Skip to content
Wargaming Events

Privacy Policy

Last updated: October 18, 2026

Wargaming Events (wargamingevents.com) is a free directory of wargame tournaments, store game nights, and conventions in the United States and Canada. José Anés operates the site. This page describes the information the site actually collects and stores. Questions and deletion requests go to jose.anes@gmail.com. The Terms and Conditions cover use of the directory.

Accounts

You can use the directory without an account. Submitting a listing, claiming a store, or saving a player profile requires a sign-in. Sign-in is Firebase Authentication with an email and password, or with Google. Google sign-in opens a popup, and uses a full-page redirect on Safari, iOS, and when the popup is blocked. Google can share your name, email address, and profile photo. The password for an email account stays with Firebase. The site does not store the password.

The first sign-in creates an account document for your user id. It stores your display name, email address, an empty home place, a 50-mile radius, an empty game list, and notification settings. The event-email digest starts off. You can later save a home label, coordinates, radius, and the games you play. An admin can read account documents, including the email address, from User Management. Other visitors cannot.

Firebase keeps you signed in on this browser until you sign out. That session is stored in IndexedDB, which is how the Firebase Auth library persists a login. A short-lived session flag records that a Google redirect was started, and a referral id from a ?ref= link is kept in session storage as wge-ref. If you sign up from a referral link, the site stores that your account was referred, once. That record is visible to you and to moderators.

Player profile

The player profile is optional. It can store a display name, a US ZIP code, games, play formats (competitive, casual, narrative, painting), where you like to play, a travel radius, and whether you are willing to host. Hosting details can include tables, terrain, games, availability, a guest limit, and a short note. You can also save links or handles for gaming sites and social profiles, and choose an avatar: none, your Google photo, or Gravatar. If you choose Gravatar, we store a hash of your email and the browser loads the image from gravatar.com. The profile card does not store the email address itself.

The private profile is readable by you. If you turn on “show on the map,” a public profile is written with your display name, ZIP code, the ZIP centroid (not a street address), games, formats, and the links you chose to show. Rank and experience points appear there only if you turn that on. Turning the map off deletes the public profile. Clearing the avatar and social links deletes the public profile card. Other players can send an “ask to play” message only if you turn that on. Store invites work the same way, and both switches start off.

Listings and moderation

Signed-in people can submit events, weekly series, and store pages. A new event or player series stays pending until a moderator publishes or rejects it. A store manager of an approved store that may auto-publish can publish that store’s events without the wait. A store page created with an event starts hidden. Published pages show the listing itself: title, place, time, description, fee, and links the submitter entered. The public page does not print your email address. The event document still stores the account id of the person who submitted it.

You can also send a correction, a suggestion, a store report (closed shop or a no-show), an RSVP, a check-in, or a review. Moderators can read pending listings, notes, and the account id of the submitter. A moderation note can be stored on the listing. Store pages can show a phone number, hours, games, and contact links a manager saved, including an email address if the manager entered one.

Store claims, badges, and experience

A store claim asks to manage that store. The form stores your role, a proof type (business email, phone callback, social account, or none yet), a short proof detail, and a note. A moderator approves the first manager. A later request can be approved by a moderator or by someone who already manages that store. Approval records the claim, names a manager, and can mark the store verified for auto-publishing its events. The public store page shows a claim status, not the claimant’s account id.

Experience points are stored when you RSVP, check in, have an event published, write a review, refer someone who signs up or RSVPs, or have a suggestion accepted. The amounts are fixed in the site rules. The ledger is append-only: the browser cannot delete a row. Totals, a monthly total, and counts of reviews, published events, and conventions are stored with your display name, region, and city slug. Those totals are readable by anyone. A public leaderboard shows a display name only after you opt in on the account page. Accounts created before that choice stay off the name list until you check the box. Ranks and badges (first review, a published event, and five convention check-ins) are calculated from those counts. They are not a separate certificate.

