1. Information We Collect

1.1 Account Information

When you create an account, we collect your name, email address, and password. Your password is handled by Google Firebase Authentication; Company does not see or store your password in plain text. Once your account is created, you may also provide a username, city or neighborhood, favorite TTRPG systems, and a short bio, which are stored in our database (Google Cloud Firestore) and associated with your account.

1.2 Event Submission Information

When you submit an event to the Quest Board — whether or not you have an account — we collect the event details you provide, which may include the event title, type, system, description, date, time, venue name, neighborhood, seat count, experience level, age restriction, price, an optional event URL, and your name, email address, and phone number as the submitting GM or host. We also collect any optional notes you leave for our review team.

1.3 Payment Information

If you purchase the optional Boost feature, your payment is handled entirely by PayPal. We do not collect or store your card number, bank information, or PayPal login credentials. We retain only the PayPal order reference, the amount charged, and the date of payment, associated with your event submission.

1.4 Information Collected Automatically

Like most websites, our hosting and infrastructure providers may automatically log basic technical information, such as IP address, browser type, and general usage patterns, for security and operational purposes. Our bot-protection provider, Cloudflare, also evaluates certain technical signals from your browser when you submit forms (see Section 5).

2. How We Use Information

We use the information described above to:

• create and maintain your account and authenticate your login;
• display your profile information back to you when you're signed in;
• review, publish, and manage event listings on the Quest Board;
• process Boost payments and send related confirmations;
• send account-related emails, such as confirmation of account details, password reset links, and email-change verification;
• notify our review team when a new event is submitted;
• detect and prevent spam, fraud, and abuse of the Service; and
• comply with our legal obligations and enforce our Terms of Service.

We do not use your information for third-party advertising, and we do not sell your personal information.

3. How We Share Information

We do not sell your personal information. We share information only in the following circumstances:

• with the service providers listed in Section 5, solely to operate the Service (for example, Firebase to store your account, PayPal to process a Boost payment, or EmailJS to deliver an email on our behalf);
• as described in Section 4, where certain event submission details are published to the public Quest Board once approved;
• if required by law, subpoena, or other legal process, or to protect the rights, safety, or property of Company, our Users, or the public; or
• in connection with a merger, acquisition, or sale of assets, subject to this Policy or a successor policy of which you will be notified.

4. What Becomes Public

Most account information — your username, location, favorite systems, and bio — is visible only to you when signed in. We do not currently maintain a public member directory or public-facing profile pages.

When an event submission is reviewed and approved, the following details are published on the public Quest Board: event title, type, system, session info, description, date, time, venue, neighborhood, seat count, experience level, age restriction, price, and GM name. Your contact email and phone number are not displayed as text on a published listing. However, if you do not provide a separate Event URL, the listing's button links directly to your contact email (as a “mailto:” link), meaning a visitor who clicks that button will see your email address in their own email application. If you'd prefer your email not to be reachable this way, provide an Event URL (a Discord invite, sign-up form, or similar) when you submit your event, or contact us to use alternate contact arrangements.

5. Third-Party Service Providers

5.1 Google Firebase

We use Firebase Authentication and Firestore (both Google products) to manage accounts and store account and event submission data. Firebase's handling of data is governed by Google's own privacy and security practices.

5.2 PayPal

Boost payments are processed entirely by PayPal. PayPal's collection and use of your payment information is governed by PayPal's own privacy policy, not this one.

5.3 EmailJS

We use EmailJS to deliver account-confirmation emails to Users and event-submission notifications to our review team. Email addresses and message content passed to EmailJS for this purpose are handled under EmailJS's own privacy practices.

5.4 Cloudflare Turnstile

We use Cloudflare Turnstile to help distinguish real visitors from automated bots on our signup and event-submission forms. Turnstile may evaluate technical signals from your browser; this is governed by Cloudflare's own privacy practices.

5.5 Google Fonts

Our pages load typefaces from Google Fonts. Loading a font involves your browser making a request to Google's servers, which may receive your IP address in the ordinary course of serving that request.

6. Cookies and Local Storage

Company does not use advertising or third-party tracking cookies. Firebase Authentication stores a session token in your browser's local storage so you can stay signed in between visits. PayPal and Cloudflare may set their own cookies or similar technology as part of processing payments and detecting bots, respectively, under their own privacy practices.

7. Data Retention

We retain your account information for as long as your account is active. If you delete your account through the Service, your account record and profile information are deleted from our database at that time.

Event submissions are retained for our review and record-keeping purposes, including after publication, and are not automatically deleted when you delete your account (an event submission is not tied to requiring an account in the first place). If you would like a past event submission removed, contact us at ttrpgh[at]gmail.com.

8. Data Security

We rely on Firebase's security infrastructure and access-control rules to restrict who can read or modify stored data — for example, only you can read or write your own account record, and event submissions cannot be read back by the public once submitted. No method of storage or transmission is completely secure, and we cannot guarantee absolute security.

9. Your Rights and Choices

You can, at any time, through your account:

• Access and update your profile information from your Profile page;
• Change your email address, which requires verifying the new address before it takes effect;
• Reset your password from the login page; and
• Delete your account, which permanently removes your account and profile information.

For requests we don't yet have a self-service tool for — such as removing a past event submission, or asking what information we hold about you — contact us at ttrpgh[at]gmail.com and we will respond within a reasonable time.

10. Children's Privacy

The Service is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. Consistent with our Terms of Service, use of the Service by anyone under 18 requires the involvement and consent of a parent or legal guardian. If we learn that we have collected information from a child under 13 without appropriate consent, we will delete it.

11. State Privacy Rights

Depending on where you live, you may have additional rights regarding your personal information under state privacy laws. We do not sell personal information and do not use it for cross-context behavioral advertising, which are the activities most state privacy laws are primarily concerned with. To make any privacy request, including a request to access, correct, or delete your information, contact us at ttrpgh[at]gmail.com.

12. Changes to This Policy

We may update this Policy from time to time. If we make material changes, we will update the “Last Updated” date above and, where appropriate, provide additional notice. Your continued use of the Service after changes take effect constitutes acceptance of the revised Policy.

13. Contact Us

Questions about this Privacy Policy, or requests regarding your information, can be sent to ttrpgh[at]gmail.com.