Privacy Policy

1. Who We Are

Cork D&D is a community-run tabletop gaming club based in Cork, Ireland. The club is the "data controller" for the personal information handled on this site — in plain English, we decide what's collected and why, and we're responsible for looking after it. If you have any question about your data, reach us through the Contact page.

2. What We Collect, and Why We're Allowed To

We only handle what's needed to run the club. For each activity, EU law (the GDPR) requires us to name a legal basis:

• Your account: email address, username, display name, an optional preferred name (see section 4), optional avatar and play preferences. We need these to provide the site at all — the legal basis is our agreement with you (contract). We keep these for as long as your account exists.
• Club activity: the games you join, RSVPs, posts, comments, stories, and library borrows. Also part of providing the site (contract).
• Live chat: your messages, uploaded images, and chat settings. We run the chat as the club's communication channel — the legal basis is our legitimate interest in running club communications, as part of your membership. Details in section 5.
• Moderation and safety records: content reports, moderation actions (with their reasons), and the admin audit log. Legal basis: our legitimate interest in keeping the community safe and being able to show what was done and why.
• Emails and push notifications: reminders, verification emails, and (if you opt in per device) push notifications. Legal basis: contract for essential account emails, and your consent for optional notifications — you control these from your profile's notification settings. When an organiser answers a message you sent through the contact form, the reply is emailed to you from the club's own address; the button in that email simply opens our contact form again with your details filled in, so you can write back without retyping them.
• Anti-abuse: a registration blocklist and rate limiting, to keep spam and abusive signups out. Legal basis: legitimate interest.
• Payments: handled entirely by Shopify's checkout — we never see or store your card number. We receive the order details (what was bought and the checkout email) so raffle tickets can be credited to your account.

We will never sell your data to anyone.

3. Third-Party Services

• Payments: Shopify runs the club shop and its checkout, including card details.
• Login: if you use Google to sign in, they share your email and name with us to create your account.
• Emails: we use automated services to send verification and notification emails.
• Anti-spam: the sign-up and contact forms use Cloudflare Turnstile to tell people from bots. It replaces the old "spot the traffic lights" puzzles and doesn't track you around the web.
• Fonts and shared code: a few files — our fonts and some small code libraries — are delivered by Google Fonts, jsDelivr, unpkg and cdnjs rather than by us. Your browser has to tell them your IP address to fetch a file; they get nothing else about you and set no cookies here.

4. What Organisers Can See

Your preferred name. Your profile has an optional "preferred name" — the name you'd like to be called at the table, for when you've RSVP'd under an online handle. It is never shown to the membership at large. It is visible only to club admins, event organisers (the people running the door on the night) and the Dungeon Master of a table you're in. Leave it blank and nothing is stored; clear it at any time from your profile.

5. Live Chat

The site's chat runs on the club's own chat server (a Matrix homeserver we operate). A few things you should know before you use it:

• Not end-to-end encrypted. Messages are protected in transit and in storage, but they are readable on our server.
• Organisers can read messages in channels and table chats for moderation. Don't post anything in chat you'd mind a club organiser seeing.
• Direct messages between two members are read only for a specific reason. That means one of two things: somebody reported a message in the conversation, or there is a safety matter an admin has had to write down a reason for. It is limited to the messages around the one being looked at, only club admins can do it, every time it happens is recorded, and we tell both of you once the matter is dealt with. Your direct messages are not end-to-end encrypted and they are not private from us in a technical sense — this is the rule we hold ourselves to about when we will actually look.
• Presence is visible: other members can see when you're online, whether you've read messages (read receipts), and when you're typing.
• Uploaded images are stored in the club's storage and automatically deleted after the retention period below.
• Push notifications for chat carry message details (sender, room, a preview) through the club's own infrastructure to your device.

6. How Long We Keep Things

We don't keep data forever. Our retention periods:

Active moderation records (for example a chat ban that's still in force) are kept for as long as the sanction lasts.

7. Your Rights

You're in control of your data:

• Access: download a full export of your data from your profile at any time — a ZIP with a readable summary page, your photos and images, and a machine-readable file, chat messages included.
• Erasure: delete your account from your profile. You choose whether to also delete everything you said in chat — otherwise your messages remain, shown as from "a deleted user".
• Rectification: fix anything that's wrong — most account details are editable on your profile; for anything else, contact us.
• Objection: you can object to any processing we base on legitimate interest, via the Contact page.
• Complaint: if you think we've handled your data badly, you can complain to Ireland's Data Protection Commission.

8. If Something Goes Wrong

If we ever suffer a data breach that puts your rights at risk, we will report it to the Data Protection Commission within 72 hours and tell affected members without undue delay, explaining what happened and what we're doing about it.

9. Cookies and What's Stored on Your Device

Two different things get stored by your browser, and the law treats them the same way, so here's both.

Essential cookies. A small number, strictly necessary to run the site: they sign you in, protect forms against forgery, and hold your shopping basket. Without them the site can't work, so they don't need your consent.

Settings saved on your device. Things you chose — light or dark mode, which panels you left open, chat and game volume. These never leave your device, they're only there because you picked them, and we don't use them to identify or follow you.

We do not use tracking, analytics or advertising cookies, we don't share any of this with anyone, and nothing here follows you to other websites. That's why you aren't asked to accept cookies. If we ever wanted to add something that isn't essential, we'd ask you first.

You can wipe your saved settings any time from the bottom of your profile page, and your browser can clear everything on this list. Signing out clears your chat sign-in. If anything here isn't clear, please get in touch.

10. Security

All traffic to the site and the chat server is encrypted in transit (TLS), and stored data sits behind access controls. The club app itself does not keep logs of your IP address; the chat server keeps IP and device logs for up to 14 days for abuse investigation, then deletes them. No site is 100% secure — we recommend using a unique password for your account.