Privacy policy

Last updated: 3 November 2026

This policy explains what Party Goblins collects and why. It is written to meet the EU General Data Protection Regulation (GDPR) and Turkey's Personal Data Protection Law No. 6698 (KVKK). We collect as little as we can.

What we store

• Account: your username and a hash of your password (Argon2id). We never see or store your password in plain text. We do not ask for your email.
• Recovery codes: stored only as hashes.
• What you post: events, guild listings, LFG posts (including the in-game character name you enter, shown publicly so players can contact you), going / tentative answers on events and reports.
• Optional posting defaults: the character name, ruleset, region, faction, class and role you choose on your account page, used only to pre-fill your own forms. Not shown to anyone else; clear them any time.
• In your browser only: the PvE / PvP ruleset filter you pick is remembered in your browser's local storage so it stays on as you move around the site. It is never sent to us and is not a cookie.
• Session: one cookie that keeps you signed in. It is strictly necessary, so no cookie banner is shown. We use no advertising or tracking cookies.
• IP address: used only in memory to limit abuse (rate limiting). It is not written to our database, is masked in server logs and is deleted within 48 hours.
• Analytics: if enabled, we use a cookieless, privacy-friendly tool (Plausible or Umami) that counts page views without identifying you.

Why (legal basis)

• Running your account and showing what you post: performance of our terms with you.
• Spam and abuse protection: our legitimate interest in keeping the site safe.

Who else processes data

• Our hosting provider (servers in the EU).
• Cloudflare, for DNS, caching, attack protection and the Turnstile anti-bot check on sign-up and posting.

We do not sell data and we do not share it with advertisers.

How long

• Account and posts: until you delete them or your account.
• Ended events and expired LFG posts may be removed from the database over time.
• IP addresses: at most 48 hours.

Your rights

You can see, edit and delete your posts at any time, and you can delete your whole account on the account page. Deleting your account removes all of your data immediately (hard delete). Under GDPR and KVKK you also have the right to access, correct, object, and to complain to your data protection authority (in Turkey: KVKK Kurumu).

Contact

Questions about privacy: [email protected].