Privacy Policy

Data controller

The controller of your data is El Dragón Cojo, a community in Mallorca (Spain) that is being set up as an association. For any question about your data, write to drac.coix@gmail.com.

What data we process

To create your account we only ask for an email, a username and a password. Since you join with an invitation from someone in the community, we record who invited you, and only that person and the admins see it. The password is stored in a way that nobody can read, admins included.

Everything else is up to you: what you add to your profile, what you post in the community, the events you join and what you tell us in them (questionnaire, plus-ones, shared ride or availability), your messages, what you write to us through the contact form or when asking for an invitation (your name, an email or a phone number and a few lines) and, if you turn them on, phone notifications. If you deactivate your account, we keep the bare minimum to give it back to you if you return.

Like any web server, ours logs the IP address and browser of every connection, only for security and to fix faults. What your own browser stores is described in the Cookie Policy.

Signing in with Google, Discord or Twitch

You can sign in with your Google, Discord or Twitch account instead of an email and password, or link them under Settings → Ways to sign in. It is optional: your account works the same without them.

When you choose one, that company asks for your permission and, if you agree, sends us only the basic details of your account there:

• Google: an identifier for your Google account, your email address and whether it is verified, your name and your profile picture. We only ask for the basic sign-in permissions (openid, email and profile).
• Discord: your account identifier, your username and display name, your avatar, your email address and whether it is verified (the identify and email permissions).
• Twitch: your account identifier, your username and display name, your profile picture and your email address (the user:read:email permission).

What we use them for: only to know it is you when you sign in and to connect that account to your community account. Your username and portrait on the site are the ones you choose here: we do not copy your name or picture from Google, Discord or Twitch to your profile, and the site only shows these details to you, under Settings → Ways to sign in.

What we do not do: we never post to your account, we do not read your contacts, emails, videos or messages, and we do not ask for access to them. We do not sell this data, share it with anyone or use it for advertising. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Where it is kept and how to remove it: it is stored with your account on Hetzner's servers in Germany. You can disconnect that way of signing in at any time under Settings → Ways to sign in, and you can also remove the site's access from your Google, Discord or Twitch account. If you also want us to delete what it sent us, write to drac.coix@gmail.com. If you deactivate your account, it is deleted along with the rest of your personal data, as "Retention" explains.

Each of these companies handles your account data under its own privacy policy.

Who sees what

This is the question people actually ask, so here is the plain answer. The community is arranged in three circles, and every piece of data lives in exactly one. When in doubt, the data does not leave its circle: we would rather ask for an account too often than show too much.

1. The shop window: anyone, with no account. Just enough to decide whether to join: the home page, the Commandments, these legal texts, the forum in read-only, the Wiki and the game catalogue. Also the listing and the page of public events with the basics: what it is, when, where and how many people are coming. The number, never the names, and not who organizes it either. Of a person, nothing shows here: not their username, portrait, level or signature, not even under what they write in the forum.
2. The community: signed-in users. Shared life: each person's username, portrait, level and signature, who is coming to each event you can see and who organizes it, the wall, each event's chat, the groups, place reviews and game ratings with their author, who follows whom, game libraries, declared availability and Market listings. This is also where the switchable parts of your profile live (bio, town, statistics, achievements, groups, game library and contacts). Switch one off and nobody sees it. Switch it on and signed-in users do.
3. Private: only you and whoever it concerns. Your private messages, your answers to an event's questionnaire, your contact details, your exact location, your attendance-withdrawal history and your list of blocked people. These leave that circle only for whoever organises YOUR event (what running it requires: the attendee list, their questionnaire answers, the announced plus-ones and the roll call) and for the admins where it already concerns them: published content, the report queue, the contact inbox and the notification log.

The switches are enforced by the server, not just by the screen. When you switch a section off under Settings → Privacy, the data stops being served: it is not merely hidden behind a button.

Never public: your email, your password (which nobody can read, admins included) and your private messages.

