Privacy Policy
Astro's Lounge ("we", "us") runs this fan-made Days of Dragons site. This policy explains what we keep so the site works, and the choices you have under the EU and UK GDPR, US children's privacy rules, the California Consumer Privacy Act as amended by the CPRA, and similar US state privacy laws. We do not sell personal information. We do not give it to advertisers.
Who to contact
Privacy requests must be sent by text to (920) 279-9244. Say which right you are using and the Discord account or page it concerns. We may need to confirm it is you. We respond within 45 days, or sooner when the law that applies to you requires it. You can also complain to your local data protection authority. In the UK that is the ICO. In the EU it is the authority in your country.
Any dispute about this policy or about your information must be sent by text to (920) 279-9244 before you file a claim. Give us 30 days after that text to try to resolve it.
Information we collect
- Discord sign-in. If you sign in, Discord gives us your Discord user id, username, display name, discriminator, and avatar. We store that with your sanctuary profile. The login cookie is
sanctuary_discord_session. It is HttpOnly, lasts 30 days, and is used only to keep you signed in. - Sanctuary content you add. Profile name, page address, landing page, server sheets, account names, dragon rosters, notes, images, and whether a page is public. Account names can include a Steam id, Steam name, and Steam avatar when you add them. If a Steam profile is public, we ask Steam for the display name, avatar, and playtime for Day of Dragons and Dragons Legacy.
- Requests. Nesting or account-access requests can include your Discord id, Discord username, and the message you send.
- Wiki and map. If you suggest or publish an edit while signed in, we store the edit with your Discord id and name.
- Push notifications. If you turn them on, the browser gives us a push endpoint and keys, plus a short user-agent string, so we can notify that sanctuary owner. You can turn this off in the browser.
- Page analytics on Sanctuary. On load we record the page path, title, referrer, language, time zone, browser, operating system, device type, and screen size, plus a random session id. That is only so we can see which of our own pages are used. It is not used for ads, and it is not tied to a public profile of you.
- Analytics dashboard. The private analytics login uses a separate cookie,
sanctuary_analytics_session, for 12 hours.
We do not store IP addresses. We do not ask for your real name, email, postal address, payment card, government id, or precise GPS location. Discord does not give us your email through this sign-in.
Cookies and similar storage
The Discord cookie is strictly necessary once you choose to sign in. The analytics dashboard cookie is only set after someone logs into that private dashboard. Sanctuary page analytics are sent as a request when the page loads. They are not an advertising cookie. The site also remembers some display choices in your browser. Public wiki and API responses may be cached briefly by your browser and by Cloudflare so pages load faster. Cached public pages do not include your Discord session.
Why we use it
- To provide the site you asked for (GDPR contract): your profile, rosters, wiki edits, and notifications.
- Legitimate interests: keeping the site secure, preventing abuse, understanding which pages are used, and fixing breakage. Analytics stay limited to our own pages.
- Consent: browser push notifications, which you can withdraw by disabling them.
We do not use personal information for automated decisions that produce legal effects.
Children
This site is a general-audience fan site for a game. It is not directed at children under 13, and we do not knowingly collect personal information from anyone under 13. Discord's own rules require users to be at least 13. Do not sign in, submit a roster, or send a request if you are under 13.
If you are in the EU or UK and you are under 16, or under the lower digital-consent age set by your country (never below 13), do not create an account unless your parent or guardian has agreed. If we learn we have information from a child we should not have, we will delete it. Parents and guardians can text (920) 279-9244 and ask us to delete a child's information.
This section is how we meet the US Children's Online Privacy Protection Act (COPPA) and the GDPR rules on children's consent.
EU and UK privacy rights
If the GDPR or UK GDPR applies to you, you can ask us to:
- confirm whether we have your information and for a copy of it
- correct it
- delete it
- restrict or object to how we use it, including analytics based on legitimate interests
- receive the profile and roster data you gave us in a portable form
- withdraw consent for push notifications without affecting earlier use
- lodge a complaint with a supervisory authority
We are the controller of the Discord profile, sanctuary content, wiki edits, and analytics described above. Those rights apply even when the data is processed outside your country.
Your data may be processed in other countries
Your data may be processed in countries other than the one you live in. That includes the United States. It can also include other countries where the host that runs this site operates. The site is hosted on Cloudflare. When you open a page, sign in, save a sanctuary, suggest a wiki edit, or turn on a notification, the information described in this policy may be stored and handled on servers outside your country so the site can load and keep working.
This can cover your Discord profile, the sanctuary pages and rosters you save, nesting and access requests, wiki and map edits, optional push-notification details, and Sanctuary page analytics. It does not change what we keep. We still do not store IP addresses. We still do not sell personal information, and we do not give it to advertisers.
The data is encrypted while it travels between your browser and the site, and it is encrypted where it is stored. Encryption protects it on the way and at rest. It does not mean the data never leaves your country. Processing in another country is how a site hosted on a worldwide network is able to run.
The country where data is processed may have different privacy laws than the country where you live. If you are in the EU or the UK, your rights in the section above still apply. Cloudflare participates in the EU-US Data Privacy Framework. Where that does not cover a transfer, the protection is the contract with the host and the encryption described here.
Signing in uses Discord. A Steam lookup uses Steam only for the profile you asked us to check. Push notifications use your browser's own push service only if you turn them on. Those steps happen because you used that feature. They are not a sale of your information.
You can still ask for a copy, a correction, or deletion by texting (920) 279-9244, no matter which country the data was processed in. Any dispute about this processing must be sent by text to (920) 279-9244 before you file a claim. Give us 30 days after that text to try to resolve it.
California
If you are a California resident, the CCPA/CPRA gives you the right to know, delete, and correct personal information, and to opt out of sale or sharing. We do not sell personal information and we do not use it for advertising. We will not discriminate against you for using these rights.
Depending on what you use, that information is your Discord id and username, a Steam id you add, the sanctuary text you type, and basic page and device details from Sanctuary analytics. We do not collect precise location, financial information, health information, or biometrics.
We honor a browser Global Privacy Control signal as a request not to sell or share personal information. We do not respond to older "Do Not Track" signals, which are not a consistent standard.
You may use an authorized agent if you give them signed permission and we can verify you. Text (920) 279-9244.
Other US state privacy laws
Residents of states with consumer privacy laws, including Virginia, Colorado, Connecticut, Utah, Texas, Oregon, Montana, and other states that grant similar rights, can ask to access, correct, delete, and opt out of sale, targeted advertising, or certain profiling. We do not sell personal information and we do not use it for targeted advertising or for profiling that produces legal or similarly significant effects. To appeal a refusal, reply to our decision and we will review it.
How long we keep it
Account, roster, request, and wiki-edit data stays until you delete it or ask us to delete the account. Push subscriptions stay until you disable them or the browser endpoint expires. The Discord cookie expires after 30 days. Page-view analytics are kept so we can see how the site is used, and we delete them when you ask or when we no longer need them. Short-lived public caches of wiki pages expire within about a minute, and the public map cache expires within about three minutes.
Public pages
Sanctuary pages, rosters, and wiki edits you leave public can be seen by anyone on the internet and may be cached or indexed. Do not put private information about yourself or anyone else in a public roster, map pin, or wiki page. Private landing pages are hidden from other visitors.
Security
Sign-in cookies are HttpOnly. Traffic to the site is encrypted, and stored data is encrypted. Access to analytics and admin tools is limited. Tell us if you think an account or page was accessed without permission.
Changes
If we change this policy, we will update the effective date on this page. Continued use of the site after the new date means the new policy applies. If a change requires consent, we will ask for it.