Dracoteca

Who answers for your data

The data controller has not been named yet. Until it is, this notice is incomplete and nobody should sign up: it is the organisation the law holds accountable for your data.

In two lines

Dracoteca collects the minimum needed to run what you ask for: your email address to let you in, the name you choose, and the things you do in the app — your notes, your games, the groups you belong to.

We sell nothing to anyone, there are no ads, and there is no system tracking you to work out who you are. You can delete your account yourself, whenever you like, and it really does go.

Who processes your data

The data controller is the organisation named above: it is who answers for your data before the law, and who you write to if something is wrong.

What we collect

To let you in: your email address. If you sign in with Google, we receive your address, name and profile picture from Google — nothing else, and we have no access to your mail, files or calendar.

Why there is no password: we neither ask for one nor keep one. You get in with a link sent to your inbox, or with Google. A password that does not exist cannot be stolen.

What you write: the name you want to go by, your notes on games, your ratings, your collection, your social handles if you choose to add them, the race you pick and the quiz result if you take it.

What use produces: which groups you belong to and in what role, which boxes you have on loan, which tables you sit at, which evenings you were on duty or present at.

What we do NOT collect: your location, your contacts, your exact age, your purchases, any health data, any advertising profiling. There are no third-party analytics inside the app.

Why, and on what legal basis

To give you the service you asked for — signing in, having a profile, writing notes, booking a table, borrowing a game: the legal basis is the contract (art. 6.1.b GDPR). Without this data the app cannot work.

To keep the association's records — who has which box on loan, who was present at an evening: the legal basis is the association's legitimate interest (art. 6.1.f) in knowing where its things are and who took part in its activities.

For what you choose to show publicly — your collection, your association, the quiz result: the legal basis is your consent (art. 6.1.a). Everything starts off: you turn on what you want, and you can turn it off again.

We do not process your data for marketing and do not use it to build commercial profiles. The race quiz result is neither sold nor passed to anyone.

The messages you exchange with others

You can write only to someone who accepted your friendship, and only if you accepted theirs. There is no way at all to receive messages from strangers.

Messages are read by the two of you only. We do not read them, they go into no statistics, and we train no system on them.

We do not tell the other person whether you have read, and we show nobody when you were last online. Knowing someone read and did not reply is a small pressure that serves no purpose, and «online now» says where you are right now.

If you report a message, the report carries a copy of the text — so it survives even if the sender deletes it — and moderators read it. The reported person is not notified.

If you block someone, they can no longer write to you or request your friendship. They are told nothing.

When you delete your account, the messages you wrote are gone. Those the other person wrote stay with them: they are their words, and deleting them would be deciding on their behalf.

If you book an evening without signing up

You can book an open evening without creating any account. In that case we collect your name, your email address, your phone if you write it, and whatever you tell us in the notes field, which is free text: it is for saying you will arrive late, that you need an accessible table, that it is your first time. We do not ask for information about your health and we ask you not to write any: if you write it anyway, it ends up in there and follows the same fate as everything else.

What they are for: the name and notes go to whoever runs the evening, to prepare it; the email address only to send you the link for seeing or cancelling your booking. We do not sign you up to anything and we do not write to you otherwise.

Consent for photographs is separate and genuinely optional: say no and you still get your place, and nobody asks why.

If you cancel, all we keep of that booking is your name and the fact that a cancellation happened — so the organisers know a place has freed up. Address, phone and notes are deleted straight away: they are no longer needed.

Of your network connection we keep no number, only a fingerprint that cannot be turned back into the original address. It is there solely to spot someone filling tables as a joke.

Bookings are seen only by whoever runs that evening, not by all group members and not by other registered users.

Who sees it

Other members see only what you have chosen to make public on your profile. Everything starts off.

Your group sees what concerns the group: that you belong to it, your open loans, duties and attendance at its evenings. People outside the group do not see it, even if they are Dracoteca members.

People who have not signed in see only the public pages: the game catalogue, and whatever groups have chosen to show.

Outside Dracoteca, your data goes only to what is technically needed to run it: the service that sends the sign-in emails, and Google if you choose to sign in with Google. Nobody else. There are no advertisers.

Where it lives, and for how long

The data sits on servers in Europe. Sign-in emails go through a service with servers in Ireland.

We keep it while your account exists. When you delete it, it goes — see the section below for exactly what happens.

There is one exception, and we say it plainly: if you delete your account while holding an association's box on loan, the loan stays recorded under your name until the box comes back. The association has to know who has its things.

Deleting your account

You do it yourself, from your den, without writing to anyone and without giving reasons.

Gone: your profile, your public page, your collection, your notes (including guild-shared ones: they are your words), your ratings, your friendships, your account and open sessions.

Stays without you: your departure from groups, the roster slots you covered go back to uncovered, and boxes of yours kept at a venue return to the group.

One case where we ask you to wait: if you are the only owner of a group, you must hand it over first, otherwise the group would be left with nobody in charge. We tell you beforehand, with the group's name.

Deletion cannot be undone. All that remains recorded is that it happened and when — not your data: it is there to prove we did it.

Your rights

You can ask to know what data we hold about you, to correct it, to erase it, to restrict its use, to receive it as a file to take elsewhere, and to object to processing based on legitimate interest.

Some of these you do yourself in the app: change your details in settings, delete your account from your den. For the rest, write to the controller at the address above.

If you think we are getting it wrong you can turn to the Italian data protection authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it), or to a court.

Minors

To sign up on your own you must be at least fourteen: that is the age Italian law sets for giving consent to online services on your own (D.Lgs. 101/2018).

Accounts for younger children, created and supervised by a parent or guardian, are planned but not built yet. Until they exist, under-fourteens do not sign up.

Profiles of minors never show social links, nor the association or guild they belong to: telling a stranger which association a child belongs to means telling them where to find that child on a Thursday evening.

Cookies

We use only technical cookies, the ones without which the app does not work: one that remembers you signed in, and one that remembers which language you read in.

There are no profiling cookies, no third-party cookies, and no banner to dismiss. The law does not require consent for technical cookies, which is why we do not ask for it.

If this notice changes

Every version carries a date. If we change something substantial — what we do with your data, not a comma — the date changes and at your next sign-in we show you the text again and ask you to accept it afresh.

Which version you accepted, and when, stays recorded. It is there for you, to know what you said yes to, and for us, to prove it.