Security Disclaimer

• DM accounts use the configured authentication provider for sign-in and session handling.
• Campaign data is synchronized through the configured backend and should be transmitted over HTTPS in production.
• Player access is scoped by campaign membership, character ownership, display mode, and join-code workflows.
• AI and generation routes are server-side so provider keys are not intentionally exposed to the browser.

No web application can guarantee perfect security. Bugs, misconfiguration, weak passwords, leaked join codes, browser extensions, compromised devices, provider outages, or incorrectly configured environment variables may expose campaign data or interrupt access.

Campaign join codes are convenience access controls, not high-security passwords. Share them only with trusted players and rotate or recreate campaigns if a code is exposed to the wrong audience.

• Use strong, unique passwords for DM accounts.
• Sign out on shared machines and protect devices used at the table.
• Only reveal player handouts, quests, observations, and maps when you intend players to see them.
• Do not paste secrets, private personal data, or confidential business information into AI prompts.

AI-generated text, images, encounters, NPCs, monsters, maps, or rules suggestions may be inaccurate, incomplete, unbalanced, or inappropriate for a specific table. The DM remains responsible for reviewing, editing, saving, revealing, or deleting generated content before it becomes part of a live campaign.

If you believe campaign data has been exposed, immediately change account credentials, remove or rotate campaign access where possible, and review visible player content.

To report a suspected security issue, or for any privacy or data request, contact privacy@sypher.solutions. If you are using a self-hosted or third-party deployment of Sypher DnD, contact that instance's operator as well.