1. Who is responsible
Tabor Map is a non-commercial, community-run fan project. The controller for the personal data described here, within the meaning of Art. 4(7) GDPR, is the operator of the Service:
FletcherRenn
Email: info@tabormap.com
For any question about your data, or to exercise any of the rights in Section 8, write to that address.
2. What we collect
Account data. A username, and, depending on how you sign up, either an email address and a password (stored only as a bcrypt hash, never in readable form), or a Discord account. If you register through Discord you do not give us an email address at all, and we do not request one from Discord.
Profile data you choose to add. Avatar image, biography, and any social links you enter. These are shown publicly on your profile.
Discord data, only if you link or sign in with Discord. Your Discord user ID, your Discord display name, and the date you linked. We request only the identify scope. We do not receive your Discord email address, your servers, or your messages, and we do not store any Discord access token. It is used once to read your ID and display name, then discarded.
Content you submit. Map markers and routes, comments, forum threads and posts, live chat messages, private messages, bug reports, appeals, and any images or videos you upload.
Technical data. For each page view we store the path, a timestamp, your account ID if you are logged in, and your IP address in hashed form only (SHA-256). We do not store readable IP addresses in this record.
Moderation data. If moderation action is taken on your account, we store the action, reason, duration and the moderator involved, together with any reports or appeals concerning you.
We do not use analytics or advertising services, we do not build profiles for marketing, and we do not carry out automated decision-making or profiling within the meaning of Art. 22 GDPR.
3. Why we process it, and on what legal basis
| Purpose | Legal basis (Art. 6(1) GDPR) |
|---|---|
| Creating and running your account; showing your content; delivering the features you ask for | (b) performance of a contract |
| Authenticating you and keeping sessions secure | (b) contract, and (f) legitimate interests in account security |
| Moderation, enforcing the Terms, handling reports and appeals | (f) legitimate interests in a safe, lawful community |
| Preventing abuse, spam and attacks; rate limiting; hashed IP records | (f) legitimate interests in the security and integrity of the Service |
| Sending account emails (verification, password reset, data export) | (b) performance of a contract |
| Mirroring your notifications to Discord DMs | (a) your consent (strictly opt-in, withdrawable at any time) |
| Syncing your site role to a Discord role | (a) your consent, given by linking your Discord account |
| Responding to lawful requests and complying with legal duties | (c) legal obligation |
Where we rely on legitimate interests, we have weighed them against your interests and rights. You may object to that processing at any time under Art. 21 GDPR; see Section 8.
4. Cookies
We use only cookies that are strictly necessary to operate the Service. There are no analytics, advertising or tracking cookies, and therefore no consent banner.
| Cookie | Purpose | Lifetime |
|---|---|---|
token | Keeps you signed in | 7 days, or 30 days with "Remember me" |
discord_oauth | Security check during Discord sign-in (prevents cross-site request forgery) | 10 minutes |
discord_signup | Holds an in-progress Discord sign-up until you choose a username | 15 minutes |
All three are set as HttpOnly and Secure, so they cannot be read by scripts and are only sent over HTTPS. Blocking them will prevent you from signing in.
5. Who else sees your data
We do not sell, rent or trade personal data. It is shared only in the following cases.
Our hosting provider operates the server on which the Service and its database run, as a processor on our instructions.
Brevo (Sendinblue GmbH / Brevo SAS, EU) sends our account emails. It receives your email address and the message content. It is only used if you have an email address on your account.
Discord (Discord Inc., United States) is involved only if you sign in with, or link, a Discord account. When you use Discord sign-in, Discord learns that you authenticated to this Service. If you switch on Discord DM notifications, the text of those notifications is sent to Discord so it can deliver the message to you. Transfers to Discord in the United States are covered by the safeguards Discord relies on for European users, including the EU-US Data Privacy Framework and/or Standard Contractual Clauses.
Content delivery networks. Some page assets, namely web fonts and the mapping library, are loaded from third-party networks (Google Fonts, cdnjs/Cloudflare, unpkg, jsDelivr). When your browser fetches them, your IP address and browser details are transmitted to those providers. We are working to serve these files from our own server so this no longer happens.
We may also disclose data where we are legally required to do so, or where it is necessary to establish, exercise or defend legal claims.
6. How long we keep it
| Data | Retention |
|---|---|
| Account and profile data | Until you ask us to erase it (see Section 8) |
| Page-view records (hashed IP, path, time) | Automatically deleted after 90 days |
| Generated data-export files | Automatically deleted after 7 days |
| Discord link codes | 10 minutes |
| Session cookies | 7 or 30 days, then expire |
| Moderation records | Kept while needed to run the community fairly and to handle appeals |
| Content you submitted | See below |
What erasure actually does. If you ask us to erase your account, we delete your account and the personal data attached to it: your username, email address, password, avatar, biography, social links, Discord link, notification settings, private messages, saved routes and personal markers.
What you posted publicly stays. Markers, routes, comments, forum posts and chat messages remain on the Service, but your name is removed from them so they no longer identify you. This is how a collaborative community resource stays usable and readable when one contributor leaves. Deleting one person's posts would tear holes in conversations other people took part in. It also reflects the grant in Section 6 of the Terms of Service.
If you believe a specific contribution should be removed as well, for example because it contains personal information about you in its text, say so in your request and we will remove it.
7. Security
We protect your data with HTTPS for all traffic, bcrypt password hashing, HttpOnly and Secure session cookies with expiry and server-side revocation, input validation and sanitisation, rate limiting on sensitive endpoints, hashed rather than readable IP records, and prompt application of security updates. Access to the database is restricted to the operator.
No online service can be completely secure. If you find a vulnerability, please report it privately to info@tabormap.com.
8. Your rights
Under the GDPR you have the right to:
- Access your data and receive a copy (Art. 15)
- Rectify inaccurate or incomplete data (Art. 16)
- Erasure of your data (Art. 17)
- Restrict processing in certain circumstances (Art. 18)
- Data portability: receive your data in a structured, machine-readable format (Art. 20)
- Object to processing based on legitimate interests (Art. 21)
- Withdraw consent at any time, without affecting processing already carried out (Art. 7(3))
Things you can do yourself, right now: download a complete copy of your data from Settings → Your Data; correct your profile, username and social links in Settings; turn Discord DM notifications on or off, or unlink Discord entirely, in Settings → Discord.
To erase your account, email info@tabormap.com from the address on your account, or, if you signed up with Discord and have no email, send the request from your linked Discord account. We will action it without undue delay and in any event within one month.
Right to complain. You may lodge a complaint with a data protection supervisory authority, in particular in the EU member state where you live or work, or where you believe the GDPR has been infringed (Art. 77 GDPR). You do not have to contact us first, though we would rather you did so we can put it right.
9. Children and young people
You must be at least 13 to create an account. We do not knowingly collect data from anyone younger; if you believe a child under 13 has registered, contact us and we will remove the account.
Running your account and showing your contributions rests on the contract between us (Art. 6(1)(b) GDPR), not on consent, so it does not depend on the age limit in Art. 8 GDPR. The optional features that do rest on consent (Discord DM notifications and Discord role syncing) require you to be at least 16 in Germany, or to have a parent or guardian's authorisation. Those features are off unless you deliberately switch them on.
If you are under 18, please make sure a parent or guardian has agreed to the Terms of Service on your behalf.
10. Changes to this policy
We may update this policy as the Service changes. Material changes will be announced on the Service. The date at the top of this page always shows the current version.
11. Contact
Data protection contact: FletcherRenn
Email: info@tabormap.com
We have not appointed a Data Protection Officer, as we are not required to do so under Art. 37 GDPR.