Privacy policy

Updated 18 October 2026. Kobold Taskmaster is a community project operated by Regin Glob. To ask about your information, request a copy, correction or deletion, use Contact admin.

Your membership

We store your username, player name, membership dates, account preferences, acceptance of community rules and security-update acknowledgements. Passwords and private recovery codes are stored as salted hashes. Session tokens are stored as hashes. Your mother’s name is no longer collected or used for recovery; its previous hash is replaced when you upgrade your account.

Account data and private decks are processed to provide the membership and saving features you request. Security controls and moderation protect the service and its users. These purposes use contractual necessity or legitimate interests as applicable; optional public listing and broadcasts follow your choices.

Decks and public information

Old School decks saved while signed in are stored privately in your account, including custom card images. Deck tools used without signing in and the Commander builder store decks on your device. Existing device decks are imported only when you choose to import them. Sharing a deck or image makes that content available to its recipients.

You can choose whether your username appears on the public player list and completed tournament results, including the Home Top 4. When public visibility is turned off, public tournament results show “Private player” in your place. Your player name and game data are visible to participants at your table. Streamed match results and prize history may remain with personal identifiers removed after account deletion.

Cameras and Twitch

LiveKit handles the audio and video connection. Twitch receives broadcasts when the stream is started with the required player approval. Viewers may record or share a broadcast; Twitch recordings are managed separately and are not automatically removed by deleting your membership. “Hide preview only” does not stop transmission. Use “Stop sending cameras” or leave the room to stop sending your camera. A Twitch stream has a delay, so pictures sent before stopping may appear briefly afterwards.

Hosting and other services

The service uses OpenAI Sites and Cloudflare for hosting, its account database and deck storage, LiveKit for audio/video, Twitch for streaming, and Scryfall for card information and images. These providers receive information needed for their services, such as connection information. Providers may process information outside the EEA; their locations, transfer arrangements and retention depend on their services. Contact us for information about the arrangements relevant to your data.

Security and retention

Essential cookies keep you signed in. Browser storage holds device decks, drafts and preferences. Hashed network identifiers and attempt counters limit login and registration abuse; the counters expire after their rate-limit window and are cleaned up periodically. Messages you send to admin include the name, message and optional reply address you provide and remain until reviewed and deleted. Memberships inactive for two years are removed when the membership cleanup runs. You can delete your membership from the membership page; this removes sessions, private account decks and the personal records covered by that deletion. Provider backups and previously published content may have separate retention.

Your rights

You may request access, correction, deletion, restriction, portability where applicable, or object to processing based on legitimate interests. You may withdraw optional permissions for future public listing or broadcasting. Withdrawal does not undo earlier processing. You may complain to the Danish Data Protection Agency, Datatilsynet. We may need to verify that an account belongs to you before disclosing data or changing access.