Privacy policy
Borealis is a free, open-source character builder made by the Borealis project. It has no accounts, no analytics and no ads, and what you make in it stays on your device. This page covers the Borealis app on every platform, including the App Store and Google Play versions, and this website.
In short: Borealis collects nothing about you. It goes online only for the few things listed below, most of them because you asked. On Android, the QR code scanner comes from Google and sends Google diagnostics; details below.
What Borealis keeps, and where
Everything Borealis keeps is on your device, in the app's own data folder:
- your characters, and the content packs you imported;
- your settings, including the player name you can set;
- log files that help find problems (the five most recent daily files, each capped in size);
- the search index and, if you downloaded it, the optional search model;
- for Send to device, the keys that let your own devices recognise each other, in the system's secure storage (Keychain on Apple devices, Android Keystore, Windows Credential Manager, Secret Service on Linux).
None of this is sent to the Borealis project or anyone else. It leaves the device only when you do it yourself: exporting a .borealis file, saving or sharing a character sheet or the logs, sending characters to another device, or sending an import bug report. Your device's own backup (such as iCloud or Google backup) may include your characters and settings, according to your device settings; the transfer keys, the search index and the search model are excluded from backups.
To delete everything, uninstall Borealis. On a computer, also delete its data folder (the FAQ says where it is), because uninstalling leaves it in place.
When Borealis goes online
Borealis works offline. These are all the network requests it makes.
Checking for a new version (computers and the Android download only)
On a computer, and in the Android app downloaded from this website, Borealis asks GitHub (api.github.com) for the number of the latest Borealis release, about 12 seconds after it starts and when you click Check now. The request carries the Borealis version and nothing about you or your characters; from the Android app it also carries the standard headers of the phone's built-in web view. Turn it off in View > Borealis Settings > General, Check for new versions of Borealis.
The App Store and Google Play versions never make this request: the store handles updates.
Content you add from an address
When you paste the address of an index file or a data folder and click Fetch, Import or Update, Borealis downloads the files from that address, over https:// only. Borealis comes with no addresses. An index file can list files on other sites; Borealis downloads those too and lists the new sites in its report. For a GitHub address it also asks GitHub's API which version of the files is current. These requests carry the Borealis version and nothing about you.
On a computer, Borealis also checks the index files you added for updates about 10 seconds after it starts. If you added none, nothing is requested. Turn it off in View > Application Settings > Data files, Automatic Updates. Phones only check when you tap Update.
The optional search model
Smarter search needs a model of about 210 to 310 MB. Borealis downloads it only after you press Download and turn on, from Hugging Face (huggingface.co), or from the Borealis release files on GitHub if that fails. The download sends no identifiers. Search is off until you do this.
Send to device
Moving characters between your devices happens only on your local network, while a Send or Receive window is open. The devices pair with a QR code or a short code, and the connection is encrypted. Borealis refuses any address outside your local network, and no server is involved. While the window is open, a computer announces it on the local network so the other device can find it. Devices show each other a generic name such as "Borealis on Mac", not your device's name.
The QR code scanner on Android is Google's ML Kit barcode scanning, which comes through Google Play services. Google says ML Kit collects device information (such as manufacturer, model and system version), the app's name and version, a device identifier and per-installation identifiers, performance metrics and usage events, for diagnostics and usage analytics, sends them to Google over an encrypted connection and does not share them with third parties (Google's ML Kit data disclosure). Borealis never receives any of it, and the camera images are not sent anywhere by Borealis. This applies to both Android versions. On iPhone and iPad the scanner is Apple's own camera framework.
Import bug reports (computers only, when you send one)
When the optional AI import goes wrong on a computer, you can send a bug report to this website. Borealis first shows you the exact report, and sends it only when you press Send. It holds the Borealis version, the operating system and processor type, the structure of the import with element names (descriptions removed) and your note. The text of the source and the last lines of the log are added only if you tick them. It holds no name, email address, account or characters.
Reports are kept in private storage that only the Borealis developers can read, and are used only to fix the importer. Your IP address is not stored: only a scrambled, salted hash of it, to limit how many reports one network can send. To have a report deleted, ask on Discord or GitHub (below) and say when you sent it.
Links you open
The website, changelog, release and Discord links in the Help menu open in your browser. What those sites do is covered by their own policies.
The optional AI features
- Off by default, and only on computers. The iPhone, iPad and Android versions have no AI features at all.
- Your own tool and account. When you turn the assistant on, Borealis runs the Claude Code (
claude) or Codex (codex) command-line program installed on your computer, signed in with your own account. Borealis has no AI service of its own, holds no AI keys and never sees your login. - What is sent. What you ask, and what the feature needs to answer it, goes through that program to its provider (Anthropic for Claude, OpenAI for Codex), under the provider's terms and your account settings: for example the details of the character you ask about, rules text, and the files you give the AI importer, such as a PDF or a photo of a page.
- Installing the program. If you choose to let Borealis install the program, it runs the standard npm installer, which downloads it from the npm registry. Borealis asks first.
- Sharing the assistant on your network. A computer can offer its assistant to devices you pair with it on the same local network. This is off until you turn it on in Borealis Settings.
The importers for Aurora files and 5etools-format data never use AI.
What Borealis never does
- No accounts or sign-in.
- No analytics, telemetry or crash reporting of its own, and no advertising.
- No advertising identifier, and no tracking across apps or websites.
- No selling or sharing of your data: the Borealis project does not collect any to sell or share.
The one third-party component that reports to its maker is the Android QR code scanner above. The system parts Borealis runs on, such as the web view built into your operating system, follow your system's own settings.
This website
borealisbuilder.com has no cookies, analytics, ads or trackers, and loads nothing from other sites. It is hosted by Vercel, which handles standard request data such as IP addresses to serve the pages and protect them from abuse. Downloads come from the Borealis releases on GitHub.
Children
Borealis is a character builder for tabletop games, suitable for all ages. It has no accounts and collects no personal information from anyone, children included. If a child uses Borealis, everything they make stays on their device, as described above.
Changes to this policy
If what Borealis does with data changes, this page changes first, with a new date at the top. The app's source code is public on GitHub, so anyone can check what it does.
Contact
Questions about privacy, or a request to delete a bug report: ask on the Borealis Discord or open an issue on GitHub. For a security problem, use GitHub's private vulnerability reporting on the Borealis repository. More ways to get help are on the support page.