The Eastern Tavern is a small game made for friends. This is everything it keeps about you, and why.
Without an account nothing about you is kept beyond the match you are in (the name you type, your boards, for one day), except the IP address record below.
With an account: your player name; your email address, to log in and to reset your password; a hash of your password, never the password itself; if you log in with Google or Discord, your account ID, verified email and name from them (nothing else from those accounts, never their password; see “Data from Google and Discord sign-in” below); your game statistics (matches, places, heroes, tribes, time played online) and your last matches.
Friends: your friends list and friend requests, the players you blocked, the messages you send and receive (so your friend can read them later; bad words are replaced with *** before they are stored), room invites (for 10 minutes), and when you last had the game open, so your friends see whether you are online or in a match. Only your friends see your messages and whether you are online.
Cookies: one login cookie keeps you logged in for 30 days; reCAPTCHA sets one when you do something it guards. No advertising cookies. Google Analytics runs only if you press “Accept all” in the cookie banner; every cookie is listed on the Cookies page.
Public: your player name and statistics, in the Standings. Your email is never shown to other players.
Spam protection: signing up, logging in, rooms, matchmaking and bug reports go through Google reCAPTCHA, which is loaded only when you start one of those (Google's privacy policy applies).
Analytics, only with your OK: if you press “Accept all”, Google Analytics counts visits and anonymous game events, never your name. “Only essential” keeps it off.
Bug reports you send are stored and emailed to the game's maker.
The Long Road: when a run ends, its numbers (hero, tribe, how far you got, which fights you won, the cards and relics you ended with) are sent without your name, account or address, so the road can be balanced on real play. Kept 180 days.
IP addresses, against abuse and cheating: when you log in, open or join a room, look for a match or finish one, the game keeps a scrambled code made from your IP address (a one-way hash; the address itself is never stored), the first two parts of the address (like 89.42.x.x) and the name or account it was used with. It is used only to stop banned players and cheaters from coming back, and it is deleted after 90 days.
Fair play: when other players' games see that a turn of yours does not add up, they report it; the report (room, turn, your name) and a copy of that match's moves are kept so the game's maker can check it, and may lead to a ban.
Payments (only if you buy the Early Supporter pack): Stripe handles the payment; we keep a record of it (your account, the amount, currency, country, the email Stripe gives us, the date), never your card details. The record is kept as long as accounting law requires, even after you delete your account.
Your data is never sold or shared for advertising.
Delete your account any time in your profile: everything above is deleted at once, your friendships, requests, blocks, messages, invites and IP records included.
1. Who looks after your data
The Eastern Tavern (easterntavern.com) is run by VELDESIGN WEB SOLUTIONS SRL (tax code (CUI) 37938405, Trade Register no. J2017011980407 (EUID ROONRC.J2017011980407); registered office Str. Mircea Vulcănescu nr. 94, Corp C, Ap. 1, Sector 1, 010825 Bucharest, Romania), which is the controller of the personal data described here under the EU General Data Protection Regulation (GDPR). Contact: info@easterntavern.com, or "Report a bug" (bottom left of every page) with your email address.
2. What we collect
Account data (only if you make an account): player name, email address, a one-way hash of your password (Argon2id; we can never see the password), the Google or Discord account number if you sign in with them, your avatar choice, the date the account was made, when you changed your name, your badges, and whether you are an administrator.
Game data: the rooms you open or join, the name you play under, your seat, every turn you submit (the list of your actions, needed so every player's game can check it), match results, places, heroes, tribes and time played online. Guests' match data is kept only while the room exists.
Social data (accounts only): friends, friend requests and their note ("from a match you played together"), blocks, chat messages between friends, room invites, and when you last had the game open.
The Long Road: when a run ends, its numbers (hero, tribe, Heat, how far you got, fights won and lost, the cards and relics you ended with, how long it took) are sent with no name, account or address. A flag marks the administrator's own runs.
Technical data: a one-way hash of your IP address plus its first two parts (like 89.42.x.x), stored with the name or account it was used with; browser errors the page sends us (the error, the page state, the browser name; never your name); bug reports and whatever you write in them.
Fair-play data: if other players' games report that a turn of yours does not add up, the report and a copy of that match's moves.
Payment data (only if you buy the Early Supporter pack): the account it was for, the amount and currency, the country and email address Stripe gives us, the Stripe payment reference, the date, and whether it was refunded. Your card details go to Stripe only; we never see them.
We do not collect your real name, address, phone number, card details, precise location or contacts, and we never read anything from your Google or Discord account beyond the account number and a verified email address.
3. Data from Google and Discord sign-in
“Continue with Google” and “Continue with Discord” are optional; you can always use an email and password instead.
What we receive from Google (scopes openid email profile): your Google account ID, your email address and whether Google has verified it, and your first or display name. We do not read your profile picture, contacts, files, calendar or any other Google data, and we never see your Google password.
What we receive from Discord (scopes identify email): your Discord user ID, your email address and whether Discord has verified it, and your Discord display name.
How we use it: only to sign you in and keep you signed in, to recognise you the next time, to join your Google or Discord login to an existing account with the same verified email, and to suggest a player name the first time (you choose your own). Nothing else: no advertising, no profiling, no selling, no training of AI models.
