Privacy policy

The Cantina Network ("TCN", "we", "us") is an informal, non-commercial online gaming community operated from the Netherlands. People from around the world may join and use our community services.

The controller responsible for the processing described in this policy is the community operating under the name The Cantina Network:

The Cantina Network community
Operated from: The Netherlands
Privacy contact: info@the-cantina.net

This policy covers TCN-operated services, including:

• www.the-cantina.net, including member sign-in, the gallery, member screenshot uploads and the public event schedule;
• the TCN Season Roster at roster.the-cantina.net;
• TCN Accounts and the TCN sign-in service used by these websites;
• the TCN Anniversary website and its contact and contribution flows, while that website remains online;
• The Cantina Chat at chat.the-cantina.net;
• TCN-managed Discord and TeamSpeak spaces;
• TCN email and community-administration systems;
• moderation and safety tools, including Sentinel; and
• the Discord-The Cantina Chat synchronization and management bot, when that service is enabled.

Third-party services such as Discord, Stripe and Cloudflare also process data under their own privacy notices. This policy describes TCN's role and does not replace those third-party notices.

The data depends on the service you use.

Accounts, profiles and community membership

We may process platform account identifiers, usernames, display names, nicknames, avatars, email addresses used for registration or verification, community and channel memberships, roles, permissions, account-link status, status information and recent activity.

The main website is managed with a content-management system (CMS). A small number of administrators, officers and editors have CMS access. The website does not offer public comments.

Website sign-in, gallery and officer lists

Sign-in. When you sign in to the website with your Cantina account, the TCN sign-in service tells the website who you are. The website receives your account identifier, your Discord user identifier, display name and avatar, whether you are a verified member, and which community groups you belong to. It uses this to show your account menu and to decide which gallery categories you may post to. The website never receives your password.

Gallery uploads. When you add a screenshot, we store the image, the category you chose, your optional caption, your account and the upload time. We remove embedded file metadata, such as camera details and location, before an image is published. Officers can hide or remove an upload; we record which officer did so, when, and the reason they gave. Published screenshots and captions can be seen by anyone who visits the website, together with the display name of the member who added them.

Officer lists. The guild pages show who the officers are, so visitors know whom to talk to. They list the Discord display name and Discord avatar of members who hold a guild's officer role in the TCN Discord server. The list is updated automatically from Discord.

Event schedule. The home page shows upcoming raid and game nights from the Season Roster: the date, name and start time only, without participant names.

The optional TCN Bot World of Warcraft guild-verification feature lets a Discord member authenticate directly with Battle.net. During verification we receive the member's authorized World of Warcraft Retail character list, including character identifiers, names and realms, and compare it with the public roster of the configured guild. We retain the Discord account, server and role identifiers, the matching character identifiers, names and realms, verification and roster-check timestamps, role-assignment state, and whether the bot assigned the role. The Battle.net user access token is used only for the verification callback and is not retained.

Content and communications

We process messages, edits, deletions, replies, reactions, attachments and attachment metadata, voice-session participation, moderation reports, contact-form messages, support and privacy requests, and other content you choose to submit to a TCN service or community space.

TCN does not record TeamSpeak voice. The current TeamSpeak service is a temporary community setup. The Discord-The Cantina Chat bot's cross-platform voice relay is also disabled.

Community administration and safety

We may process role and permission changes, bans and timeouts, exempt-user settings, security and moderation events, review decisions, consent choices, administrative audit metadata and service-health information.

Sentinel receives Discord guild, member, message and AutoMod events needed to detect configured trap-role mentions and enforce the guild's anti-spam rules. It stores identifiers, timestamps, policy/configuration state, evidence state and enforcement outcomes. It does not persist message bodies as detection evidence. Its operational logs may contain guild, user and resource identifiers, account age, enforcement reason and delivery outcome. Relevant events may also be posted to a configured Discord moderation-log channel.

Automated tools can flag or enforce clear configured rules. You may ask for human review of a moderation decision by contacting us.

Technical and security data

Ordinary operation may produce IP addresses, request times, requested hosts and paths, browser or client information, session identifiers, gateway and connection metadata, rate-limit information, error codes, mail-routing metadata and security logs.

