Privacy at HeavyHaven

Your public clubhouse activity

Your chosen display name, RSVPs, event details, discussions, game results and statistics are visible to visitors. Event locations and notes are public too: only include information you want others to see. A Google email address and internal sign-in identifiers are not included in the public player records.

Collections and event photos

Game ownership is public. Uploaded collection details remain visible only to the uploader and club owner until approved; original spreadsheet files are not stored. Hosts can upload public event photos and captions, including after a night is archived. The browser resizes photos and removes original embedded metadata before upload. The host can remove photos from the event.

Google sign-in

Google sign-in requests basic identity permissions: openid, email and profile. Google may return your account identifier, verified email and basic profile information. HeavyHaven uses your account identifier and verified email to authenticate you, keep your player history connected to your account, and check host or clubhouse-owner permissions. You choose your public display name separately.

The application stores your Google account identifier with your player identity and your identifier and email in its private session records. It does not retain Google's access tokens, refresh tokens, profile photograph or Google display name. It does not request access to Gmail, Drive, contacts or calendar data. Google sign-in information is not sold or used for advertising.

Storage, cookies and providers

Cloudflare hosts the application and its D1 database in the owner's account. Google processes the sign-in request. BoardGameGeek supplies game information when its integration is enabled; game searches are sent to BoardGameGeek and cached. Loading externally hosted game images may send your IP address to their image provider.

Essential cookies remember a guest identity for up to one year, a signed-in session for seven days, and an in-progress sign-in for ten minutes. Session tokens are stored as hashes on the server. Signing out revokes the current signed-in session. The app also uses short-lived request information to limit abuse. Hosting providers may process ordinary connection information, including IP addresses, to deliver and protect the service.

Your English or Arabic preference is remembered on this browser using local storage and a language cookie that lasts up to one year. It only controls the interface language, not the language of your posts or your player identity.

History and your choices

Clubhouse records are retained to preserve the group's game history until corrected or removed. Expired sign-in records are no longer accepted and are cleaned up when a new sign-in begins. You can change your display name, sign out, clear the site's cookies and local storage, or remove HeavyHaven's access through your Google Account settings. Removing Google access does not automatically delete existing clubhouse history.