Privacy Policy

Last updated: August 2026

In short

Taro Bay stores only what is needed to run the game — your account and your game progress. There are no tracking cookies, no ads, and no third-party analytics.

1. Controller

Patrick Kis, Dachensteingasse 11, 2700 Wiener Neustadt, Austria, email: hello@tarobay.io

2. Account data

To register, we store your email address, your password — the latter only as a cryptographic hash, never in plain text — and your character name. Sign-in is handled by Supabase Auth. Purpose: providing your game account. Legal basis: Art. 6(1)(b) GDPR (performance of contract). Without these details no account can be created; you are under no statutory obligation to provide them.

3. Game progress

Your progress — character, skills, inventory, market orders, chat messages, activity log — is stored in a Supabase database in the eu-central-1 region (Frankfurt am Main, EU). Purpose: that is the game. Legal basis: Art. 6(1)(b) GDPR. Your character name and chat messages are visible to other players; your email address never is.

4. Hosting and server logs

The website is served via Vercel Inc. (USA). Visiting it produces technical server logs (IP address, timestamp, requested page, user agent), which we use for debugging and abuse prevention. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, stable, abuse-free operation). Logs are deleted automatically after a short period. Data processing agreements pursuant to Art. 28 GDPR are in place with Vercel and Supabase. Where data is transferred to the USA, this is based on the EU–US Data Privacy Framework (EU Commission adequacy decision; Vercel is certified under it), supplemented by EU standard contractual clauses.

To prevent automated mass sign-ups, registration requests are additionally rate-limited per IP address: we store a keyed hash of the IP address (never the address itself) in our database for up to 48 hours. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in preventing abuse of the registration).

5. Contact by email

If you write to hello@tarobay.io, we process your email address and the content of your message to answer your request. The mailbox is hosted with Apple iCloud Mail (Apple Distribution International Ltd., Ireland); where Apple transfers data to the USA, this is safeguarded by EU standard contractual clauses. Legal basis: Art. 6(1)(b) GDPR where your request concerns your account, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering requests). Settled emails are deleted once they no longer need to be kept.

6. Notifications (only if you switch them on)

You can have the game notify you when your action queue runs dry. This is off by default. If you switch it on, your browser creates a push subscription with the push service of its maker (Google, Apple, or Mozilla, depending on the browser). We then store, linked to your player account: the address of that subscription (the endpoint URL at the push service) and the two keys that let us encrypt a message so only your browser can read it. We also note which queue finish we last notified you about, so the same reminder is never sent twice.

Purpose: sending that one notification. Legal basis: Art. 6(1)(a) GDPR (consent). Delivery necessarily runs via your browser maker's push service, which sees that a message is on its way to your device but not what it says. You can withdraw your consent at any time — turn the notifications off again, or revoke the permission in your browser; we delete the subscription in either case. Subscriptions the push service reports as gone are removed automatically, and everything is deleted with your account.

7. In-game reports

If you use the report button in the game to send us a bug or an idea, we transmit what you wrote (bug or idea, the area you picked, the title and your description) together with your player ID, the page you were on, which of the two interfaces you were using, the version of the game, and the size of your browser window. That context is what lets us reproduce a problem without asking you a dozen questions. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in finding and fixing faults).

Reports land in our own feedback tool — a separate application, run by us on the same providers as the game (served via Vercel, stored in the same Supabase database in Frankfurt am Main, EU) and readable only by the people we have given access to it. Settled reports are deleted once we no longer need them.

8. Cookies

We use only technically necessary cookies for your login session (Supabase Auth). Such strictly necessary cookies are permitted without consent under § 165(3) of the Austrian Telecommunications Act (TKG 2021). No tracking cookies, no ad networks, no third-party analytics. That is also why there is no cookie banner — there is nothing to consent to.

9. Retention

Your account and game progress are kept for as long as your account exists. You can delete it yourself at any time: log in, open Account & data (at the foot of the sidebar, or in the character panel) and confirm by typing your character name. Deletion takes effect immediately and cannot be undone — there is no grace period and no backup we could restore you from. It removes your character and all game progress, your chat messages in every channel, your activity log, achievements, leaderboard entries and push notification registrations, together with your login itself. Two things are kept in anonymised form, with no link left to you: completed market trades (they are the other party's record of the transaction as well, and they carry the market tax) and the record that a guild daily quest was redeemed — without who redeemed it. If you can no longer log in, an informal email to hello@tarobay.io is enough and we delete the account for you. Server logs are deleted after a short period regardless.

10. Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and objection (Art. 15–21 GDPR). An informal email to hello@tarobay.io is enough. Erasure (Art. 17 GDPR) you can also exercise yourself, inside the game: Account & data → Delete account. You may also lodge a complaint with the Austrian data protection authority (dsb.gv.at).

No automated decision-making, including profiling, takes place.

11. Contact

Privacy questions: hello@tarobay.io