Privacy Policy
This policy explains what taybl collects, why, who else can see it, and how to get it deleted. It describes what the product actually does today — not a general-purpose template.
Last updated 31 July 2026
Who we are
taybl ("we") operates tayblgames.com, an online virtual tabletop. For privacy law purposes we are the data controller for the information described below. You can reach us at admin@tayblgames.com for any question or request in this policy.
What we collect when you make an account
Your email address, a display name, and a password (stored only as a salted scrypt hash — we never store, and cannot recover, your actual password). If you sign in with Google or Discord we receive your email, name, and profile picture from that provider instead, and store an opaque account identifier so we can recognise you next time. We never receive your Google or Discord password.
What we collect about how you found us
When you first arrive we record — once, and only once per browser — the website that referred you, the first page you landed on, and any campaign (utm_*) tags in the link you followed. We store the referring site's DOMAIN only (for example "reddit.com"), never the full referring address, so we cannot see the specific page or search you came from. We also record a coarse device class, browser family, and operating system (for example "desktop / Chrome / macOS") derived from your browser's user-agent; we do not store the full user-agent string, and we do not store your IP address on your account. This tells us which channels bring people to taybl. It is not used to profile you and it is never sold.
What we collect while you use taybl
The games you create, the files you upload, the layouts you build, and the sessions you play — all of which are required to provide the product. We also record a small set of named product events (for example: a game was created, a generation finished, a session started) so we can see which parts of taybl work and which do not. These events are keyed to your account identifier and NEVER include your email address, your display name, or the content of your games.
Server logs
Like any web service, our servers write a technical log line for each request: the time, the method and path, the response status and duration, your account identifier when signed in, your IP address, and your browser's user-agent. These logs are what let us diagnose an outage or investigate a bug you report. They are retained for approximately 30 days and then deleted automatically. We deliberately keep email addresses, passwords, authentication tokens, and email verification links OUT of our logs.
Crash reports
If something breaks in your browser, taybl sends us an automatic report containing the error message, a technical stack trace, the page you were on, the app version, your account identifier if you are signed in, and a short reference code that is also shown to you on screen. Quoting that code to support lets us find the exact failure. Crash reports live in our server logs under the same ~30-day retention and are not stored in our database.
Cookies and similar technologies
taybl uses browser storage for things the product cannot work without: keeping you signed in, remembering your preferences, and holding the acquisition data described above until it can be saved to your account. Our analytics is configured NOT to record your screen, NOT to capture your clicks and form input automatically, and NOT to build advertising profiles. We do not run advertising trackers or third-party ad pixels.
Who else processes your data
We use a small number of vendors to run taybl. Each acts as a processor on our instructions: Fly.io (application hosting), Neon (managed database), Cloudflare (DNS and file storage for your uploads), Resend (transactional email such as verification links), PostHog (product analytics), Axiom (server log search), and Google and Discord where you choose to sign in with them. In addition, when you use taybl's AI generation or the Pip assistant, the rules text and images you provide are sent to an AI provider (Anthropic by default, and in some configurations OpenAI or Google) purely to produce your game — see our AI Disclosure page for the detail. We do not sell your personal data to anyone.
Games you publish are public
Publishing a game makes its name, description, cover art, and playable definition publicly visible at a permanent address, along with your designer display name. That is the point of publishing — but it is a deliberate choice, and you can unpublish at any time from the Studio. Unpublished drafts are visible only to you.
How long we keep things
Your account and its games are kept until you delete them. When you delete your account we mark it deleted immediately and keep it recoverable for 30 days so a mistake can be undone; after that a scheduled job permanently erases the account, the games you own, your uploaded files, and your usage records, and asks our analytics provider to erase your data too. Play sessions with no activity for 30 days are removed automatically. Server logs are kept for approximately 30 days.
Your rights
Depending on where you live, you may have the right to access, correct, export, or erase your personal data, to object to or restrict certain processing, and to complain to your local data protection authority. You can delete your account yourself at any time from your Account page, which triggers the erasure described above. For anything else, email admin@tayblgames.com and we will respond.
Children
taybl is not directed at children under 13 (or the minimum age of digital consent where you live, if higher), and we do not knowingly collect their personal data. If you believe a child has created an account, contact admin@tayblgames.com and we will remove it.
International transfers
Our vendors may process data in countries other than yours, including the United States. Where required, transfers rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.
Changes to this policy
If we change this policy materially we will update the date shown on this page and, where the change is significant, tell you in the app. Continuing to use taybl after a change means the updated policy applies.