Privacy and data protection
Last updated: 19 October 2026
This notice explains how your personal data is processed when you use Ejderha at ejderha.net, under the EU General Data Protection Regulation (GDPR) and the Turkish Personal Data Protection Law (KVKK).
Controller
The controller is Ejderha. For any request about this notice, write to destek@ejderha.net.
What we process
| Data | Purpose | Legal basis |
|---|---|---|
| Email address, display name, password hash | Creating and protecting your account, signing in | Performance of a contract |
| Year of birth | Enforcing the minimum age of 13 | Legal obligation and contract |
| Google account ID (if you sign in with Google) | Letting you sign in with Google | Performance of a contract |
| Session data, browser type, a one-way hash of your IP address | Security, abuse prevention, showing you your devices | Legitimate interest |
| The country derived from your IP address (only Türkiye, Germany, Austria, Switzerland or other) | Opening the site in your language on your first visit. The country is looked up on our server, with an address list that comes with the site or with country data from our hosting provider, and is never sent to another service. Your IP address is not stored or logged for this. It is only used for that one request. Once you pick a language in the language menu, your country is no longer checked. | Legitimate interest |
| Game progress, characters, dice logs | Running the game and preventing cheating | Performance of a contract |
| The days you opened the game (date only) | Seeing in aggregate numbers whether players come back, and improving the game | Legitimate interest |
| Summaries of errors in the game, the screen it happened on, browser type (anonymous, not linked to your account) | Finding and fixing bugs | Legitimate interest |
| Invite relationship (the member who invited you and the people you invited), invites left | Opening accounts by invitation during the closed beta and preventing abuse. The member who invited you sees your display name. | Contract and legitimate interest |
| Feedback text, the screen it was sent from, browser type and screen size | Finding the bug you reported and reviewing your suggestion | Legitimate interest |
| Your friends, the friend requests you send and receive, the people you block and table invites | Showing your friends list, showing your friends whether you are online and inviting them to a table. Your online status is visible only to your friends. A person you block does not see the block. | Performance of contract |
| The display name and year of birth you give when you sit down as a guest, the ready hero you receive and the table you join | Letting you sit at a table without an account and keep your hero if you want. Your display name is visible to the players at the table. Your year of birth is kept only for the age limit and is never shown to anyone. | Performance of contract |
| Tables you schedule (title, description, date and time, language, levels, tone), tables where you reserve a seat and table reports you make | Listing scheduled tables, reserving seats, sending a reminder email one hour before the start and moderating inappropriate content. The title and description of a table you schedule and your display name are visible to signed in players. | Performance of the contract and legitimate interest |
| The turn state of play by post tables, when you were last sent a turn email, and your turn email preference | Emailing you when it is your turn and making sure a table sends you no more than one message an hour. You can turn these emails off on your account page or with the link in every message. | Performance of a contract |
| Narrator templates you share and allow to be published on the site (title, summary, level, length, scene titles and first paragraphs, character names and roles, quest names) | Publishing them publicly on the site's Community adventures page after an admin approves them. Your account name, narrator notes, character notes, the document text and the full scenes are not shown. You can withdraw the permission when you save the template, and any change needs approval again. | Consent |
| Your weekly dungeon scores (rounds and health left), the narrator templates you write and the template reports you file | Showing the weekly ranking, storing your templates and sharing them if you choose, moderating inappropriate content. Your display name is visible to everyone if you are in the top ten of the ranking and on templates you share. Only admins see your reports. | Performance of a contract and legitimate interest |
| Newsletter preference | Sending news, only if you opt in | Consent |
| Visit statistics (Google Analytics 4) | Improving the site, only if you accept cookies | Consent |
Your password is never stored in plain text. It is hashed with Argon2id. Your IP address is never stored in plain form, only as a one-way hash.
Who receives your data
We never sell your data. To run the service we share it, as little as possible, with our hosting provider, our email server, Google if you sign in with Google, and Google Analytics if you accept cookies. When the AI narrator and voice features are enabled, in-game text is sent to Google Gemini and ElevenLabs. Your email address and password are never sent to them.
International transfers
Services such as Google and ElevenLabs may process data outside Türkiye and the EU. These transfers rely on the safeguards required by GDPR and KVKK.
Retention
Account data is kept while your account is open. When you delete your account, your personal data is deleted or anonymised immediately. Security logs are kept for up to 1 year and session records for up to 30 days. The record of days you opened the game is kept for up to 120 days, anonymous error summaries for up to 30 days. Planned tables are deleted, together with their reservations and reports, 30 days after their start time. Table chat is kept for 14 days, but the chat of a running play by post table stays until the table closes (a table closes after 14 days without activity). Guest accounts are deleted together with their hero and table records one day after the session ends, and at the latest after 30 days. If you keep your hero, your account continues as a regular account.
Your rights
You have the right to access, rectify, erase and port your data, and to object to or restrict processing. Use "Download my data" on your account page to get all of your data at once, or "Delete my account" to remove it permanently. For anything else, write to us. You may also complain to your data protection authority.
Children
Ejderha is not for children under 13. We delete accounts that we learn belong to a child under 13.
Security
All connections are encrypted. We recommend turning on two-step verification. Secret keys are stored encrypted in our database.