Privacy and cookies

Last updated on October 10, 2026.

Taverna is a free tool for tabletop roleplaying groups. It shows no advertising, sells nothing and does not follow you around the web. This page says what it keeps about you, why, for how long, who else sees it, and how to have it corrected or erased.

Who is responsible

Taverna is run by Grégory Schouweiler, a private individual living in Belgium, who is the controller of your data within the meaning of the General Data Protection Regulation (GDPR). For any question or request about your data, write to privacy@taverna.games.

What Taverna keeps, and why

Your account

Your name, your email address, your password (stored only as an irreversible fingerprint), your language and time zone, the session emails you choose to receive and, if you turn them on, your two-factor authentication and your passkeys. During the closed beta, Taverna also records who invited you.

They let you sign in and use the service you signed up for: this is the performance of the contract between you and Taverna (Article 6(1)(b) GDPR).

What you create

Your characters and their history, the tables you run or join, sessions and attendance, date polls, journal entries with their pictures and sounds, and the links shared with your group. They are the service itself (Article 6(1)(b) GDPR), and are shown only to you and to the members of the table concerned, as each screen says.

Grégory Schouweiler, who runs Taverna, can also open any table and any sheet, and see who sits at a table with their email address: to answer a question you ask, or to hand the game master's role to one of a table's players when the table asks for it. Beyond that, the site is only looked at in totals — how many accounts, characters and tables —, never person by person.

What you write there is up to you. Remember that your table reads it: the place of a session, for instance, is seen by every member. The same goes for pictures: they keep what the camera recorded in them, which can include the place where the photo was taken.

Invitations

When you invite someone by email, to a table or to the beta, Taverna keeps the address you type and sends that person a single message. Nothing else is sent to them, and they are added to no list. This rests on the legitimate interest, yours and Taverna's, in bringing a group together (Article 6(1)(f) GDPR).

Emails about your sessions

When a game master of your table puts dates to the vote, gives up a date already set or cancels a session, Taverna writes to the other members. When a date is set or moved, the whole table receives it, game master included, with the place and a file for the calendar. Two days before each session, a reminder goes to everyone at the table, except those who said they could not come. These messages go only to the members of the table concerned, at the address of their account, and hold nothing they cannot already see on the sessions page. They are part of the service (Article 6(1)(b) GDPR).

You can stop them — the reminders on their own, or the rest — in Settings › Notifications, or with the link at the foot of each of them, without signing in. Taverna keeps that choice with your account.

Technical data

While you are signed in, your session holds your IP address and the name of your browser, to protect your account. Error reports may contain your account number. This rests on Taverna's legitimate interest in keeping the service secure (Article 6(1)(f) GDPR).

Your calendar

If you subscribe a calendar application to your personal address, that application (Google, Apple, Microsoft or another) receives the dates and places of your sessions, and handles them under its own policy. You can cut it off at any time from the sessions page, with “Draw a new address”.

Donations

Donations are made on Ko-fi, on its own site: what you enter there — your name, your email address, your means of payment, a message — is handled by Ko-fi and by the payment provider you choose, under their own policies. The button that leads there is a plain link: no page of Taverna loads anything from Ko-fi.

Ko-fi then tells Taverna about each payment. Of that notice, Taverna keeps only the amount, the currency, the date and the number of the payment, to show everyone where the year's costs stand. Your name, your address and your message are not kept, and nothing is linked to your account. This rests on Taverna's legitimate interest in keeping honest, public accounts (Article 6(1)(f) GDPR).

Taverna does not sell or rent your data, builds no profile of you, and uses no audience measurement or tracking tool.

How long it is kept

• Your account and what you created: for as long as the account exists. You can delete it at any time, in Settings › Profile › Delete account: it is erased at once.
• The tables you run leave with your account, with their sessions, journal and files, for all their players. The players keep their characters.
• What you gave to other people's tables, such as a journal entry or a file you posted, stays there without your name, because it belongs to the group's shared story.
• A character who fell at a table stays in its memory, even once you have left it: its name, the date, and what the game master wrote of its death, without your name. Deleting the character takes it away.
• Invitations expire after 30 days. Once used, declined, withdrawn or expired, they are erased 30 days later.
• Sessions end after 120 minutes without activity, and are erased shortly after, with the IP address and browser name they held.
• Error reports are kept for 14 days.
• Donations: their amount, currency, date and number are kept as the site's accounts, with nothing that names you.
• The host's backups may still hold a copy of erased data until they are replaced in turn.

Who else sees it

Taverna is hosted by Hostinger International Ltd (Cyprus), on servers in the European Union, which also send its emails. Hostinger acts on Taverna's behalf, as a processor.

If you make a donation, you make it on Ko-fi, run by Ko-fi Labs Limited (United Kingdom), which does not act on Taverna's behalf: it is a separate service, with its own privacy policy.

Apart from the members of your tables, who see what you share with them, nobody else receives your data. Taverna itself sends none of it outside the European Union.

Cookies and storage in your browser

Taverna only stores in your browser what it needs to work. Such storage is exempt from consent, which is why the site shows no cookie banner. There are no advertising, audience measurement or third-party cookies, and the fonts are served by Taverna itself.

Should Taverna ever need something that is not strictly necessary, it will ask for your consent first, and this list will say so.

Your rights

You may access your data, have it corrected or erased, restrict or object to its use, and receive it in a common format to take elsewhere. You can do much of this yourself: your profile is edited in Settings, and your account is deleted from there too. For everything else, write to privacy@taverna.games: you will get an answer within one month.

If you believe your data is mishandled, you may lodge a complaint with the Belgian Data Protection Authority (dataprotectionauthority.be), or with the authority of the country where you live.

Security

The site is only served over an encrypted connection. Passwords are never stored in readable form, journal files are kept private and handed only to the members allowed to see them, and you can protect your account with two-factor authentication or a passkey.

Changes

When this page changes, the date at the top changes with it.