Our self-hosted mail system processes mailbox contents and delivery metadata. Mail logs may include sender and recipient addresses, connection IP and client details, authenticated account name, queue identifiers, delivery status and anti-abuse results such as SPF, DKIM or policy checks.

The synchronization bot removes query strings from request logs and redacts OAuth codes, state values, authorization headers and cookies.

Anniversary contact and contribution data

The Anniversary contact form asks for a name, email address and message. Its normal JavaScript flow sends the message to our server, which delivers it directly to a TCN mailbox. We do not use contact submissions for advertising, profiling or a CRM.

For a contribution, our server sends the selected amount to Stripe to create a Stripe-hosted Checkout session. Stripe collects the payment details. TCN may receive the contribution amount, transaction or Checkout identifier and status, and information needed for event reconciliation, refunds, disputes, fraud prevention or legally required records. TCN does not receive full payment-card details through the ordinary Checkout integration. The public participant statistic is an aggregate count.

Sensitive information in free-form content

TCN does not ask you to include special-category or otherwise sensitive personal data in messages, uploads or contact forms. If you include it, the people who can access that community space or mailbox may see it. Do not share information you do not want those recipients to receive.

We obtain data:

• directly from you when you create an account, sign in, upload a screenshot, post content, contact us, contribute, link accounts or change a consent choice;
• from the TCN sign-in service and TCN Accounts when you sign in to a TCN website;
• from Discord, The Cantina Chat, TeamSpeak, Stripe or another service when you use an integration or TCN-managed community space;
• from Blizzard Entertainment when you choose Battle.net-authenticated World of Warcraft guild verification, and from Blizzard's public guild roster; and
• automatically through ordinary website, application, mail, security and network operation.

For the synchronization bot, source data comes from the Discord and The Cantina Chat communities in which the bot is installed and configured.

We process personal data to:

• provide, secure, maintain and troubleshoot TCN services;
• administer accounts, memberships, roles, community content and events;
• deliver contact messages to the TCN mailbox and respond to them;
• let verified members share screenshots in the gallery, and let officers moderate uploads and act on misuse;
• show visitors who the guild officers are and when the next events are;
• provide the Stripe-hosted contribution flow and reconcile contributions;
• verify, assign and maintain an optional Discord role for members who prove ownership of a World of Warcraft Retail character on the configured guild roster;
• operate optional account linking and cross-platform synchronization;
• synchronize configured channels, roles, permissions, moderation state and informational presence where those features are enabled;
• prevent abuse, enforce community rules, protect users and infrastructure, and keep proportionate accountability records;
• respond to support, privacy and lawful requests; and
• keep records where Dutch or other applicable law requires them.

We do not sell personal data. We do not use personal data for advertising or a CRM. The synchronization bot contains no advertising, product analytics, third-party telemetry or crash-reporting destination. Our live-observed public websites did not load advertising or analytics trackers at the date above.

Text synchronization is currently enabled for selected channels in TCN's test Discord and The Cantina Chat communities. The following terms apply while it is enabled. Voice, role, nickname, ban and presence synchronization remain disabled.

Text synchronization and identity labels

The bot receives configured Discord and The Cantina Chat gateway events so it can decide whether they are eligible for synchronization. Normalized events may be held temporarily in an encrypted queue before the consent decision is applied. Consent controls delivery to the other platform; it does not prevent the limited initial processing needed to receive the event, enforce your choice, prevent loops, and discard or deliver it safely.

Text is sent to the other platform only after the required text-relay consent exists. A synchronized message may show your display name, avatar and a source label such as "Discord" or "TCN Chat". Members who could not see the source channel may therefore receive the synchronized copy if they can access the mapped destination channel.

Message identifiers, channel mappings, revisions, timestamps and a one-way content fingerprint may be retained to synchronize edits and deletions and to prevent duplicate or looping messages. Deleting a mapped message is intended to delete its mapped copies too, subject to platform availability and API behaviour.

