Privacy Policy

1. Who we are and what this covers

Idle Handz LLC (“Idle Handz,” “we,” or “us”), based in Simi Valley, California, United States, operates aurora.idlehandz.com and develops Aurora: Reflections. Contact us at idlehandzonline@gmail.com for privacy questions or requests.

This policy covers this informational website, our handling of support communications, and the official Reflections desktop and Android application, including its Google Drive integration. Feature availability varies by build and platform. It does not describe a future hosted Aurora Web service, which is not currently available, or every practice of the separately linked Legacy, Constellations, and Transpositions tools. Check the notices and documentation of the tool you use.

2. When you visit this website

The website serves public information, images, and links. It does not offer visitor accounts, accept character uploads, or contain contact forms. Its code does not set cookies, use browser local storage, load advertising or analytics scripts, or embed social-media widgets. Website artwork and styles are served from this domain.

Our hosting and content-delivery provider, Hostinger, necessarily receives network and request information to deliver and protect the site. Its server logs and traffic statistics can include your IP address, requested URL, request time, browser or device information, response status, and referring page when your browser supplies it. These records support site operation, performance monitoring, troubleshooting, and abuse prevention; visiting the site is not anonymous to the hosting infrastructure.

Hosting records are retained under the applicable hosting service’s logging and retention arrangements. We do not promise a fixed deletion period for records held by Hostinger. See Hostinger’s Privacy Policy and contact us about records associated with this site.

This static website does not change its behavior in response to a browser’s Do Not Track signal. We do not implement cross-site advertising tracking on it.

3. Information Reflections uses on your device

Reflections reads and writes the character files, session information, portraits, notes, imported files, and content libraries you choose to use. These may contain personal information if you put it in a character name, player field, note, portrait, or other content. The app also stores preferences and local content databases needed for its interface and character-building features.

The app keeps local diagnostic messages and a persistent diagnostic log for troubleshooting. Logs may include error details, file paths, content identifiers, and information about the operation being performed. Review and remove private information before sending logs or character files to anyone. The Drive save feature does not automatically send these diagnostic logs to Idle Handz.

Some features contact other services: update checks and downloads contact GitHub, content updates contact the sources you configure, and importing a D&D Beyond JSON file may download a portrait from the URL in that file. Those providers receive the network request and associated connection information. This is separate from uploading a character to Drive. Imported documents are processed locally by the import feature.

4. Optional Google Drive cloud saves

You choose whether to connect your own Google account. A Google connection is not required to use Reflections’ local character files. Authorization takes place through Google in the system browser on desktop or Google Play services on Android; you do not give Idle Handz your Google password.

Permission and account information

Reflections requests the Google Drive permission https://www.googleapis.com/auth/drive.file. It permits access to files the app creates or that you explicitly authorize for the app; it does not grant general access to everything in your Drive. Reflections retrieves the connected account’s Drive identifier, email address, and available display name to identify the account, display the connection, and keep saves associated with the correct account.

File data and purpose

For accessible character files, the app reads file contents and metadata such as the file name, identifier, size, modification time, version, checksum, and edit/download permissions. It uses these to list and open your saves, verify transfers, and detect conflicting changes.

When you choose an upload or save action, Reflections sends character XML and included session data—such as HP, spell slots, resources, and other saved session fields—directly from your device to Google Drive over HTTPS. Character notes and embedded portraits are included when they are part of the saved file. Opening or reloading a cloud character downloads it directly from Drive. This feature does not route those saves through an Idle Handz storage backend.

Cloud saves require an explicit save action. Local editor autosaves can update a working copy without uploading it. This is not continuous background synchronization; check the save status and reload to retrieve changes made on another device.

5. Storage, security, and retention

• Google Drive: Uploaded characters remain in your Google account until you delete them or Google applies its own account, storage, or retention rules. Google hosts and processes these files under its terms and Google’s Privacy Policy.
• Local files: Reflections keeps working copies, session sidecar files, save metadata, and recovery copies on your device. Recovery copies are not automatically pruned. Character files, local logs, and recovery files can remain until you remove them; removing a cloud connection does not remove them.
• Connection credentials: Desktop refresh tokens use the platform’s MAUI SecureStorage. Android obtains access tokens through Google Play services and keeps its verified account binding in SecureStorage. Credentials or bindings remain until disconnected, removed, or made unusable by the platform or Google.

