Privacy notice
What this site keeps
Tavern Party is a game you can play without an account, and the short version is that it keeps as little as it can get away with. The long version is below, written against the actual code rather than from a template, so it names real cookies and real database tables.
The data controller is Adam Mackay, an individual operating this site from the United Kingdom. That is the person who decides what is collected here and the person legally answerable for it, and it is the same person who reads the contact form. There is no company, no data protection officer and nobody else with access. Anything you want to ask about your data goes through that form.
This notice covers www.tavernparty.com. It is operated from the United Kingdom, English law applies to it, and the UK GDPR is the law it is written against.
Cookies
| Cookie | What it is for | How long |
|---|---|---|
| tp_guest | Your guest identity. It holds a random id and a signature, nothing else: no name, no email, no game history. It is httpOnly, so JavaScript on the page cannot read it, and it is signed so that nobody can edit it into somebody else's identity. Without it the server cannot tell which player at a table is you. | One year, or until you clear it |
| Supabase auth cookies | Only if you create an account and sign in. They hold the session, and they are set by Supabase, who host the login for us. | Until you sign out or the session expires |
| Google advertising cookies | Set by Google, not by us, when an advert is served on the page. Google uses them to limit how often you see the same advert and to measure whether one worked. We never see them and we cannot read them. | Set and controlled by Google |
| PostHog analytics cookie | Counts page views and a small number of named events, like a run being started or a daily being finished, so I can see which parts of the game people actually use. No autocapture, so it is not recording what you click or type. Hosted in the EU. | Set and controlled by PostHog |
There is no consent banner on this site yet, and it should have one. The guest cookie is genuinely necessary, in the sense the law means: without it the server cannot tell which player at a table is you, so it is set with no consent asked and none needed. The advertising and analytics cookies are a different matter. Those are not strictly necessary, the obligation to ask you about them is mine rather than Google's, and at the moment they are set without being asked about. That is a gap, it is being closed with a proper consent tool, and this page will say so plainly when it is done.
Until then, here is what you can do about it today. Any browser will let you block third party cookies outright, and any of the usual content blockers will stop both the advertising and the analytics ones before they are set. Google's own controls at My Ad Center switch off personalised advertising across everywhere Google serves it, this site included. None of that stops the game working: the whole thing plays with no advertising and no analytics at all, and it plays the same.
Storage in your own browser
The daily puzzles keep your progress in localStorage, which never leaves your machine and is not sent to us. That is what lets a guest keep a streak and reload a half finished puzzle without losing it.
- tp_daily_done which days you have completed, and the score for each.
- tp_daily_progress one entry per puzzle per date, holding the in flight state so a refresh does not restart it. Old entries are pruned automatically.
- tp_name the name you last used, so you are not asked for it every time.
Clearing your browser storage deletes all of it, including your streaks. There is no copy on the server unless you have an account.
What is stored on the server
- Live tables. While a game is running, the state of that table is stored: the code, the name you typed, your guest id, and the dice. It is deleted once the table has been idle for a while, and nothing about a finished run is kept for a guest.
- Accounts, if you make one. An email address and a password, both held by Supabase who provide the login, plus a username you choose. If you have an account, finished runs and daily scores are recorded against it so you have a history. Guests write none of this.
- Rate limiting. A short lived counter keyed on your IP address, so one person cannot open a thousand tables. It is a count and a timestamp, it is not linked to your identity or your games, and it is deleted after a day.
- Contact messages. If you use the contact form, what you typed is stored so it can be read and answered, along with the date. The name and email address on that form are both optional. Those messages are not readable from any browser and are not used for anything else.
Advertising, and third parties
Adverts pay for the hosting. They are served by Google AdSense, which means Google receives your IP address and the page you are on, and may use its own cookies to personalise and measure what it shows you. That is Google acting as its own controller, under its own policies, and you can review and change what it does at Google My Ad Center and read the detail in how Google uses information from sites that use its services. Adverts are never rendered during a live encounter or a daily puzzle in progress.
The other third parties are Vercel, who host the site and keep short lived request logs; Supabase, who hold the database and the accounts; and PostHog, who count the page views. Google Fonts files are served from this site rather than fetched from Google, so loading a page does not tell Google that you did.
Nothing is sold. No data is passed to anybody for their own marketing. There is no advertising or tracking pixel here beyond the two named above.
Your rights
Under the UK GDPR you can ask for a copy of what is held about you, ask for it to be corrected, or ask for it to be deleted. For a guest there is realistically nothing to send you, because a guest cookie is a random string and nothing is attached to it once the table is gone. For an account, ask through the contact form and it will be dealt with. Deleting an account deletes the profile, the run history and the daily results with it.
The lawful basis for the guest cookie and the live table state is legitimate interests, specifically being able to run a multiplayer game at all. For an account it is performance of a contract. For the advertising and analytics cookies the basis is consent, and as set out above that consent is not currently being collected properly, which is a defect being fixed rather than a position being defended.
If you think this has been handled badly you can complain to the Information Commissioner's Office at ico.org.uk.
Children
This is a game about a bad night in a tavern, and it is meant for a general audience. Accounts are not intended for under 13s. If you believe a child has created one, say so and it will be removed.