Privacy Policy

Effective date: August 26, 2026

Tavern Bag ("Tavern Bag", "we", "us") is a web application for tabletop role-playing: a character creator, a character sheet you play from, and a searchable rules compendium. It runs in your browser at tavernbag.com. This policy explains what data it collects, why, and how it is handled.

1. Data We Collect

Data	Purpose	Storage
Email address	Account authentication (Sign in with Connections)	Connections
Session tokens	Keep you signed in between visits	Your browser's local storage, on your device
Characters, inventory, notes and places	Store the heroes and items you create	Supabase database (Postgres), scoped to your account
Compendium questions & chat history	Show your earlier searches and answers on any device	Supabase database, scoped to your account
Subscription status	Determine which features are available	Connections
Page views	Understand which parts of the site get used	ARGUS analytics (analytics.connections.icu)

2. Data We Do Not Collect

We do not collect your keystrokes, or any browsing activity outside tavernbag.com.
We do not run advertising SDKs, and we do not use analytics to build a profile of you across other sites. See section 3 for the one first-party analytics pixel we do run.
We do not sell, rent, or share your data with third parties for marketing.
We do not collect personally identifiable information beyond your email address.
We never see or store your card number.

3. How Data Is Used

All collected data is used exclusively to provide Tavern Bag functionality:

Authentication: You sign in with Connections (OAuth); we receive only your verified email. No password is stored.
Session persistence: Session tokens are kept in your browser's local storage for tavernbag.com so you stay signed in.
Your characters: The heroes, items, notes and places you create are stored in our Supabase database (Postgres), tied to your authenticated account and readable only by it.
Compendium search: Searches run against our own copy of the rules in Supabase. When you ask the keeper a question, the text of that question is sent to Cloudflare Workers AI to produce an answer, and the question and answer are saved to your account so you can find them again.
Analytics: Our pages load a first-party analytics pixel from analytics.connections.icu, operated by Connections, the same company that handles sign-in. It records page views so we can see which parts of the site are used. It is not used for advertising and does not follow you to other sites.
Billing: Subscription status is provided by Connections, which handles payment processing. We never see or store card numbers.

4. Third-Party Services

Supabase — database and file hosting (Supabase Privacy Policy)
Cloudflare — website hosting, API compute, and the AI models behind compendium answers (Cloudflare Privacy Policy)
Connections — sign-in, billing, and the analytics pixel described above

These services receive only the minimum data required to perform their function.

5. Cookies & Local Storage

Local storage: Your session token is kept in your browser's local storage for tavernbag.com. Clearing site data signs you out and removes it.
No advertising cookies. We set no cookies for advertising, retargeting, or cross-site tracking.
Analytics: The pixel described in section 3 may set a first-party identifier to distinguish one visit from another. It is not shared with advertisers.

6. Data Retention & Deletion

Your data is retained only while your account is active. You may delete your account and all associated data at any time through our support page. Local data can be cleared at any time by clearing site data for tavernbag.com in your browser settings.

7. Security

All network communication uses HTTPS. Session tokens are stored in your browser's local storage for tavernbag.com and are readable only by that origin. Server-side data is stored in Supabase (Postgres), scoped on every request to the authenticated account owner.

8. Children's Privacy

Tavern Bag is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.

9. Changes to This Policy

We may update this privacy policy from time to time. Material changes will be communicated on our website. Continued use of Tavern Bag after changes constitutes acceptance of the updated policy.

10. Contact

Questions about this policy? Visit our support page.