Local character and recovery files are ordinary files, not an additional app-encrypted vault. Protect your device, storage, and backups. Secure credential storage and HTTPS help protect the connection, but no system guarantees complete security or uninterrupted availability.

The desktop OAuth client configuration identifies the application. It is separate from a user’s Google account credentials and is not a copy of the user’s password or refresh token.

6. Google data use and sharing

Aurora: Reflections’ use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

We use Google account and file information to provide the cloud-save features described here. We do not sell this information or use it for advertising, credit or lending decisions, or training artificial-intelligence or machine-learning models. The Drive integration does not send it to an AI service or advertising provider.

We do not receive a general copy of your Drive for staff to browse. Human access to Google-derived data, such as a file you provide for support, is limited to your affirmative permission for that specific data, necessary security investigation, or legal requirements. Any transfer of Google-derived data is limited to providing the requested feature with your consent, necessary security purposes, legal obligations, or a business transfer with your prior explicit consent, consistent with Google’s Limited Use restrictions.

7. Disconnecting, deleting, and managing your data

1. Disconnect this installation: Close open cloud characters, then use Disconnect in Cloud Saves. This removes the connection credentials or account binding for that installation. It does not delete Drive files, local files, or recovery files, and does not disconnect other devices.
2. Revoke Google access: Manage Aurora’s access in your Google Account connections. Revoking access prevents further authorized Drive access until you reconnect; it does not itself erase saved files.
3. Delete cloud copies: Delete the relevant files in Google Drive and manage Drive’s trash and any retained copies under Google’s rules. Existing sharing settings on your Drive files are controlled through Google Drive.
4. Delete device copies: Separately remove local characters, session files, managed cloud working copies, recovery files, and any backups you no longer want. The Recovery Files control can help locate recovery copies on supported desktop builds. Contact us for platform-specific assistance.

Uninstalling or disconnecting is not a reliable way to remove every copy from other devices, exported folders, backups, or Google Drive. Idle Handz cannot remotely erase files stored only on your device or in your Google account.

8. Support, outside services, and donations

If you contact us, we receive the information you send, such as your email address, message, and attachments. We use it to respond, investigate the issue, and keep necessary support records. Our public contact mailbox uses Google’s Gmail service. We retain support correspondence only as reasonably needed for those purposes and applicable legal obligations; you can request deletion at idlehandzonline@gmail.com.

GitHub issues and community Discord messages may be visible to others. Use email for private requests, and do not post credentials or private character files publicly. If a request requires us to inspect a Google-derived file, provide only the specific material you authorize us to review.

Links to GitHub, Discord, Patreon, Ko-fi, the main IdleHandz site, and other tools take you to separate services with their own policies. Optional donations are processed by the chosen platform, which may share supporter information with us according to your settings and its rules. This website does not collect payment-card details. Reflections currently has no paid features or paid cloud-save tier.

Our providers may process information in countries other than your own. Their applicable terms and privacy notices describe their processing and safeguards. This policy does not replace those notices.

9. Age audience and privacy requests

The website and Reflections are intended for people aged 13 and older. We do not knowingly collect personal information from children under 13. If you believe a child has sent us personal information, contact us so we can investigate and remove information within our control where required. Google’s account eligibility rules also apply when connecting Drive.

Depending on where you live and the law that applies, you may have rights to access, correct, delete, or obtain a copy of personal information we hold, object to or restrict certain uses, withdraw consent, or complain to a privacy authority. Contact idlehandzonline@gmail.com with your request. We may need proportionate information to verify it; do not send a password or access token. Requests involving your device or Google Drive may require the controls described above.

10. Changes and contact

We will update this policy and its effective date when our practices change. Material changes will be identified through the website or application as appropriate. Before using Google data for a new purpose, we will provide the required notice and obtain any required consent.

Privacy contact: Idle Handz LLC, Simi Valley, California, United States. Email idlehandzonline@gmail.com. See also our Terms of Service.