Privacy Policy

This Privacy Policy explains how Cardboard Cabana LLC, based in Iowa, United States and operator of CardboardCabana, collects, uses, discloses, and retains information. Our initial launch is intended for users in the United States.

Information we collect

• Account profiles, contact details you provide, preferred Games, and linked Discord or Google identities.
• Discord server administration, connection, channel, follow, and delivery information.
• Organizer access applications, manager grants, invitations, content, and source changes.
• Configured delivery destinations and protected authorizations.
• Event and Organizer information obtained from public or configured external sources, including published tournament results, player or team names, standings, matches, and deck links when available.
• Application sessions, audit history, operational logs, errors, and security events.
• Location supplied for searches, including browser location only when you choose to provide it.

How we use information

We use information to authenticate users, authorize server and Organizer management, provide discovery and publishing features, operate integrations, prevent abuse, diagnose failures, communicate about the service, and meet legal obligations.

OAuth and connected accounts

Discord sign-in requests the identify and guilds scopes and does not request Discord email access. Provider access and refresh tokens remain server-side and are not stored in the browser authentication cookie. Disconnecting a provider may not delete delivery, security, or audit records that must be retained.

Google sign-in requests your account identifier, basic profile, and email address. We use this information to sign you in, link your identity to your CardboardCabana account, and populate account details. These sign-in permissions do not provide access to your Gmail messages, Google Drive files, or Google Calendar. We do not receive your Discord or Google password.

Location searches and time display

You can search using a city, state, or postal code. If you choose "Use my location" and grant browser permission, we receive coordinates to find nearby results. Location-based search URLs include those coordinates, so they may appear in your browser history and in links you copy or share. Remove the location filter before sharing a link if you do not want to share those coordinates.

When you explicitly save an event search, we store its filters with your account, including selected coordinates when present. You can remove saved searches and bookmarked events from My saved events. Account deletion removes these saved items.

We record daily aggregate counts of searches, searches with no results, event visits, source-link clicks, and calendar use for up to 90 days. These counts contain no account identifiers, IP addresses, search text, or locations. They do not establish that a visitor registered for an event.

Your browser also supplies its timezone so we can display event times in your local time. This does not require permission to access your device's geographic location.

Cookies and sessions

CardboardCabana uses a secure, HTTP-only authentication cookie and server-side session records. We do not currently use third-party advertising cookies. This policy will be updated before adding analytics or advertising technologies that materially change that practice.

Public information

Active Organizer profiles, events, and content published through enabled discovery features may be visible without signing in. Private server identities and private destination-owner identities are not shown in Organizer analytics.

Public discovery can also include Discord servers whose administrators enable public listing, and published tournament results with player or team names, standings, match records, and deck links. Removing your CardboardCabana account does not automatically remove records supplied independently by an Organizer or event-data provider.

When we share information

We disclose information to connected providers and service processors only as needed to provide the service, maintain infrastructure, comply with law, protect rights and safety, or complete a business transaction subject to appropriate safeguards. Provider categories include enabled identity and publishing integrations, hosting and database infrastructure, external image hosts, and event-data providers.

Some profile pictures and event or Organizer images load from external image hosts. Your browser connects to those hosts to retrieve the images, which can expose your IP address and browser request information to them. Following an external link takes you to a service governed by its own privacy policy.

Retention and deletion

We normally retain your account until you request deletion, unless removal is necessary for security, legal compliance, or enforcement of our Terms. You can request deletion through your account profile. Deletion is reviewed and may require resolving destination, server, or Organizer responsibilities first.

Completing deletion removes profile details and linked identities and revokes account sessions. It does not erase every record associated with past activity. We may retain records needed for security, disputes, audit history, or legal obligations, and records that no longer identify you. The retention of these records depends on their purpose, sensitivity, and applicable requirements.

Your choices and rights

You can review profile information, unlink eligible identities, disconnect destinations, revoke provider access, and request account deletion through available account controls. Additional access, correction, deletion, objection, or portability rights may apply based on your location. Available profile and deletion controls are accessible from your account profile after signing in.

Children's privacy

CardboardCabana accounts are intended only for people who are at least 18 years old and legally able to enter the Terms. Account creation requires a declaration that you meet this requirement. This is self-attestation, not independent age verification; signing in with Discord or Google does not establish that you are an adult.

Security and processing locations

We use administrative, technical, and organizational safeguards appropriate to the information we process, but no system is completely secure. Although our initial launch is intended for United States users, connected providers and infrastructure providers may process information in the United States or other countries where they operate. We do not represent that all processing takes place exclusively within the United States.

Changes to this policy

We may update this policy and will identify the current version and effective date.