Privacy Policy
The short version: the Rollwarden extension has no accounts, no analytics, no telemetry, and no servers of its own. It never collects, transmits, or sells your data. Everything it stores lives in your browser, and the only things it ever sends anywhere are the rolls you choose to push to your own Discord channel, Roll20 game or Foundry world. This website counts how many visits arrive from where, and nothing else — the detail is at the bottom.
What Rollwarden stores
Rollwarden keeps its state — active modifiers, custom modifiers, companions, tracker values, and settings — in your browser's local storage, saved per character. If your browser is signed in with profile sync, the same data mirrors to your browser profile's extension storage so it can follow you between your own machines. That storage belongs to your browser profile; Rollwarden's developer has no access to it.
What Rollwarden reads
By default, Rollwarden reads D&D Beyond and nothing else: your character sheets, and — for the clickable-dice and send-to-table features — reference pages like monsters, spells, items, sourcebooks, vehicles, feats, classes, species, and backgrounds. It reads the page already open in your tab — on a sheet, that's your level, ability modifiers, weapon rows, and roll results — to do its job.
If you connect a virtual tabletop, it also reads that game's tab, and only that one. On Roll20 it reads which character sheet the game uses and, where you've turned those features on, the token and turn-order state it needs to keep in step with your sheet. On Foundry it reads your world's name, the game system, who you're signed in as, and the actor matching your character. It does not read your browsing history, and it does not read any other tab.
Site access, and how a Foundry game gets it
Rollwarden asks the browser for standing access to two addresses: roll20.net and discord.com, both used only for the optional roll-forwarding below, and both inert until you turn that feature on.
Foundry is the exception, and it's worth being exact about it. Foundry is self-hosted, so every table's address is different — localhost:30000, a home server, a Forge subdomain — and no fixed address can be declared in advance. So Rollwarden declares the ability to ask for any address, as an optional permission. That declaration grants nothing on its own and shows no install warning; it is only the mechanism by which one address is approved later.
When you connect a Foundry game, Rollwarden asks your browser for that one origin and nothing wider, from a real click on its own connect page. Each grant covers that one game, appears in the extension's site-access controls where you can remove it at any time, and is handed back by Settings → factory reset. You can also connect for a single session, which asks for no permission at all and stops when the tab reloads.
What Rollwarden sends, and where
- Nothing, by default. A fresh install makes no network requests to anyone but D&D Beyond's own site and services — the same ones your browser is already talking to. Some features fetch content you're entitled to from D&D Beyond directly (a monster's stat block when you import a companion, or your sheet's own Extras when you adopt one), signed in as you; that stays between your browser and D&D Beyond.
- Discord: if you add a Discord webhook in Settings, the rolls you make — and any spell card or boxed read-aloud text you explicitly click "Send to table" on — are posted to that webhook, a URL you created pointing at your own channel. Remove the webhook and the posting stops. This is the only feature that sends anything to a server that isn't D&D Beyond's.
- Roll20: if you connect a Roll20 tab, your rolls are relayed into that tab's chat, inside your own browser. Nothing leaves your machine except what Roll20 itself then does with its chat.
- Foundry: the same, for a Foundry game you've connected — your rolls, and where you've turned them on your hit points, conditions and turn order, are written into that tab, inside your own browser. Nothing is installed in Foundry, and only the player rolling on D&D Beyond needs any of this; the GM's Foundry needs nothing.
What the extension never does
- No accounts, sign-ins, or profiles.
- No analytics, telemetry, crash reporting, or tracking of any kind. Nothing about how you use Rollwarden is ever reported to anyone.
- No collection, sale, or sharing of personal data — there is nothing to sell.
- No modification of your D&D Beyond account or subscription data.
This website
Everything above is about the extension. This page you are reading is a separate thing, and it is worth being exact about the one difference.
rollwarden.app counts its visits. When a page here loads, the server records five things: which page it was, which country the request came from, whether the visit arrived from a search engine or a link on another site (and which site, by name), and a tag if the link was one we posted ourselves. That is the whole record.
What that record is not: there is no cookie, no identifier of any kind, no IP address stored, and no script placed on this page to watch what you do on it. Nothing is written to your device. The rows cannot be joined back together into a person or a session, because nothing in them links one visit to another. It is a tally of arrivals, kept so we can tell whether anyone is finding Rollwarden and how — the same question a paper visitor book answers.
The counting happens on the server, in the open: the code is worker/index.js, and you can read exactly what it records.
Data removal
Uninstalling the extension and clearing site data for dndbeyond.com removes everything Rollwarden ever stored. There is nothing to delete on any server, because there is no server.
Changes to this policy
If a future feature changes any of the above, this page will be updated and the change called out in the changelog before that feature ships.
Contact
Questions? Email support@rollwarden.app or ask on Discord.