Location and maps

If you have not already chosen a place, the home page may ask the browser for a coarse location. If that is unavailable, it requests an approximate city from geojs.io using your IP address, or uses a location header when the host provides one. The players page uses the same lookup when a signed-in visitor has no ZIP code on their profile: the browser calls https://get.geojs.io/v1/ip/geo.json. geojs.io sees the IP address. We do not store that IP. A located place can then be saved in this browser. Typing a city or ZIP, or choosing “use my location,” saves the same way.

A city, ZIP, or Canadian postal code that is not in the built-in list is geocoded from your browser by OpenStreetMap Nominatim (nominatim.openstreetmap.org). The request includes the text you typed. Maps use Leaflet and tiles from tile.openstreetmap.org. Your browser requests those tiles directly. OpenStreetMap’s privacy policy is at wiki.osmfoundation.org/wiki/Privacy_Policy.

Address suggestions and Google star ratings load the Google Maps JavaScript API and Places API in the browser, and they send the text you type or a place id to Google. A rating stays in memory for that page and is not written to our database. The Maps key is unset in the committed production environment, so those calls stay off until a key is configured. A weekly store-health job can also ask Google Places whether a business listing looks open, and only when that option and a server key are turned on. They are off unless configured.

Cookies and browser storage

The site and its providers use these cookies and storage keys:

  • _ga and _ga_*. Google Analytics 4 page-view cookies on production pages.
  • Google AdSense cookies, and cookies set by Google’s consent and US-state privacy message. The AdSense script is on production pages. Ad units themselves are still house placeholders.
  • Firebase Auth in IndexedDB, so the signed-in session survives a reload until you sign out.
  • wge-ref in session storage. The account id from a ?ref= link, for that tab.
  • wge-event-draft in local storage. The add-event form until you submit or it is cleared.
  • wge-last-venue in local storage. The last venue used on that form.
  • wge-place in local storage. The remembered place (coordinates, a label, and how it was chosen).
  • wge-profile-prompt in local storage. A flag that the profile prompt was dismissed.

Session storage also holds a short Google-redirect flag, and, for moderators, pending-queue counts for about a minute. You can clear cookies and site data in the browser. That signs you out and drops the draft, the last venue, and the remembered place.

Analytics

Production pages load Google Analytics 4, measurement id G-RX2W05H6X8. Development and tests do not. A page view sends the page path, the page location, and the title. Query parameters named email, uid, token, or password are removed first. Google signals and ad personalization signals are turned off, and IP anonymization is turned on. The tag does not send your account email or account id. Before that tag loads, the page sets Google Consent Mode defaults. In Austria, Belgium, Bulgaria, Croatia, Cyprus, Czechia, Denmark, Estonia, Finland, France, Germany, Greece, Hungary, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, Malta, the Netherlands, Norway, Poland, Portugal, Romania, Slovakia, Slovenia, Spain, Sweden, the United Kingdom, and Switzerland, analytics and ad storage start denied until you answer Google’s privacy message. Elsewhere they start allowed. If the browser sends Global Privacy Control, ad personalization and ad user data stay denied. Google can still set _ga cookies where storage is allowed. Analytics data for this property is kept for 2 months. Google’s policy is at policies.google.com/privacy. If your browser reports a European time zone, the same denied defaults apply even when your network address is placed elsewhere.

Privacy settings

The consent banner is Google’s Privacy & messaging message, delivered by the AdSense tag. José publishes that message in the AdSense console. The site does not show a second banner. The footer link “Privacy settings” reopens that message when it is available. Until the message has loaded, the same link stays on this section.

Advertising

The site is free and ad-supported. Visible slots are currently house placeholders that link to the advertise page. They are not Google ad units. Production HTML still loads the Google AdSense script for publisher ca-pub-0922011798840275 so Google can verify the site. That script can use cookies. Account, moderation, store-management, and admin pages do not show an ad slot.

