Privacy Policy

⚡ The Quick Summary (TL;DR)

1. Lawful Basis for Processing (GDPR Requirement)

If you are visiting from the European Economic Area (EEA), we only collect and process your personal data when we have a lawful basis to do so under Article 6 of the GDPR. This includes:

• Your Explicit Consent: When you opt-in to tracking cookies via our cookie banner or subscribe to our newsletter.
• Contractual Necessity: When we need your information to fulfil an order, run your LilRPG account, or provide another service you requested.
• Legal Obligation: When the law requires us to keep records, such as order records for tax purposes and records of your email consent under Canada's anti-spam law (CASL).
• Legitimate Interests: To secure our website, prevent fraud, and understand general user behaviour to improve lilrpg.ca.

2. Information We Collect and How We Use It

A. Automatically via Cookies & Tracking

We do not track you by default. If you grant us permission via our cookie banner, we use the following third-party services. If you accept on the same page where you first see the banner, the actions you took on that page before choosing (for example, viewing a book) are sent at that moment. Until then they are held only in your browser's memory: they are never saved to your device, and they are discarded if you decline or leave the page. Your answer to the banner (accept or decline) is saved in your browser so we don't ask again on every page.

Google Analytics: This tool records how visitors use the site (like how long you spend on it and which pages you visit), linked to a random ID stored in a cookie. This helps us see what content our users love. Google uses your IP address only to estimate your general location and does not store it.

Meta (Facebook) Pixel: This tracks actions you take on lilrpg.ca so we can measure the effectiveness of our ads on Facebook and Instagram. Meta can connect this data to your Facebook account to serve you targeted advertising.

Reddit Pixel: This tracks actions you take on lilrpg.ca, such as viewing a book, adding it to your cart, downloading a free colouring page, signing up for updates, or completing a purchase, so we can measure the effectiveness of our ads on Reddit. Reddit can connect this data to your Reddit account to serve you targeted advertising. For purchases, Reddit receives the order number, items, and total, but not your contact details.

Purchase matching: When you complete an order, we share details from that order with Meta, through the Meta Pixel and Meta's Conversions API, so Meta can tell whether the purchase came from one of our ads. These details are your email address, phone number, first and last name, city, province or state, postal code, and country. They are hashed (turned into scrambled codes) in your browser before they leave it, so your readable details are never sent. Hashing is pseudonymisation, not anonymisation: a platform that already holds the same detail (for example, the email on your Facebook account) can produce the same code and recognize the match. Meta uses these codes to match the purchase to one of its accounts; it does not receive your readable details from us. We may also share your hashed email address and phone number with Google in the same way for ad measurement. This only happens if you clicked "Accept" on our cookie banner.

B. Information You Provide Voluntarily

We collect personal information (such as your name, email address, or billing details) only when you willingly submit it—for example, when creating a LilRPG account, making a purchase, or contacting us. We will never sell, rent, or trade your personal information.

C. Your LilRPG Account

Creating an account is optional. If you create one, Netlify Identity (the service that runs sign-in on lilrpg.ca) stores your name, email address, and password. Your password is stored scrambled (hashed), so nobody at LilRPG can read it. When you choose a password, your browser checks it against Have I Been Pwned's list of passwords exposed in data breaches: only the first 5 characters of a scrambled version of it are sent, never the password itself, and nothing about you. If you choose "Continue with Google", Google tells us your name and email address and confirms who you are; we never see your Google password.

• Staying signed in: To keep you signed in, your browser stores a sign-in token on your device. It is strictly necessary for your account to work, so it doesn't wait for the cookie banner, and it is never used for tracking or ads. Signing out removes it. If you ask for a colouring page before signing in, your browser also remembers which one for up to a day, so we can offer it once you're signed in.
• Email preferences: We only send news and updates if you say yes, and you can change your answer on your account page at any time. To show we have your permission, as Canada's anti-spam law (CASL) requires, we keep a record of each choice: when you made it, the exact wording you saw, and where. If you ticked the updates box on one of our forms before creating your account with the same email, we carry that choice over. When you say yes, we add your name and email address to Ecosend, the service we use to send our news emails. When you say no, or unsubscribe from one of our emails, we tell Ecosend, and your account page shows the change. If you say no and you aren't already on our email list, we don't add you to Ecosend at all. Account emails, like confirmations and password resets, are always sent.
• Your orders: Your account page shows your paid orders from our shop. We find them in Snipcart by your account email each time you look; nothing is copied into your account. When you're signed in, we also fill your account email into checkout, so new orders show up there. If you buy the ePub or the board book (which comes with the ePub), you download the ePub from there whenever you like.
• Your control: On your account page you can download a copy of your account data or delete your account, which removes it from Netlify Identity. Deleting your account also unsubscribes your email in Ecosend, so our news emails stop. To show we honoured your choice, as Canada's anti-spam law (CASL) requires, we keep a short record of the deletion for 3 years: a scrambled (hashed) copy of your email address, the date, and that we stopped our news emails. Votes, sign-up forms, and orders are kept separately; email us to have those removed too.

