Privacy Policy

1. Information We Collect

We collect the following categories of personal information:

• Account information: email address, name, username, password (hashed), and profile picture via Google or Discord OAuth.
• Age verification: date of birth to enforce minimum age requirements and apply minor safety protections.
• Location data: city, province/state, and country to recommend nearby events and gaming venues. You control location sharing in your profile settings.
• Profile content: bio, avatar, banner image, and other profile details you choose to share.
• Usage data: posts, messages, games and events you book or join, attendance and check-ins, purchases and refunds, feedback you leave for a GM (written text and topic tags), follows, community memberships, campaign activity, and other platform interactions.
• Sign-in and security events: successful and failed sign-ins, used to keep your account safe (kept for 90 days).
• Payment data: processed by Stripe — we do not store credit card numbers. We retain transaction records (amount, date, subscription status).
• Parental consent: for users under 18, we collect parental/guardian consent details.

2. Lawful Basis for Processing (GDPR)

We process your data on the following legal bases:

• Contract performance: to provide the Adventure Foundry platform and services you signed up for.
• Consent: for optional features such as location-based recommendations, marketing emails, and cookie preferences. You may withdraw consent at any time.
• Legitimate interests: to maintain platform security, prevent fraud, improve our services (including studying overall trends in how the site is used, which you can opt out of — see section 3.1), and enforce our Terms of Service.
• Legal obligation: to comply with applicable laws (e.g., age verification, tax records for payments).

3. How We Use Information

Your information is used to:

• Provide, maintain, and improve the platform.
• Authenticate your identity and keep your session secure.
• Enforce safety protections, especially for minor accounts.
• Recommend events, campaigns, and gaming venues near you.
• Process payments and manage subscriptions.
• Send transactional emails (account confirmations, payment receipts, session reminders).
• Communicate platform updates and changes to our terms.
• Understand, in aggregate, how the site is used so we can improve it (see below).

3.1 Improving Adventure Foundry

To find what makes games and the site better for everyone, we study totals and trends in how people use Adventure Foundry. For example: how many new players come back for a second game, where people drop off during sign-up, how often games are cancelled, and which game systems sell out.

• What we look at: the games and events you book, join and attend; purchases and refunds; sign-ins; follows and community memberships; whether and when you sent messages (never what they say); and the topic tags on feedback (the written text is private between you and the GM and isn't used in these reports).
• What our team sees: these site-improvement reports show counts, percentages and trends, not individual profiles or names, and comparisons that would rest on too few players are hidden or flagged. Staff can still see account activity when running and supporting the site (for example, to help you with a booking or keep the platform safe).
• Who is never included: accounts of people under 18, and anyone who opts out.
• Opting out: turn on "Don't include my activity in site-improvement analysis" in Profile Settings → Privacy. It never changes how the site works for you. Financial totals (revenue, fees, payouts and refunds) still include every transaction, because we must keep accurate financial records.
• What it's not used for: advertising, selling, or sharing with anyone outside Adventure Foundry.

We never sell your personal information. We only use it to run and improve Adventure Foundry.

4. Cookies & Tracking Technologies

We use essential cookies only — no advertising or cross-site tracking cookies. Essential cookies are required to keep you signed in and protect against security threats.

We also use Vercel Web Analytics and Vercel Speed Insights to count page views and measure how fast pages load. They don't use cookies and don't track you across other websites; see section 5. If you choose "Decline Non-Essential" on our cookie banner, your browser stops sending these measurements.

We also use localStorage and sessionStorage in your browser for caching preferences and feed data. These are never sent to third-party servers.

For full details, including a table of every cookie and storage item we use, please see our Cookie Policy.

5. Third-Party Services

We integrate with the following third-party services, each of which has its own privacy policy:

• Google OAuth: for sign-in authentication. Google receives your email and basic profile info during the login flow.
• Discord OAuth: for sign-in authentication. Discord receives similar identity information during login.
• Stripe: for payment processing. Stripe receives the payment details you provide at checkout.
• Cloudinary: for image and media hosting. Uploaded images are stored on Cloudinary's servers.
• Pusher: for real-time messaging via WebSocket connections. Message content is transmitted through Pusher's infrastructure.
• OpenStreetMap / Leaflet: for map display. Map tiles are loaded from OpenStreetMap servers, which may log your IP address.
• Geocoding (Nominatim, Photon, Mapbox): for converting addresses and city names to map coordinates. Queries are sent from our servers — your browser does not contact these services directly, and only the address or city text you enter is shared, never your identity.
• Vercel Web Analytics & Speed Insights: to count page views and measure page speed. For each page view they record the page address, referring site, approximate location (country/region/city), device type, operating system, browser, and page-speed timings. They use no cookies; Vercel tells visitors apart with a short-lived hash of the request that is discarded after 24 hours, and the data is used for totals only. Before anything is sent, we remove usernames, invite links and query strings from page addresses, and nothing is sent if you decline non-essential cookies.
• Approximate location: when you browse nearby venues and events, your approximate city-level location is derived from your connection by our hosting provider (Vercel) and, only if you grant permission, from your device's precise location. We do not send your location or IP address to third-party IP-lookup services.