When ad units are switched on, Google AdSense may use cookies and may show personalized ads. That can count as “sharing” personal information for cross-context advertising under US state privacy laws. We do not sell personal information for money, and we do not share phone numbers or account emails with other companies for their marketing. The footer link “Do Not Sell or Share My Personal Information” opens Google’s US state privacy message when that message is loaded. Until then, the link stays on this section. You can also read Google’s advertising policy at policies.google.com/technologies/ads and change ad personalization at adssettings.google.com.

Global Privacy Control is honored in the page itself. When the browser sends that signal, the consent defaults set ad personalization and ad user data to denied before Analytics or AdSense can record a hit. A Do Not Track header is not given a separate effect beyond that. You can also use Google’s ad settings and Google’s US state privacy message.

Email and text messages

The account page can opt you in to an email digest of matching events. That choice stores the consent time, the sentence you agreed to, a source, a text version, a frequency (weekly, monthly, or instant), the stores and series you follow, and an unsubscribe token. The digest starts off. Turning it off keeps the original consent time and sets the opt-in to false. The unsubscribe link does the same without a signed-in session, and writes a short proof record. The digest builder in this project does not send mail. A dry run prints who would be mailed. No digest emails are sent by the current code.

Cloud Functions in us-central1 handle moderation notices. A new pending submission, event, store claim, event claim, or suggestion emails moderators. Publishing or approving it emails the submitter. Those messages use the email on the account, or the email on the Firebase user if the account document has none. They do not check the digest opt-in. Email is sent by Twilio Email. Twilio is the email processor and the SMS processor. The site does not use SendGrid, and it does not use the Firebase Trigger Email extension. A copy of each moderation email, including the recipient address, is stored in a mail document that visitors cannot read. That document expires about 30 days later. Twilio’s privacy notice is at twilio.com/en-us/legal/privacy.

Text messages are the program “Wargaming Events alerts.” They are sent by Twilio, and only after you opt in. On the account page you enter a phone number in international format and check a box. The sentence names the program Wargaming Events alerts, says message frequency varies, says message and data rates may apply, says you can reply HELP for help and STOP to opt out, and links the terms and this policy. Frequency varies with moderation activity and verification codes, and sends are capped at 5 texts an hour and 20 a day. The site stores that sentence, a version, the consent time, the number, and whether texts are on or stopped. A six-digit code, stored only as a hash and kept for about 10 minutes, verifies the number. A text is sent only when the functions are deployed, the number is verified, the opt-in is on, it has not been stopped, and a Twilio sender number is configured. If SMS is not configured, or the verification function is unavailable, saving a number does not send a text. STOP, STOPALL, UNSUBSCRIBE, CANCEL, END, and QUIT turn texts off. START, YES, or UNSTOP can turn them back on only when the saved consent and the verified number still match. Texting HELP or INFO gets an automatic reply with the program name, the frequency line, and links to help, terms, and this policy. For anything else, email jose.anes@gmail.com. You can also press “Stop text messages” on the account page. SMS is sent immediately and is not stored in a queue. Consent records are kept and are not given an expiry time. Phone numbers are used for this alert program. They are not sold or shared with other companies for those companies’ marketing.

How long information is kept

Account, profile, listing, claim, and experience records stay while the account and the listing exist. There is no general “delete after N years” job. Moderation mail documents are kept for about 30 days. The index file marks expireAt for Firestore time-to-live deletion, and deletion can lag a few days after that time. SMS verification codes expire after about 10 minutes. Confirming a code deletes that challenge document. Google Analytics data for this property is kept for 2 months. Share-slot and play-request slot documents must set expireAt about 48 hours out, and unsubscribe proofs about 30 days out. The security rules require those times. Enabling automatic deletion for those three collections is a separate step this repository documents and does not turn on by itself. Older rows written before the field existed have no expiry. Experience ledger rows are not deleted by the browser. SMS consent and verification documents are kept on purpose.

Deleting your account

On the account page, “Download my data” saves one JSON file of the records tied to your sign-in. “Delete my account” removes those records after you sign in again and type DELETE. The sign-in check has to be from the last five minutes. Someone who cannot sign in can still email jose.anes@gmail.com from the address on the account.

