Privacy Policy

1. Who We Are

MEKASMITH is the business operator responsible for personal information handled through the Service under Japan's Act on the Protection of Personal Information, and the data controller where that concept applies to you.

2. Scope

This Privacy Policy applies to Taverns, Wonders of Aether, Wonders Studio, related websites, community features, account services, developer tools, and any user-generated content ("UGC") features we provide.

It does not cover the independent activities of other users. Tavern owners, moderators, creators of Wonders, and developers of bots decide how they use the information they can see on the Service, as described in Section 6, and third-party services you connect follow their own privacy policies.

3. Information We Collect

We collect only the information reasonably necessary to operate, secure, support, and improve the Service.

A. Information You Provide

We may collect:

• your email address;
• your login and account credentials or authentication-related information;
• your username, display name, avatar, banner, bio, and other profile information;
• your date of birth and resulting age-verification status when you choose to verify eligibility for Mature Content;
• messages you send to support;
• reports, complaints, appeals, or moderation submissions, including any content you attach to them;
• content, Taverns, halls, Wonders, bots, uploads, chats, posts, comments, reactions, or other UGC you choose to submit.

B. Information Collected Automatically

When you use the Service, we may automatically collect limited technical and usage information, such as:

• IP address and the approximate country or region derived from it;
• device type, operating system, app version, language, and region;
• login timestamps, active sessions, and basic account activity;
• product interactions, app lifecycle events, and feature usage;
• push-notification token and delivery status when notifications are enabled;
• crash data, error logs, diagnostics, performance data, and security logs;
• moderation signals, such as filter matches, report counts, and enforcement history.

Crash and performance diagnostics are limited: Sentry is configured not to attach default account PII, and Taverns does not record session replay.

C. Information From Device Features

If you choose to use voice, video, camera, photo, screen-broadcast, or notification features, the Service processes the content or device identifiers needed to provide that feature. We request system permission before accessing protected device features. You can change those permissions in device settings, and the app continues to work without the optional ones.

D. Information From Other Users and Services

Other users may post content that includes you, mention you, invite you, or report you. If you sign in with Apple, Google, or another provider, that provider sends us the identifiers and profile details you allow it to share; if you use Apple's Hide My Email, we receive a relay address. If you connect an external account, such as Twitch, YouTube, or Spotify, we receive the account information needed for the feature you enabled.

E. Payment Information

If paid features are offered, payment transactions may be processed by platform providers or payment processors. We do not store full payment card information ourselves unless expressly stated.

4. How We Use Your Information

We use personal information to:

• create and manage your account;
• let you log in and use the platform;
• operate, maintain, and secure the Service;
• deliver your messages, posts, voice, and other content to the people you share it with;
• provide customer support and respond to your requests;
• review reports, moderate UGC, run automated content and profanity filtering, enforce our Terms and Community Guidelines, and keep records of enforcement actions and appeals;
• determine age eligibility and enforce default-hidden Mature Content controls;
• detect and prevent fraud, abuse, spam, security incidents, and unlawful activity;
• send service notices and, only with your consent, marketing notifications;
• comply with legal obligations and respond to lawful requests;
• improve platform stability, safety, and performance.

We primarily use your email address for account login, account security, and account-related support.

Where data-protection law requires a legal basis, we rely on the performance of our contract with you (providing the Service you signed up for), our legitimate interests (keeping the Service safe, secure, and working, and enforcing our rules), your consent (optional analytics, marketing notifications, device permissions, and age verification), and compliance with legal obligations.

Product analytics can be disabled from Privacy settings in the Taverns app or from tav.gg/privacy-choices without signing in. Operational security, abuse-prevention, and crash diagnostics may still be processed when necessary to provide and protect the Service.

5. How We Share Information

We do not sell your personal information and we do not share user information with unrelated third parties for their own marketing purposes.

We may disclose information only in the following limited situations:

• to other users, as described in Section 6, when you post content, join a Tavern, play a Wonder, or interact with someone;
• to service providers that help us operate the Service, such as hosting, infrastructure, authentication, security, customer support, moderation, and technical operations;
• when required by law, regulation, court order, or lawful government request, including requests under Japan's Information Distribution Platform Act;
• to protect our rights, users, community safety, or the integrity of the Service, including reporting child-safety matters to the appropriate authorities;
• in connection with a merger, acquisition, financing, or sale of assets, subject to appropriate safeguards.

Service providers used by Taverns include:

• Amazon Web Services for hosting, storage, delivery, and infrastructure;
• Google Firebase for authentication and related account services;
• PostHog for product analytics and app-usage measurement;
• Sentry for limited crash reporting, diagnostics, and performance monitoring;
• OneSignal for push-notification delivery;
• LiveKit for real-time voice and video features;
• Apple, Google, and Meta when you choose their sign-in services.

These providers process information on our behalf under contracts that require them to protect it. Any third party we share user data with must provide the same or equal protection of that data as described in this Privacy Policy and required by the platforms we distribute through. The providers used for a particular session depend on the features you choose.