We do not use Google Analytics, Facebook Pixel, advertising networks, or any cross-site tracking. Vercel's cookieless analytics, above, is our only in-browser measurement.

6. Sharing

We never sell, rent, or trade your personal information. We only use it to run and improve Adventure Foundry. We share limited information with the service providers listed above solely to operate the platform, and we may disclose information if required by law, court order, or to protect the safety of our users.

7. Data Retention

• Account data: retained until you delete your account.
• Payment records: retained for 7 years for tax and legal compliance.
• Deleted accounts: when you delete your account, your profile is hidden straight away. By the end of a 30-day grace period, your personal details (name, email, username, phone, birth date, medical and emergency-contact information, photos and connected sign-ins) are erased from your account, and your posts, messages, audit-log entries and feedback are unlinked from you. Feedback you wrote for a GM stays in their feedback history but no longer points to you.
• Financial records: payments, refunds, and the bookings and event registrations they relate to are kept for tax and legal reasons, and may still include the email address used for the purchase.
• Deletion requests: a record that your deletion was requested and completed, including the email address involved, is kept for 3 years so we can show we honoured it.
• Sign-in and security events: kept for 90 days. Security audit logs are kept for 1 year.
• Email logs: transactional email metadata is retained for up to 12 months.

8. International Data Transfers

Adventure Foundry is operated from Canada. Your data may be processed in other countries through our cloud infrastructure providers (e.g., Vercel, MongoDB Atlas, Cloudinary). Where data is transferred outside Canada or the European Economic Area, we rely on standard contractual clauses or equivalent safeguards to protect your data.

9. Children & Minors

You must be at least 13 years old to use Adventure Foundry. Users under 18 are classified as minors and are subject to additional protections:

• Parental/guardian consent is required at registration.
• Direct messaging is disabled for minor accounts.
• Per-session parental approval may be required for certain activities.
• Minor profiles are set to private by default.
• Minor accounts are never included in our site-improvement analysis (section 3.1).

10. Data Security

We implement technical and organizational measures to protect your data, including encrypted connections (HTTPS/TLS), hashed passwords (bcrypt), CSRF protection, security headers, and access controls. However, no system is 100% secure and we cannot guarantee absolute security.

11. Your Rights

Depending on your location, you may have the following rights:

GDPR (European Economic Area)

• Access: request a copy of your personal data.
• Rectification: correct inaccurate or incomplete data.
• Erasure: request deletion of your data ("right to be forgotten").
• Restriction: request that we limit how we process your data.
• Portability: receive your data in a structured, machine-readable format.
• Object: object to processing based on legitimate interests.
• Withdraw consent: where processing is based on consent, withdraw it at any time without affecting prior processing.

CCPA / CPRA (California)

• Right to know: what personal information we collect, use, and share.
• Right to delete: request deletion of your personal information.
• Right to opt-out: we do not sell or share personal information for cross-context behavioral advertising.
• Non-discrimination: we will not discriminate against you for exercising your rights.

PIPEDA (Canada)

• Access: request access to your personal information held by us.
• Correction: request correction of inaccurate information.
• Withdrawal of consent: withdraw consent for non-essential data processing.

To exercise any of these rights, you can use the self-service options in your Profile Settings (including account deletion), or contact us at the email below.

12. Your Choices

• Update your profile, location, and privacy settings from your account.
• Delete your account via Profile Settings.
• Manage cookie preferences via the cookie consent banner or your browser settings. Declining non-essential cookies also stops Vercel's page-view and speed measurements.
• Opt out of site-improvement analysis in Profile Settings → Privacy.
• Unsubscribe from emails using the link in any email footer, or visit the Unsubscribe page.
• Adjust location sharing and recommendation preferences in your settings.

13. Changes to This Policy

We may update this Privacy Policy to reflect changes in our practices or legal requirements. Material changes will be communicated via email or a prominent notice on the platform. The "Last updated" date above indicates the most recent revision.

14. Contact

For privacy requests, questions, or complaints, contact us at: adventurefoundryonline@gmail.com.

If you are in the EU and are unsatisfied with our response, you have the right to lodge a complaint with your local data protection authority.