoft Azure, plus Cloudflare for traffic routing. The rest are Anthropic's own business operations: error reporting, billing, fraud checks, email and support. Those reach content only incidentally, for example if a support ticket happened to carry some.

By default Anthropic may route requests through the United States, Europe, Asia or Australia, and stored data sits in the United States. That list belongs to Anthropic and it changes. The current version is always at trust.anthropic.com/subprocessors, and I re-check it whenever I review this page.

Voyage AI

Voyage's default terms let them use customer content for model training under a broad and permanent licence. I opted this account out on 13 August 2026. Their terms say content sent after an opt-out is deleted immediately once it has been processed, so from that date nothing sent from Campaign Familiar is trained on or kept.

One detail I would rather you learn here than discover later: the opt-out is not retroactive. Anything sent before 13 August 2026 stays under the earlier licence, which is permanent and cannot be withdrawn. What fell in that window was my own pre-release development and testing, not live campaigns. I have asked Voyage to delete it in any case. If you are reading this as someone considering a founder seat, the practical version is simpler: everything from your campaign will be sent after that date, so none of it is in the window.

Voyage AI has been owned by MongoDB since February 2025. I mention it because you would find it in a minute of looking and I would rather it came from me. It is a fact about who owns the vendor, not about where your campaign lives. Voyage keeps its own sub-processor list, three entries as at 13 August 2026: Amazon Web Services, Google, and Baseten Labs. It undertakes to publish new ones thirty days before engaging them.

Getting there through your antivirus

Some antivirus products, and most corporate networks, inspect encrypted traffic by sitting between the app and the vendor. Campaign Familiar works normally in that situation: it validates certificates against your operating system's own trust store, which is where those products install themselves, so nothing breaks and you are not asked to weaken anything. Tested against live interception on 14 August 2026.

About your players

This one is yours to handle, and I would rather say so than leave it implied. Your players are at your table, not on my list. They have not agreed to anything with me. If you paste raw session transcripts, whatever they said goes with it, including the parts that had nothing to do with the game and the parts with their names in them.

Two honest options: tell them what the tool does, or trim the transcript before you paste it. I would rather you did the first.

What stays, always

Your campaign database is a file on your computer. Every NPC, location, session log and note lives there. Full export is built in. If you stop paying, uninstall, or I disappear tomorrow, the app keeps working and the database is still yours.

Deleting something in the app deletes it locally. What has already been sent is governed by the vendor terms above, which is why those terms are written out in full rather than summarised.

Everything in this part describes the website you are reading right now. None of the app's promises above apply to a website. A page you load is a request to a server, so a website cannot be local-first and cannot claim to hold nothing about you. Here is what this one actually does.

Analytics

The site uses Fathom Analytics to count page views. Fathom sets no cookies and does no cross-site tracking, and there are no ad networks on this site. That is why you are not being asked to accept anything.

Being exact rather than reassuring: Fathom does briefly handle your IP address and browser user-agent, because it has to receive the request to count it. It converts them into an anonymous hash rather than storing them, and destroys the ingredients needed to reverse that hash after roughly 48 hours. So there is a short window in which the data exists in a pseudonymous form, and after it there is no way back to you. "No cookies" is exactly true. "Collects nothing about you" would not be, and this page said that until 14 August 2026.

Hosting and request logs

The site is hosted on Cloudflare Pages. Loading any page means Cloudflare receives your IP address, the page you asked for, your user-agent and the time, because that is what serving a request requires. Cloudflare uses that to deliver the page and to filter abusive traffic, under its own privacy terms rather than mine. I have not enabled raw request-log export, so I do not receive, store or read a log of individual visits. Cloudflare shows me aggregate counts only.

Forms and what the site collects directly

There is no signup form, no waitlist, no newsletter box and no contact form on this site. The only form on any page is the guide search, and it runs entirely inside your browser against an index that ships with the site — what you type into it is never sent anywhere, including to me.

If you want to reach me, the email address below is a plain link, not a form.

Purchases

Payments run through Stripe, on Stripe's own checkout page. Clicking the buy button sends you to Stripe; this site collects no payment or contact details itself. I see what a receipt needs, your name and email, and use it for your licence and nothing else. No mailing list you didn't ask for.

Fonts on this site

The four typefaces are served from this site's own server, not from Google. They are built into the site rather than fetched when a page loads, so reading this page tells Google nothing and no third party learns you were here. Checked against the built output: twenty font files served from this origin, and no font host referenced in any stylesheet.

The app has not caught up yet. It still fetches the same four typefaces from Google Fonts, which is described in part one. Same fonts, different arrangement, and the site's arrangement is the one I want on both sides.

When this page changes

This page is rewritten whenever what leaves the machine changes. It is written against a manifest of every outbound call in the app, kept in the source repository, rather than from memory.

Last reviewed: 14 August 2026

Questions? sandy@campaignfamiliar.com, and you'll get a straight answer. The rest of the trust picture is on the trust page.