Attachments

Attachment metadata and source links may be synchronized. Byte transfer is disabled unless TCN configures an exact approved HTTPS source-host allowlist and size limit. When enabled, bounded attachment bytes are held transiently in process memory for transfer and are not written to a durable local bot file. Discord and The Cantina Chat then store the delivered copy under their respective service behaviour.

Account linking, roles and presence

Account linking is optional. The bot stores a one-way digest of each short-lived link code rather than the displayed code. Once verified, it stores the paired platform account identifiers. Unlinking stops use of the pairing but is not by itself a request to erase every historical record.

Configured role, permission, membership, ban, nickname or informational presence data may be synchronized only when the corresponding feature is enabled. Role-derived administrative access fails closed when membership data is stale or unavailable.

Voice

Cross-platform voice relay is disabled. It will not be enabled without a separate acceptance review, prominent disclosure and voice-specific consent. If introduced, the bot is designed for live-only audio: it will not record, durably store, transcribe, analyse, clone or use audio for training. A relay would terminate each platform's transport-encryption boundary and could not reproduce every listener's native cross-platform block or mute relationship. These limitations would be shown to participants before activation.

Where the GDPR applies, we rely on one or more of these legal bases:

• Consent: for optional cross-platform text relay, optional account linking, any future voice relay, and non-essential cookies or similar technologies where required. You may withdraw consent at any time.
• Steps requested by you or performance of an agreement: where processing is necessary to provide an account, website sign-in, a screenshot upload, contribution flow, optional Battle.net guild verification or other service you specifically request.
• Legitimate interests: to operate this informal community, publish and maintain community information (including the officer lists and event schedule), moderate uploaded content, deliver requested contact messages, secure services, prevent abuse, investigate faults, enforce rules and keep narrowly scoped accountability records. We balance those interests against your rights and interests.
• Legal obligation: where we must keep financial records or respond to a legally binding request.
• Legal claims: where data is necessary to establish, exercise or defend a legal claim.

Withdrawal of consent does not affect processing that was lawful before the withdrawal. A different legal basis may still permit limited processing, for example to keep a suppression record or handle a dispute.

Personal data may be received by:

• anyone who visits the website, for published gallery screenshots, captions, uploader display names and the officer lists;
• members and administrators of the community space in which content is posted or synchronized;
• Discord when you use Discord, Sentinel processes a Discord event, or content is synchronized to Discord;
• TCN's self-hosted website, CMS, sign-in, The Cantina Chat, TeamSpeak, mail and infrastructure systems where needed to provide those services;
• Stripe when you use the Stripe-hosted contribution flow. Stripe processes payment data under its applicable processor and independent-controller roles, including its own security, fraud-prevention and legal-compliance purposes;
• Cloudflare when it provides DNS, reverse-proxy, security or Turnstile services;
• Blizzard Entertainment when you authenticate with Battle.net and when the bot retrieves authorized character and public guild-roster data;
• Google Fonts, jsDelivr, Figma and Unsplash when a page of the Anniversary website loads an asset directly from those services; those services receive ordinary request data such as your IP address and browser request details. The main website serves its own fonts and images;
• YouTube (Google) when you press play on a video on a guild page. Some pages can show YouTube videos. Nothing is loaded from YouTube until you press play; the video then plays through YouTube's privacy-enhanced player (youtube-nocookie.com), under YouTube's own privacy policy;
• TCN's infrastructure-hosting and backup providers where needed to operate or protect a service; and
• authorities or other recipients where disclosure is legally required or necessary to protect legal rights.

TCN administrators receive access only where needed for operations, moderation, security, support or legal compliance.

Relevant third-party notices include:

• Discord privacy notice
• Stripe privacy notice
• Cloudflare privacy notice
• Blizzard Entertainment privacy notice
• Google privacy notice
• jsDelivr privacy notice
• Figma privacy notice
• Unsplash privacy notice

TCN remains responsible for deciding to offer the contribution flow, what TCN asks Stripe to process and how TCN uses the transaction information it receives. Stripe's precise role depends on the activity and its terms.

