Privacy Policy
Effective date: August 26, 2026
Tavern Bag ("Tavern Bag", "we", "us") is a web application for tabletop role-playing: a character creator, a character sheet you play from, and a searchable rules compendium. It runs in your browser at tavernbag.com. This policy explains what data it collects, why, and how it is handled.
1. Data We Collect
| Data | Purpose | Storage |
|---|
| Email address | Account authentication (Sign in with Connections) | Connections |
| Session tokens | Keep you signed in between visits | Your browser's local storage, on your device |
| Characters, inventory, notes and places | Store the heroes and items you create | Supabase database (Postgres), scoped to your account |
| Compendium questions & chat history | Show your earlier searches and answers on any device | Supabase database, scoped to your account |
| Tip payments | Take an optional monthly tip | Connections Pay and Stripe (we never see your card) |
| Page views, clicks, form-field activity (never what you type) and a few named steps | Understand which parts of the site get used | ARGUS analytics (analytics.connectionsapi.com) |
2. Data We Do Not Collect
- We do not collect your keystrokes, or any browsing activity outside tavernbag.com.
- We do not run advertising SDKs, and we do not use analytics to build a profile of you across other sites. See section 3 for the one first-party analytics pixel we do run.
- We do not sell, rent, or share your data with third parties for marketing.
- We do not collect personally identifiable information beyond your email address.
- We never see or store your card number.
3. How Data Is Used
All collected data is used exclusively to provide Tavern Bag functionality:
- Authentication: You sign in with Connections (OAuth); we receive only your verified email. No password is stored.
- Session persistence: Session tokens are kept in your browser's local storage for tavernbag.com so you stay signed in.
- Your characters: The heroes, items, notes and places you create are stored in our Supabase database (Postgres), tied to your authenticated account and readable only by it.
- Compendium search: Searches run against our own copy of the rules in Supabase. Your search words go to our own server to run the search, and no AI service sees them; searches you run while signed in are saved to your account so you can find them again. A search that arrives in the page address, such as a shared link, is also recorded by the analytics pixel described below.
- Analytics: Our pages load a first-party analytics pixel from analytics.connectionsapi.com, operated by Connections, the same company that handles sign-in. So we can see which parts of the site are used, it records page views; clicks on links and buttons, with their visible label; how far you scroll; when you enter and leave a form field and how many keys you press there, never what you type; how much text you copy, never the text; page errors and console warnings; searches that arrive in the page address; page speed; and a few named steps (starting sign-in, signing in, saving a new hero, starting a tip, sending us a message), which carry no names or emails. It is not used for advertising and does not follow you to other sites.
- Tips: The optional monthly tip is paid through Connections Pay, which runs it on Stripe. We never see or store card numbers.
- Tavern Bag Unlimited: Paid through Connections Pay on Stripe, like a tip. When your plan starts, changes or ends, Connections Pay tells us, and we keep the subscription's id, its status, its renewal date, the email you gave at checkout and which Tavern Bag account it belongs to, so we know how many heroes you can keep. We never see or store card numbers.
4. Third-Party Services
These services receive only the minimum data required to perform their function.
5. Cookies & Local Storage
- Local storage: Your session token is kept in your browser's local storage for tavernbag.com. Clearing site data signs you out and removes it.
- No advertising cookies. We set no cookies for advertising, retargeting, or cross-site tracking.
- Analytics: The pixel described in section 3 may set a first-party identifier to distinguish one visit from another. It is not shared with advertisers.
6. Data Retention & Deletion
Your data is retained only while your account is active. You may delete your account and all associated data at any time through our support page. Local data can be cleared at any time by clearing site data for tavernbag.com in your browser settings.
7. Security
All network communication uses HTTPS. Session tokens are stored in your browser's local storage for tavernbag.com and are readable only by that origin. Server-side data is stored in Supabase (Postgres), scoped on every request to the authenticated account owner.
8. Children's Privacy
Tavern Bag is not directed at children under 13. We do not knowingly collect data from children under 13. If you believe we have inadvertently collected such data, please contact us and we will delete it promptly.
9. Changes to This Policy
We may update this privacy policy from time to time. Material changes will be communicated on our website. Continued use of Tavern Bag after changes constitutes acceptance of the updated policy.
10. Contact
Questions about this policy? Visit our support page.
© 2026 Tavern Bag. All rights reserved.
Tavern Bag
Back to Site