Privacy Policy

The privacy of your data — and it is your data, not ours — is something we take seriously. In this policy, we lay out what data we collect and why, how it is handled, and your rights with respect to it. We never sell your data: never have, never will.

This policy applies to Tableverse (the “Service”), operated by tableverse.gg (“we”, “us”, “our”). It covers our handling of information about visitors, registered users, and paying members.

What we collect and why

Our guiding principle is to collect only what we need.

Identity and access

When you sign up for Tableverse, we ask for identifying information so you can create an account. Depending on how you sign up, this may include:

• Your email address (required for all accounts)
• A username
• An avatar (optional)
• Your email address as shared by your sign-in provider when you sign in with Google or Discord. We only read and store the email address from these providers, not your name or avatar.

We use this information to create and personalize your account, sign you in, and contact you about service-related matters such as security alerts and account changes. We will never sell your personal information to third parties, and we will not use your name in marketing without your permission.

Billing information

If you subscribe to a paid Tableverse plan, you will be asked for payment information. Credit card data is submitted directly to our third-party payment processor and never touches Tableverse servers. We store a record of each transaction (including the last four digits of the card and your billing address) for invoicing, fraud prevention, and tax compliance.

Product content

We store the content you create in Tableverse on our servers so you can use the Service as intended. This includes lobbies you create or join, in-game chat messages, profile content you set, and any other content you submit. We retain this content for as long as your account is active.

IP address and access logs

We log your IP address when you sign up and each time you sign in. We use this to mitigate spammy signups, detect abuse, and investigate security incidents. Login data is retained for as long as your account is active.

Cookies

We use cookies to keep you signed in across page loads, store certain preferences, and protect against cross-site request forgery. These cookies are first-party and set on the .tableverse.gg domain so that you stay signed in across our subdomains.

You can adjust cookie settings in your browser, but the Service will not function correctly if you disable them.

Analytics

We use Umami, a privacy-focused analytics service, to understand how visitors use Tableverse in aggregate (page views, referrers, country, browser and device type). Umami does not use cookies, does not collect personal information, and does not track visitors across sites or devices. Visitor sessions are identified by a daily-rotating hash that cannot be linked back to you, and the underlying IP address is discarded after the hash is generated. We use this information to improve the Service and prioritize what to build next.

Voluntary correspondence

When you contact us with a question, support request, or report, we keep that correspondence (including your email address) so that we have a history of past interactions to reference if you reach out again.

Content moderation

To keep Tableverse safe for everyone, we run automated checks on user-generated text and images:

• Text submitted to lobbies, profiles, and chat may be checked against profanity and abuse filters.
• Images you upload (such as avatars) may be analyzed by Amazon Rekognition for unsafe content and compared against a hash blocklist of previously banned material.

These checks are automated. Human moderators may review flagged content as part of investigating reports or enforcing our community rules.

When we access or disclose your information

To provide the Service. We use third-party subprocessors to host the Service and provide essential infrastructure. The main ones are:

• Amazon Web Services — application hosting (AWS Lambda), database (Amazon Aurora), email delivery (Amazon SES), and image moderation (Amazon Rekognition).
• Google and Discord — OAuth sign-in, when you choose to use them.
• Umami Software, Inc. — privacy-focused, cookieless analytics (Umami Cloud).

Email and account communication. We use Amazon SES to send account-related emails such as sign-in codes, security notifications, and billing receipts. If your email address bounces or marks our messages as spam, we maintain a suppression list to avoid sending you further mail until the issue is resolved.

For support requests. If you ask us for help with your account, we may need to access account data to assist you. We will ask for your consent before doing so.

To investigate abuse or violations of our community rules. Accessing an account when investigating potential abuse is a measure of last resort. We do our best to balance the privacy of the account holder with the safety of the people reporting issues to us.

Aggregated and de-identified data. We may aggregate or de-identify information collected through the Service and use it for any purpose, including analytics or improving the Service.

When required by law. Tableverse is operated by tableverse.gg, based in the United Kingdom. Personal data is stored and processed on Amazon Web Services infrastructure in the European Union (AWS Europe (Ireland) region, eu-west-1).

• Government requests for user data. Our policy is to refuse government requests unless we are compelled by legal process. We will respond to requests from law enforcement only when supported by a valid warrant, court order, or equivalent lawful instrument issued through proper legal channels (including, where applicable, mutual legal assistance treaties for cross-border requests). Our policy is to notify affected users before we disclose data unless we are legally prohibited from doing so.
• Tax audits. If we are audited by a tax authority, we may be required to disclose billing-related information. We will disclose only the minimum needed.

