Privacy Policy
Courtesy translation — the German version is the legally binding one.
Last updated: July 2026
In short
Taro Bay stores only what is needed to run the game — your account and your game progress. There are no tracking cookies, no ads, and no third-party analytics.
1. Controller
Patrick Kis, Dachensteingasse 11, 2700 Wiener Neustadt, Austria, email: hello@tarobay.io
2. Account data
To register, we store your email address, your password — the latter only as a cryptographic hash, never in plain text — and your character name. Sign-in is handled by Supabase Auth. Purpose: providing your game account. Legal basis: Art. 6(1)(b) GDPR (performance of contract). Without these details no account can be created; you are under no statutory obligation to provide them.
3. Game progress
Your progress — character, skills, inventory, market orders, chat messages, activity log — is stored in a Supabase database in the eu-central-1 region (Frankfurt am Main, EU). Purpose: that is the game. Legal basis: Art. 6(1)(b) GDPR. Your character name and chat messages are visible to other players; your email address never is.
4. Hosting and server logs
The website is served via Vercel Inc. (USA). Visiting it produces technical server logs (IP address, timestamp, requested page, user agent), which we use for debugging and abuse prevention. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, stable, abuse-free operation). Logs are deleted automatically after a short period. Data processing agreements pursuant to Art. 28 GDPR are in place with Vercel and Supabase. Where data is transferred to the USA, this is based on the EU–US Data Privacy Framework (EU Commission adequacy decision; Vercel is certified under it), supplemented by EU standard contractual clauses.
5. Contact by email
If you write to hello@tarobay.io, we process your email address and the content of your message to answer your request. The mailbox is hosted with Apple iCloud Mail (Apple Distribution International Ltd., Ireland); where Apple transfers data to the USA, this is safeguarded by EU standard contractual clauses. Legal basis: Art. 6(1)(b) GDPR where your request concerns your account, otherwise Art. 6(1)(f) GDPR (legitimate interest in answering requests). Settled emails are deleted once they no longer need to be kept.
6. Cookies
We use only technically necessary cookies for your login session (Supabase Auth). Such strictly necessary cookies are permitted without consent under § 165(3) of the Austrian Telecommunications Act (TKG 2021). No tracking cookies, no ad networks, no third-party analytics. That is also why there is no cookie banner — there is nothing to consent to.
7. Retention
Your account and game progress are kept for as long as your account exists. To delete them, an informal email to hello@tarobay.io is enough — we then remove your account and game progress without undue delay. Server logs are deleted after a short period regardless.
8. Your rights
You have the right to access, rectification, erasure, restriction of processing, data portability, and objection (Art. 15–21 GDPR). An informal email to hello@tarobay.io is enough. You may also lodge a complaint with the Austrian data protection authority (dsb.gv.at).
No automated decision-making, including profiling, takes place.
9. Contact
Privacy questions: hello@tarobay.io