Why we use it and on what legal basis

• Running your account and your part in the community (forum, events, groups, messages and notifications about your activity): this is the service you ask for when you sign up, so the basis is the performance of the terms of use in the Legal Notice (Art. 6(1)(b) GDPR).
• Optional profile data, phone notifications and signing in with Google, Discord or Twitch: your consent (Art. 6(1)(a)), which you can withdraw at any time under Settings: by deleting the data or switching it off, turning notifications off or disconnecting that way of signing in.
• Answering what you send us through the contact form or when asking for an invitation: our legitimate interest in dealing with the enquiry you yourself sent (Art. 6(1)(f)).
• Security, moderation and server logs: our legitimate interest in keeping the site working, protected and in line with the community rules (Art. 6(1)(f)).

We do not use your data for advertising, we do not sell it and we do not build commercial profiles. Levels and achievements are calculated automatically, and every moderation warning is issued by a person on the team. The automatic consequences are few, and they always start from something a person decided: with three active warnings, the account is suspended for 30 days. With an active warning, the games you create wait for the admins to review them. With an active warning or a suspended account, you cannot invite anyone and your unused invitations stop working. If someone who joined with your invitation is suspended, you lose the permission to invite. If any of this happens to you, you can ask for a person to review it.

Recipients and processors

We do not sell or share your data with third parties for commercial purposes. To run the service we rely on providers acting as data processors:

• Hetzner Online GmbH (Germany): the servers that hold the website, the database, the accounts and the files. The software that manages accounts and data (Supabase) is installed on those same servers: your data does not go through the Supabase company.
• Brevo (France): sends the website's emails, such as confirming your account, recovering your password, changing your email and important notifications. It receives your email address and the text of each message.
• Cooper Hewitt (Smithsonian), Stadia Maps or OpenStreetMap: only when you view a map, they receive your IP address to serve the map images.
• Your browser's notification service (Google, Mozilla or Apple, depending on the browser): only if you turn on phone notifications. It delivers the notification, encrypted, to your device.
• YouTube, BoardGameGeek and RAWG: when a page shows the thumbnail of a shared video or a game cover, the image loads from their servers, which receive your IP address.
• Google, Discord and Twitch: only if you choose to sign in with one of those accounts. They confirm who you are and send us the basic details described in "Signing in with Google, Discord or Twitch".

Some of these services are outside the European Union, mainly in the United States. The map, video and cover providers receive only what they need to serve what your browser asks for: your IP address and the fact that you come from dragoncojo.com, not the specific page. What we store about you stays on Hetzner's servers in Germany and in encrypted backups that never leave the European Union.

Retention

We keep your data while your account is active.

If you deactivate your account from Settings, your public profile becomes anonymous ("Deactivated account") and your personal data (username, bio, portrait, town and contacts) is set aside, hidden from everyone, so you can come back with your usual email and recover the account exactly as you left it. What you wrote in the community stays, without your name.

That sleeping account waits for you for two years. When the first year is up we email you and, if you have not come back by the end of the second, we permanently delete your personal data, including your email and portrait. What you wrote stays signed as "Deactivated account", but the account can no longer be recovered.

If you would rather have everything erased for good (right to erasure), write to drac.coix@gmail.com and we will do it, except data we must keep by law.

Contact form messages, invitation requests and requests for help signing in are deleted one year after we deal with them. The IP address and browser of each sign-in are deleted after 90 days, and server logs are not kept for more than 90 days either. Backups rotate on their own: anything we delete is gone from them too within 60 days at most.

Your rights

Access and portability, with nobody's permission needed: under Settings there is a «Download my data» button that builds, right in your own browser, a copy in an open format (JSON) with your profile, everything you have written, your events, your game library, your achievements and the notifications you have received. If any section could not be read, the copy says so.

You can also exercise your rights of rectification, erasure, objection and restriction, and the two above if you would rather we handled them by hand, by writing to drac.coix@gmail.com. Anything based on your consent can be withdrawn at any time, without affecting what was done before. If you believe we have not handled your request properly, you can complain to the Spanish Data Protection Agency (aepd.es).

Minors

Registration is restricted to users aged 18 or over, which you confirm when you sign up. If we detect accounts of younger users, we will deactivate them and anonymise their personal data.

Security

We apply reasonable technical and organisational measures to protect your data: the connection is always encrypted (HTTPS), each piece of data is seen only by whoever should see it according to the three circles above and, before storing a photo, we strip its location and other hidden data (EXIF). Even so, no system is completely foolproof, so we recommend using a strong, unique password.