What we store: the account ID (to recognise you) and the verified email address, in your account. The name is only a suggestion and is stored only if you keep it as your player name.
Who we share it with: nobody. It stays in our database at our web host, which stores it for us and may not use it for anything else. It is never shown to other players.
How we protect it: HTTPS for every request, a Google sign-in flow protected by a one-time state code and PKCE, a password-protected database used only by our own server, login cookies that hold only a random code, and daily backups kept outside the public site for 14 days.
How long, and how to delete it: for as long as you keep your account. You can unlink Google or Discord in your profile, or delete your account in your profile at any time, which deletes this data at once (backups age out within 14 days). You can also remove The Eastern Tavern’s access in your Google account at myaccount.google.com/permissions.
The Eastern Tavern’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.
4. Why, and on what legal basis
To run the game and your account (contract, GDPR Art. 6(1)(b)): logging in, matches, standings, friends, chat, invites, password resets.
To sell and deliver the Early Supporter pack (contract, Art. 6(1)(b)) and to keep its payment records (legal obligation, Art. 6(1)(c)).
To keep the game fair and safe (legitimate interest, Art. 6(1)(f)): IP hashes, cheat reports, bans, rate limits, spam protection, and the backups that let us repair the game after a fault.
To fix bugs and balance the game (legitimate interest): browser errors, bug reports and the anonymous Long Road numbers.
Because the law requires it (Art. 6(1)(c)), if an authority asks us lawfully.
We do not use your data for advertising, profiling or automated decisions with legal effect. Bans for cheating are decided by a person, looking at the evidence.
5. Who else handles it
Our web host stores the site, the database and the daily backups on its servers.
Google reCAPTCHA checks that sign-ups, logins, rooms, matchmaking and bug reports come from a person. It is loaded only when you start one of these (not while you browse or play alone), and Google then receives data about your browser and how you use the page (Google's privacy policy).
Google and Discord, only if you choose "Continue with Google" or "Continue with Discord": you log in on their site and they tell us your account number and email address.
Our email provider sends confirmation, password and report emails.
Stripe (Stripe Payments Europe, Ltd.), only if you buy the Early Supporter pack: you pay on Stripe's own page, so Stripe receives your card details, email and country and handles them as an independent controller under its privacy policy, including fraud checks; it tells us that you paid.
Google Analytics, only if you press “Accept all”: the pages you open, anonymous game events (a run started or ended, a room opened, the tutorial finished), your country and kind of device; never your player name; Google Analytics 4 does not store IP addresses; its cookies last up to 2 years (legal basis: your consent, GDPR Art. 6(1)(a); withdraw it any time with Cookie settings).
Nobody else. We never sell, rent or trade your data. Some of these services may process data outside the EU; they do so under the safeguards the GDPR requires (such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework).
6. How long we keep it
Account, statistics, match history, friends and messages: until you delete your account.
Rooms, seats and their turns: removed about a day after the room is last used.
IP hashes: 90 days after they were last seen. Login sessions: 30 days. Email links: 30 minutes for a password reset, until used for a confirmation. Room invites: 10 minutes.
Long Road numbers: 180 days. Browser errors: 30 days. Bug reports: until handled (their IP part is removed after 90 days).
Cheat reports and match evidence, and bans: as long as needed to handle the case and keep a banned player out.
Payment records: as long as Romanian tax and accounting law requires (up to 10 years), even after you delete your account.
Daily backups: 14 days, then overwritten.
7. Cookies and storage in your browser
One cookie keeps you logged in (it holds a random code, not your data; 30 days), and a short-lived one protects the Google / Discord login. There are no advertising cookies. Google reCAPTCHA is strictly necessary to keep the site safe from bots and sets a cookie only when you do something it guards. Google Analytics is optional: it loads only after you press “Accept all” in the cookie banner, and “Only essential” (or Cookie settings, or Settings → Privacy) turns it off and deletes its cookies. Every cookie and what your browser stores is listed on the Cookies page. The game’s fonts are served from our own site. The game also keeps things in your browser's own storage, which never leaves your device unless a feature above says so: your settings and volumes, your Long Road run and history, the Ledger, card backs, tutorial progress, and a token for the room you are in. Clearing your browser data removes them.
8. Your rights
Under the GDPR you can ask to see the data we hold about you, correct it, delete it, limit or object to how we use it, and get it in a portable form. You can delete your account yourself, at once, in your profile. For anything else write to info@easterntavern.com; we answer within one month. You can also complain to the Romanian data protection authority, ANSPDCP (dataprotection.ro), or to the authority where you live.
9. Children
The game is not meant for children under 13. If you are under 16, ask a parent or guardian before you make an account. If you believe a child has given us data without permission, write to us and we will delete it.
10. Security
Passwords are hashed with Argon2id, the login cookie is HttpOnly and Secure, every account action needs HTTPS and the same site, sign-ins are rate-limited, email links work once, and IP addresses are stored only as hashes. No system is perfect: if we ever learn of a breach that puts you at risk, we will tell you and the authority as the law requires.
11. Changes
When the game changes what it keeps, this page changes too, and the date below with it. Big changes will be shown in the game.