D&D Beyond

"Precise location data can be Global Navigation Satellite System (GNSS) data (e.g., GPS), as well as data identifying nearby cell towers and Wi-Fi hotspots. We collect precise location data when you enable location-based products or features. Location-Identifying Technologies. GPS, WiFi, Bluetooth, and other location-aware technologies may be used to determine your device's location, sometimes precisely. Location data may be used for purposes such as verifying your device's location and delivering or restricting relevant content and advertising based on that location."

Wizards collects precise location data through GPS, cell towers, WiFi hotspots, and Bluetooth, and uses it not only for core features but also for delivering targeted advertising based on location.

"Device, Connectivity, and Configuration Data. We collect data about the type of device or browser you use, your device's operating software, your regional and language settings, and other similar information. This also includes IP address, MAC address, mobile Ad Ids (e.g., IDFA or AAID), and other device identifiers. Contacts. We collect data about your contacts if you choose to match with your contacts on the Service or invite your contacts to join the Service. Voice Processing Technologies. Voice processing technologies collect audio through the microphone on your device to effectuate an instruction or request by you."

Wizards collects MAC addresses, advertising IDs, device identifiers, user contacts, camera video, and microphone audio — a broad range of device data beyond what's needed for a tabletop gaming company's core services.

"Some of these Tracking Technologies may track your activities across time and services for purposes of associating the different devices you use and delivering relevant ads and/or other content to you on the Service and other services after you have left the Service ('Interest-based Advertising'). We also use audience matching services to reach people (or people with similar activity patterns to those people) who have visited our Service or are identified in one or more of our databases ('Matched Ads')."

Wizards explicitly tracks users across different services and devices over time for interest-based advertising, and uses audience matching to target users on third-party platforms after they leave the Service.

"Affiliates. Wizards discloses information to its related entities including its parent and sister companies. For example, we may disclose your information to our affiliates for customer support, marketing, or technical operations. Such information includes: Contact Data, Credentials, Payment Data, and Profile Data. Our apps include app-specific technologies, such as SDKs and APIs provided by third parties. An SDK is code embedded in an app that sends information about your use to a server."

Wizards shares extensive personal data (including credentials and payment data) with parent/sister companies and partners, and embeds third-party SDKs in its apps that collect data directly from user devices.

"We reserve the right to change this Privacy Policy at any time. Any changes will be effective immediately upon posting of the revised Privacy Policy. Please visit this page from time to time to check for changes. Your continued use of our Service indicates your consent to the Privacy Policy then posted."

Wizards can modify its privacy policy at any time with changes taking effect immediately upon posting, and treats continued use as consent to the new terms — placing the burden on users to monitor for changes.

"Wizards retains the information we collect only as long as necessary to fulfill the business and commercial purposes for which it was collected, as identified in this Privacy Policy. Please note that we store information as necessary to fulfil the purposes for which it was collected and may continue to retain and use the information even after a data subject request for purposes of our legitimate interests, including as necessary to comply with our legal obligations, resolve disputes, prevent fraud, and enforce our agreements."

Wizards provides no specific retention timelines and explicitly states it may continue retaining and using personal data even after a user submits a deletion request, citing broad 'legitimate interests.'

"You also have a right to request that we delete your personal information (subject to certain exceptions). We may require specific information from you to verify your identity before processing your request, and we may send you a confirmation email that you must respond to before we process the request. If we are unable to verify your identity, we may deny your request. We may continue to retain and use the information even after a data subject request for purposes of our legitimate interests."

Deletion rights are hedged with broad exceptions, identity verification hurdles, and Wizards explicitly reserves the right to retain data even after a deletion request — undermining the effectiveness of the deletion right.