D. Orders, Forms, and News Emails

These services handle the information you give us outside your account:

• Snipcart: runs our cart and checkout and keeps your order (name, email, shipping and billing address, and what you bought).
• Stripe: processes your card payment. We never see or store your full card number.
• Shipping: when we ship your books, the shipping company we use receives your name and shipping address to deliver them.
• Netlify Forms: stores what you send through our forms: Bestiary sign-ups, with your name and email (and, for sign-ups from before accounts, your answer to the updates box), and quest votes. You vote from your account, so each vote carries your account's ID and email: only your latest picks count, and we email you the results.
• Ecosend: sends our news emails to people who said yes, and records unsubscribes.

E. Children

Our books and colouring pages are for kids, but lilrpg.ca is for their grown-ups. Accounts, orders, votes, and sign-ups are meant for parents and other adults, and we don't knowingly collect personal information from children. If you think a child has sent us their information, email us and we'll delete it.

3. Data Storage, Retention, and International Transfers

LilRPG is based in Ontario, Canada. The European Commission recognizes Canada's private-sector privacy law as providing an "adequate" level of data protection. Some of the services we use are based outside Canada, so your information may be transferred to and stored in other countries:

• United States: Netlify, Google, Meta, Reddit, and Stripe.
• United Kingdom: Ecosend.
• Canada: Snipcart.

Information stored in another country is subject to that country's laws. Where the GDPR applies, we rely on the transfer safeguards these providers offer, such as Standard Contractual Clauses (SCCs) or the EU-U.S. Data Privacy Framework.

We keep your information only as long as we need it:

• Your account: until you delete it. Your email preference and its consent record are deleted with it. We keep only the short deletion record described in section 2C, for 3 years.
• Orders: as long as tax law requires us to keep business records.
• Votes and sign-up forms (including your answer to the updates box): until you ask us to remove them.
• Analytics and ad data: for the periods set in each platform's own settings and policies.

4. Your Rights (Your Data, Your Control)

Whether you are in Ontario or the EU, you have strong rights regarding your data. You can ask us to:

• Access: See exactly what personal data we hold about you.
• Correction: Fix any inaccurate or incomplete information.
• Erasure ("Right to be Forgotten"): Delete your personal data from our systems, except records the law requires us to keep, such as orders for tax purposes.
• Portability: Request a digital copy of your data to move elsewhere.
• Withdraw Consent: Revoke your permission for tracking or marketing at any time.

To exercise any of these rights, please contact our Privacy Officer at team@lilrpg.ca.

5. How to Opt-Out Right Now

• Our Cookie Banner: We use a "Prior Consent" system. No Google Analytics, Meta Pixel, or Reddit Pixel will fire until you click "Accept" on our banner.
• Google's Global Opt-Out: You can install the Google Analytics Opt-Out Browser Add-on.
• Meta Ad Preferences: Adjust how Meta targets ads to you via your Facebook Ad Settings.
• Reddit Ad Preferences: Turn off personalized ads in your Reddit privacy settings.

6. Contact and Privacy Officer

For the purposes of the GDPR and PIPEDA, the data controller is LilRPG Inc. Our Privacy Officer is responsible for how we protect your personal information. If you have any questions about this policy or wish to lodge a complaint, you can contact them at:

*If you are a Canadian resident and feel your concerns weren't addressed, you have the right to contact the Office of the Privacy Commissioner of Canada (OPC). If you are a Quebec resident, you may also contact the Commission d'accès à l'information du Québec. If you are an EU resident, you may contact your local Data Protection Authority (DPA).*