A published event or public store other people rely on stays up. The submitter id and name on that listing become “deleted user.” An unpublished event or a hidden store you submitted is removed. A store claim is released. Moderation notes that explain why a listing was approved or rejected stay, with your id, email, and phone removed. The sign-in is deleted last. Running the deletion again after that does nothing. Turning off the map, the digest, and text messages takes effect as described above without deleting the whole account. Unsubscribing does not delete the account.

Children

You must be at least 13 to use the site. If you are in a country in the European Union that requires 16 for consent to this kind of service, you must be at least 16. The site is not directed to children under those ages, and it does not knowingly collect their personal information. The account form does not ask for a date of birth, and the site does not verify age. If you believe a child under the applicable age has given personal information, email jose.anes@gmail.com. We will delete the personal information we can identify. This is how the site approaches the Children’s Online Privacy Protection Act (COPPA) and the EU age rule.

Your rights

You can see and correct most account and profile fields on the account page. You can turn off the digest, text messages, the player map, and contact from other players or stores. A copy of your records and deletion of the account are on that same page. A correction we cannot make there, or a request from someone who cannot sign in, is answered by email. Email jose.anes@gmail.com. We may ask you to confirm that you control the account. We answer within one month. We will not charge you or block the directory because you asked.

United States and California (CCPA/CPRA): we collect identifiers (name, email, account id, and a phone number if you save one), approximate location, listing and profile content you submit, and page-view data through Google Analytics. We do not sell personal information, and we do not offer a financial incentive for it. Personalized Google ads, when ad units are on, can be “sharing” for cross-context behavioral advertising. The Do Not Sell or Share link for that sharing is Google’s US state privacy message, described under Advertising. Do Not Track and Global Privacy Control are covered in that same section.

European Union and United Kingdom (GDPR and UK GDPR). The legal bases we rely on are:

  • Contract: running your account and carrying out the listings, claims, and messages you submit.
  • Consent: the event digest, Wargaming Events alerts texts, a public player profile, browser location, and personalized ads if you accept them in Google’s message. You can withdraw consent. Withdrawal does not undo processing that already happened.
  • Legitimate interests: keeping the directory online, moderation, security, and counting page views with Google signals and ad personalization signals turned off. You can object.
  • Legal obligation: keeping a record when the law requires it.

If those laws apply to you, you can ask for access, correction, erasure, restriction, a portable copy of information you provided, and to object. You can complain to a regulator: a European data protection authority, or the UK Information Commissioner’s Office. The database is in the United States (us-central1). We have not appointed an EU or UK representative.

Canada (PIPEDA) and Quebec: we collect personal information to run the directory, accounts, moderation, and the optional alerts described above. Digest email and text messages wait for your consent, and you can withdraw that consent. You can ask for access and for a correction. People in Quebec can also complain to the Commission d’accès à l’information du Québec. People elsewhere in Canada can complain to the Office of the Privacy Commissioner of Canada. José Anés is the person responsible for personal information. The database is in the United States, outside Canada and outside Quebec.

Security

Pages are served over HTTPS. Firestore security rules decide who can read and write each document. Account emails are not on the public listing pages. Hosting sends X-Content-Type-Options: nosniff, Referrer-Policy: strict-origin-when-cross-origin, and X-Frame-Options: SAMEORIGIN. Text-message codes are stored as hashes. The Twilio webhook checks Twilio’s signature. The Firebase web API key is restricted by website referrer.

Firebase App Check is wired in the code and stays off until a reCAPTCHA site key is configured. It is not enforced today. The site does not claim a security certification, an audit, or a guarantee that unauthorized access cannot happen.

Changes

When this policy changes, the date at the top of this page changes with it. That date is the notice. The site does not email a separate announcement of policy edits.

Contact

José Anés, operator of Wargaming Events. Email jose.anes@gmail.com. That address is the Google sign-in support email and the advertising contact. A public street address is not published on the site.