Privacy

oaken.gg is an independent, community-made companion site for the game Oaken Tower, built and operated by its founder, Silver (about the project). For everything in this policy, the operator is the data controller, and silverakcel@oaken.gg is the door. Write there for any privacy question or request and you will get an answer from a person.

Account and sign-in

Signing in creates an account holding your email address and, if you use a sign-in provider (Discord, Twitch or Google), the account ID, username and avatar that provider shares with us. If you link Steam, we store your SteamID and your public persona name, fetched from Valve's web API; you can refresh or disconnect it in Settings at any time. Your verified Discord and Twitch usernames can be shown on your profile; they sync from the sign-in itself and are removable there too. We use this data to operate your account. Legal basis: performing our contract with you.

Your profile and content

Your handle, display name, bio, avatar, banner and any social links you enter are public by design. So is what you publish: posts, replies, images, likes, follows, favorites, shared builds and tier lists, wiki contributions and record submissions. Reports you file about content are visible to staff. Legal basis: performing our contract with you; it is your choice what you publish.

Preferences

Site preferences (default feed, media behavior, muted words, motion) are stored privately on your account and mirrored on your device so pages can apply them instantly. They are never part of any public payload.

Usage analytics, first-party only

We run our own minimal analytics to understand what gets used and to spot abuse. An event records its type (for example pageview, signup, post created), the page path, the referring site's domain, and either your account ID (when signed in) or a random token your own browser generates (when signed out). Your IP address is never stored; a salted one-way hash of it is kept briefly for flood protection. There are no analytics cookies, no fingerprinting, and no third parties involved, and if your browser sends Do Not Track or Global Privacy Control we do not record the event at all. Raw events are deleted after 90 days; only anonymous daily totals are kept beyond that. Legal basis: our legitimate interest in understanding and protecting the service.

Performance measurements

Real sessions report Core Web Vitals (how fast pages load and respond) to our own endpoint under the same rules: first-party, cookieless, Do Not Track honored, raw samples deleted after 90 days.

Profile views

Profile pages count views. Signed-in views are deduplicated by account, signed-out views by a salted hash and the anonymous token; a short forensic trail (including referrer and browser user agent) protects the counters from manipulation and is deleted after 90 days. View data is removed when either account involved is deleted.

Moderation and safety

Staff keep records needed to run a safe community: reports and their outcomes, enforcement actions, and notes on accounts that required action. Rate limits briefly track request counts. Legal basis: our legitimate interest in keeping the community safe and enforcing the terms.

Hosting logs

Our hosting provider keeps standard, short-lived request logs (IP address, user agent) for security and operations, as every host does.

The only cookies oaken.gg sets are the session cookies that keep you signed in. They are strictly necessary for the sign-in to function, which is why there is no cookie banner: there is nothing optional to consent to.

Your browser's local storage holds a small amount of site state: oaken_prefs.v1 (a mirror of your preferences), oaken_vt (the random analytics token described above, generated by your browser and meaningless anywhere else), per-tab view markers, and feature state such as unsent drafts. Clearing site data signs you out and resets these; nothing breaks.

The database, authentication and file storage run on Supabase in the European Union (eu-west, Ireland). The site itself is served by Vercel's global network, so requests are processed close to you and may transit outside the EU; both providers operate under standard contractual clauses for such transfers.

A few things load from third parties, and only these:

• Sign-in providers. Discord, Twitch, Google and Steam handle their side of sign-in and linking under their own privacy policies.
• Provider avatars. If your profile picture came from your sign-in provider, browsers load it from that provider's image servers until you replace it.
• Video embeds. Pages with proof or guide videos embed YouTube's privacy-enhanced player (youtube-nocookie.com) or Vimeo; those load from their servers when the page is viewed.

The important ones are self-serve, in Settings, no email required:

• See and fix. Edit your profile, links, email and preferences directly.
• Export. Download everything you gave the site (profile, posts, links, follows and more) as one JSON file.
• Delete. Delete your account yourself; the section below says exactly what that does.

On top of that you have every right the GDPR grants: access, rectification, erasure, restriction, portability, and objection to processing based on legitimate interest. Email silverakcel@oaken.gg to exercise anything that is not self-serve; we answer within a month. You also always have the right to complain to your local data protection authority. If you are a California resident: we do not sell or share personal information as the CCPA defines those terms, and we honor the same access and deletion rights for you.

Deleting your account destroys every sign-in method and anonymizes you. Your profile becomes a neutral tombstone with no name, picture, links or connections; your posts retire into hidden placeholders; your follows, likes, saves, notifications and preferences are erased.

Two things survive, by design. World records and badges remain as public site history under the anonymized name, because leaderboard history belongs to the community that witnessed it. And where moderation action was taken, the records needed to enforce it are retained under our legitimate interest in keeping bans meaningful; for the same reason a banned account cannot self-delete while its enforcement records are needed. Write to us instead and we will handle it within the law. Residual copies in encrypted disaster-recovery backups expire on their own short schedule.

oaken.gg is not for children under 13, and where local law sets a higher age for consenting to data processing (up to 16 in parts of the EU), that age applies. We do not knowingly collect data from children below these ages; if you believe we have, email us and it will be removed.

If our data practices change, this document changes with them and the date at the top moves. Material changes get announced on the site, not buried.