TCN is operated from the Netherlands, but our community is worldwide and some providers process data outside the European Economic Area. This can include Discord, Blizzard Entertainment, Stripe, Cloudflare, YouTube and external asset providers.

Their privacy notices describe their processing locations and transfer mechanisms. Where TCN is responsible for a restricted international transfer, we use an applicable safeguard, such as an adequacy decision or approved contractual clauses, and assess additional safeguards where required.

When you deliberately post in a worldwide community space, other community members may view that content from their own countries. Do not post content that you do not want those members to receive.

We keep personal data only as long as needed for the purpose described below, security, disputes and applicable legal obligations. We delete or anonymize it when it is no longer needed, subject to technical dependencies and protected backups.

Websites, gallery, roster, contact and contributions

• CMS administrator, officer and editor access is kept while it is needed and removed or disabled when that access ends.
• Published website or event content remains while it is relevant to the community or until it is removed.
• A gallery upload remains until you remove it from My uploads, an officer removes it, or your account is deleted. The image and caption of a removed upload are deleted within 30 days.
• The record of who uploaded a screenshot, and of any officer action on it, is kept for 12 months after the upload is removed, so officers can recognise repeated misuse. It is deleted sooner on a valid erasure request unless an active sanction or legal reason requires it.
• The website's copy of your sign-in profile (display name, avatar, groups) is refreshed each time you sign in and deleted when your Cantina account is deleted.
• Officer-list entries are refreshed from Discord at least daily. A person who no longer holds an officer role disappears from the list at the next refresh.
• Contact-form and support correspondence is normally deleted 12 months after the last substantive contact, unless it is still needed for an open request, safety matter or legal claim.
• TCN-held operational contribution data is kept until event reconciliation and any refund or dispute period is complete. Records required by Dutch law are kept for the applicable statutory period. Stripe applies its own retention to data in its service.

The Cantina Chat

The Cantina Chat uses Fluxer's default self-hosted lifecycle settings at the date above:

• a user-requested account deletion is scheduled after a 72-hour grace period and can be cancelled by signing back in during that period;
• the deletion process removes or anonymizes profile and authentication data, sessions, relationships, notes, saved items, IP authorizations, guild membership and user avatar/banner files;
• existing messages are anonymized to a generic deleted user rather than automatically erased, so the conversation remains understandable; message content and its attachments remain until separately deleted or removed;
• inactive ordinary accounts become eligible after at least two years without activity, followed by a 30-day warning period and the deletion grace period; and
• eligible attachments can expire under the instance's enabled attachment- decay rules. Their exact lifetime depends on size, renewal and the effective instance media configuration shown by the service.

Sentinel

• Open detection evidence and message-detection state expire with the configured detection window. The upstream defaults are 30 seconds for message-mode detection and 1 hour for AutoMod detection.
• Expired data is purged on startup and by a daily cleanup task, with lazy cleanup during new detections.
• Closed, cancelled, superseded or manual enforcement claims and related evidence, and enforcement-attempt records, are deleted after 30 days.
• A departed guild's configuration and exempt-user records are deleted 30 days after the bot leaves. Active-guild configuration remains until changed or the guild is removed.
• Discord retains copies posted to a Discord moderation-log channel according to that channel's settings and Discord's service behaviour.

Synchronization bot

When its maintenance service is running, the synchronization bot uses this schedule:

• successful or discarded encrypted queue payloads are scrubbed immediately;
• consent-held message copies are normally resolved or scrubbed within 10 minutes;
• encrypted dead-letter payloads are scrubbed within 7 days;
• expired or consumed link challenges are deleted after a 1-day grace period;
• mappings for already-deleted messages, account-link records after unlinking, and resolved or superseded consent history are deleted within 30 days when no dependent event remains;
• the latest relevant consent decision remains while the account profile remains, so deleting a revocation cannot reactivate an older permission;
• eligible inactive non-bot platform profiles are deleted after at least 30 days without activity once no link, session, grant, fresh membership, challenge or consent dependency remains;
• browser sessions last up to 12 hours, and expired or revoked session records are deleted within a further 30 days; and
• metadata-only bot audit events are deleted within 365 days.

World of Warcraft verification records remain while needed to reconcile the configured Discord role. A fresh successful roster check updates continued membership. After successful checks confirm that none of the recorded characters remains in the configured guild for the configured grace period, the bot removes only a role it previously assigned and deletes the verification record. A Battle.net or Discord API failure does not trigger removal. A role that existed before verification is not treated as bot-managed. You may also request deletion through the privacy contact.

Active bot identity, mapping, role, moderation and consent records remain while needed for the enabled service or its integrity. Bot application logs are size-bounded and rotated; incident extracts may be kept while an investigation or claim remains open.

TeamSpeak, email, service logs and backups

The temporary TeamSpeak service keeps client, permission, ban and connection information only while needed to operate the service, enforce an active sanction or investigate a fault. TCN does not retain TeamSpeak voice recordings. Data that is not needed for a continuing sanction or incident will be removed when the temporary service is retired.

Mailbox contents remain until the mailbox user deletes them or until the applicable correspondence period above ends. Routine website, mail, proxy, application and infrastructure logs are kept for the shortest period needed for delivery, security, troubleshooting and abuse prevention. Incident extracts may be kept while the incident or related claim remains open.

Protected backup and rollback copies are not used for ordinary access. Some current operational backups are manual rollback sets rather than a uniform rolling schedule, so TCN does not promise a universal backup-deletion period. Copies are removed when they are no longer needed for safe recovery. If a backup is restored, applicable deletions must be reapplied where practicable.

TCN services use necessary cookies or equivalent storage for login sessions, security, preferences and OAuth state. When you sign in to the website, it sets a necessary session cookie, and the TCN sign-in service sets its own sign-in cookies. Visitors who do not sign in do not get a session cookie. Cloudflare Turnstile may process data needed to distinguish legitimate users from automated abuse.

The website and the synchronization bot dashboard do not use product analytics or advertising trackers. Our live-observed Anniversary pages did not load analytics or advertising trackers at the date above. If we add non-essential analytics, marketing or similar technology, we will identify it and obtain consent where required before enabling it.

Directly loaded fonts, scripts and images from the external providers listed in section 8 are not advertising, but they cause the visitor's browser to make a request to those providers.

A video that you choose to play on a guild page is served by YouTube, which may then use its own cookies or similar storage under its own policy. Nothing is loaded from YouTube before you press play.

Depending on the service, safeguards include HTTPS, network isolation, access controls, protected secret storage, encrypted sensitive bot payloads, hashed link and session values, restricted administrative permissions, security logging, rate limiting and hardened containers. No online service can guarantee absolute security.

If you believe TCN data or an account has been compromised, contact us promptly at info@the-cantina.net.

Depending on applicable law, you may have rights to:

• receive information about processing;
• access and receive a copy of your personal data;
• correct inaccurate or incomplete data;
• request deletion;
• restrict processing;
• object to processing based on legitimate interests;
• receive portable data where the right applies;
• withdraw consent; and
• request human review of a moderation decision.

You can remove your own gallery uploads at any time from My uploads on the website, and manage your account and connected services in TCN Accounts. The synchronization bot provides commands to link or unlink accounts, view consent status, and allow, decline or revoke text consent. Unlinking or revoking consent is not the same as requesting complete erasure.

To exercise a right, email info@the-cantina.net. We may ask for enough information to verify that you control the relevant account. We respond without undue delay and normally within one month where the GDPR applies, subject to a lawful extension or exception.

You may complain to the Dutch supervisory authority, the Autoriteit Persoonsgegevens.

TCN services are not intended for anyone below the minimum age required by the service they use or the law that applies to them. A person below the age at which they may give valid consent must not use a consent-based TCN feature without the required parent or guardian authorization. Contact info@the-cantina.net if you believe a child has provided personal data contrary to these requirements.

We may update this policy when our services, providers or legal requirements change. We will update the date above and provide a prominent notice where a change materially affects how personal data is used or where the law requires additional notice or consent.

Questions, complaints and privacy requests may be sent to:

The Cantina Network community
Operated from: The Netherlands
Email: info@the-cantina.net