If Tableverse is ever acquired by or merged with another company, we will notify you well before any of your personal information is transferred or becomes subject to a different privacy policy.

Your rights with respect to your information

We strive to apply the same data rights to all users, regardless of location. Your rights include:

• Right to know. You have the right to know what personal information is collected, how it is used, and with whom it is shared. This policy outlines those answers.
• Right of access. You have the right to access the personal information we hold about you.
• Right to correction. You have the right to request correction of inaccurate personal information.
• Right to erasure. You have the right to request deletion of your personal information, subject to certain limitations under applicable law. Fulfilling a deletion request may require closing your account, since the Service depends on that data to function.
• Right to restrict or object to processing. You have the right to request that we restrict how your personal information is used.
• Right to portability. You have the right to receive a copy of the personal information we hold about you.
• Right to non-discrimination. We will not charge you a different amount or provide different service quality because you exercised these rights.
• Right to complain. You have the right to lodge a complaint with the appropriate supervisory authority regarding our handling of your personal information.

Many of these rights can be exercised directly from your account settings. For anything else, contact us at privacy@tableverse.gg and we will help.

In some cases, we need to verify your identity before responding to a request. If we are unable to verify you, we may be unable to act on the request.

If you are in the EU or UK, you have the right to lodge a complaint with your local data protection authority.

How we secure your data

All data is encrypted in transit using TLS. Our database is encrypted at rest, and database backups are encrypted as well. We host on Amazon Web Services and rely on AWS's physical and network security controls for infrastructure-level protection.

We do our best, but no system is perfectly secure. Please use a strong, unique password for your Tableverse account.

What happens when you delete content

You can delete your avatar from your account settings. When you do, it is removed from the active Service immediately. Deleted content may remain in database backups for up to 30 days before being purged.

Some content cannot be deleted by you directly. Lobbies, chat messages, and usernames are retained for moderation, safety, and the integrity of game history. If you need specific content removed, you can contact us at privacy@tableverse.gg and we will review your request.

Account closure

If you would like to close your Tableverse account, contact us at privacy@tableverse.gg.We will make your profile and content inaccessible and permanently delete your personal data from active systems within 60 days. Backups containing your data will be purged within 90 days.

We may retain a minimal record (such as the account identifier, username, and closure date) for fraud prevention, moderation history, and to honor any legal obligations.

Data retention

We keep your information only for as long as needed for the purposes described in this policy. Retention periods depend on the type of information and how it is used. We may also retain information as necessary to comply with legal obligations, resolve disputes, and enforce our agreements.

Location of site and data

Tableverse is operated by tableverse.gg, a company based in the United Kingdom. Your personal data — your account, profile, lobbies, messages, and other content — is stored and processed on Amazon Web Services infrastructure in the European Union, specifically the AWS Europe (Ireland) region (eu-west-1).

A small number of our subprocessors operate from outside the European Union and may incidentally process your data abroad. In particular, our analytics provider (Umami Software, Inc.) is based in the United States and briefly processes anonymized request metadata before discarding it. Where transfers do occur, we rely on the safeguards described below.

Applicable law and international data transfers

Because Tableverse is operated by a UK-based company, our processing of personal data is subject to the UK General Data Protection Regulation (UK GDPR), supervised by the United Kingdom Information Commissioner's Office (ICO). Where we offer our service to users in the European Economic Area, our processing of their personal data is also subject to the EU General Data Protection Regulation (EU GDPR).

Personal data may be transferred between the United Kingdom (where our company is based) and the European Union (where the data is stored). Both jurisdictions formally recognize each other as providing an adequate level of protection for personal data — the European Commission has issued an adequacy decision for the United Kingdom, and the United Kingdom recognizes the EEA as adequate in return — so these transfers occur freely without additional safeguards.

For the limited cases where personal data is transferred outside the United Kingdom and the European Economic Area (such as to our US-based analytics provider), we rely on appropriate safeguards permitted under UK GDPR and EU GDPR, including Standard Contractual Clauses and the UK International Data Transfer Addendum, where applicable.

Changes and questions

We may update this policy as needed to comply with relevant regulations and reflect any new practices. When we make a significant change, we will refresh the date at the top of this page and take reasonable steps to notify users.

Have any questions, comments, or concerns about this privacy policy, your data, or your rights with respect to your information? Contact us at privacy@tableverse.gg and we will be happy to help. You can also review our Terms of Service.