6. Communities, Creators, Bots, and What Other Users Can See

Taverns is a social platform. Content you submit to public or shared areas of the Service is visible to other users according to the audience you chose and the settings of the space you posted in:

• Your username, display name, avatar, profile, and public activity are visible to other users, subject to your Privacy settings.
• When you join a Tavern, its owner, moderators, and members can see that you are a member, along with your roles, join date, and the content you post there. Owners and moderators can also see moderation information about your activity in that Tavern, such as rule agreements, mutes, kicks, and bans.
• Content you post in a Tavern remains there after you leave, until it is deleted by you, by a moderator, or by us, or until your account is deleted.
• When you play a Wonder, its creator may see your username and your in-experience activity and progress inside that Wonder.
• When you or a Tavern owner installs a bot or integration, the bot's developer receives the data the bot's permissions allow, such as the messages and member information in the halls it can read.
• Direct messages are visible to the people in the conversation. We may review them when they are reported or when we reasonably believe it is necessary for safety or legal compliance.

Tavern owners, moderators, creators, and bot developers are independent from MEKASMITH. They are responsible for how they use the information they can see, for complying with the laws that apply to them, and for their own bots and integrations. We require them to use the information only to run their community, Wonder, or bot, but we do not control their independent processing.

We may review, moderate, restrict, or remove UGC that violates our Terms, Community Guidelines, applicable law, or platform requirements. To report illegal, unlawful, infringing, harmful, or abusive content, use the Report action next to it or contact report@tav.gg.

7. Moderation, Safety, and Legal Requests

To keep the Service safe we process content, reports, account history, and technical signals with automated systems, including a profanity and objectionable-content filter, together with human review. When you submit a report we keep the report, the reported content, and our decision so that we can act on it, respond to an appeal, and detect repeat abuse. The identity of a reporter is not shared with the person they reported.

We may preserve and disclose content and account information where we believe in good faith that it is necessary to comply with the law or a lawful request, to enforce our Terms, to respond to a claim that content violates someone's rights, or to protect the rights, property, or safety of MEKASMITH, our users, or the public. Where the law requires it, we notify the person whose content was removed and explain how to appeal.

8. International Users

MEKASMITH is based in Japan. If you use the Service from outside Japan, you understand that your information may be processed in Japan and in other countries where our service providers operate, subject to reasonable safeguards and applicable law, including contractual protections where a country's law requires them for international transfers.

9. Data Retention

We keep personal information only for as long as reasonably necessary for:

• account administration;
• operation of the Service;
• moderation and security;
• legal, compliance, dispute-resolution, and recordkeeping purposes.

We may retain limited data where necessary for fraud prevention, security, legal compliance, enforcement of our Terms, or protection of users and the Service. Enforcement records may be kept after an account is deleted so that a banned user cannot simply return.

If you choose age verification, we retain your date of birth and resulting verification status as account data while needed to operate and enforce age-restricted settings. These records are handled under the account-deletion and lawful-retention practices described here.

10. Account Deletion and Data Requests

You may request deletion of your account and associated personal data in the following ways:

• through the Taverns app deletion function, if available to your account; or
• by contacting support@tav.gg; or
• through Account Settings on the website at: https://tav.gg/app/settings?tab=profile

You may choose immediate deletion or a scheduled request with a 14-day cancellation window. Apple-linked accounts are immediate-only. Once deletion becomes eligible, completion is expected within seven days and remains visible through the deletion status receipt even if email is unavailable.

A completed request removes the account's sign-in identity, profile, messages, connections, creator content, uploads, notification and search records, and analytics identity. We retain only narrowly scoped detached records where necessary to protect another user's entitlement, meet accounting or legal duties, enforce fraud and safety controls, honor consent or contact-suppression choices, or safely govern backups and legal holds.

If you own a Tavern when you delete your account, ownership may be transferred to a moderator, or the Tavern may be archived or deleted, as described in our Terms.

11. Your Rights and Choices

Depending on your location and applicable law, you may have the right to request:

• access to personal information we hold about you;
• correction of inaccurate information;
• deletion of your information;
• restriction or objection to certain processing;
• portability of certain information;
• withdrawal of consent, where processing is based on consent.

You can exercise many of these choices yourself:

• turn product analytics off in Privacy settings or at tav.gg/privacy-choices;
• turn push notifications off in the app or in your device settings, and unsubscribe from marketing email with the link in any message;
• change camera, microphone, photo, and notification permissions in your device settings;
• control who can message you, send friend requests, or see your activity in Privacy settings;
• review active sessions, disconnect linked accounts, export your data, and delete your account in Security and account settings.

For anything else, contact support@tav.gg. We may need to verify your identity before processing certain requests. If you are in a region with a data-protection authority, you may also lodge a complaint with it.

12. Security

We take reasonable administrative, technical, and organizational measures to protect personal information against unauthorized access, loss, misuse, alteration, or disclosure. However, no system is completely secure.

13. Children

The Service is not intended for children under 13, or under the minimum age required by applicable law to use the Service without parental or guardian consent, and we do not knowingly collect personal information from them. If we learn that a child under that age has created an account, we will delete it.

If you believe a child has provided us personal information in violation of applicable law, please contact us at: support@tav.gg

14. Third-Party Services

The Service may interact with app stores, identity providers, linked accounts, embedded media, bots, or other services you choose to use. Those third parties may receive information directly from you and process it under their own privacy policies. We do not control a third party's independent processing.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. If we make material changes, we will post the updated version, change the Effective Date above, and, where the change is significant, notify you through the Service or by email.

16. Contact Us

If you have any privacy questions, complaints, or requests, contact: