Privacy Policy

1) Who we are

2) Information we collect

We collect information in three main ways: (a) information you provide, (b) information collected automatically, and (c) information from third parties.

A. Information you provide

• •Account information: name, username, email address, password (stored in hashed form), profile image (optional).
• •Organisation information: organisation name, subdomain, invited member emails, roles/permissions.
• •Gameplay data you enter: game titles, session dates, participants, scores, results, notes, awards/badges, and any rating inputs used to generate rankings (including Elo-style ratings if enabled).
• •Support communications: messages you send to us (e.g., help requests).

B. Information collected automatically

• •Device and usage data: IP address, browser type, device identifiers, pages viewed, actions taken in the app, timestamps, and referral URLs.
• •Cookies and similar technologies: used for authentication, security, preferences, and measurement/advertising where enabled (see Section 6).

C. Information from third parties

• •Payments and subscription information: processed by Stripe. We receive information such as billing status, subscription tier, and limited payment metadata. We do not store full card numbers.
• •Analytics and advertising partners: Google Analytics / Google Tag, Meta (Facebook) Pixel, and Reddit Pixel may collect information via cookies or similar technologies.

3) How we use information

We use personal information to:

• •Provide, maintain, and improve the Service (including saving your sessions, scores, and leaderboards).
• •Create and manage accounts and organisations, including invitations and role-based access.
• •Personalise your experience (e.g., preferences, statistics, and highlights).
• •Process payments and manage subscriptions (if applicable).
• •Communicate with you about updates, security alerts, and support.
• •Monitor and prevent fraud, abuse, and security incidents.
• •Comply with legal obligations and enforce our Terms.

4) How we share information

We do not sell your personal information.

We may share information in these situations:

A. Within your organisation

Your gameplay data and profile information may be visible to other members of your organisation depending on roles/permissions and settings. For example, session results may appear in leaderboards or stats dashboards.

B. Service providers (processors)

We use third-party vendors to help operate the Service. These providers may process personal information only to provide services to us and must protect it.

Our key vendors include:

• •Hosting / infrastructure: Render
• •Email services: privateemail.com
• •Analytics / measurement: Google Analytics and Google Tag
• •Payments: Stripe
• •Advertising / measurement pixels: Meta (Facebook) Pixel, Reddit Pixel

C. Legal and safety

We may disclose information if required to comply with law, regulation, legal process, or governmental request, or to protect the rights, safety, and security of our users, the public, or the Service.

D. Business transfers

If we are involved in a merger, acquisition, financing, reorganisation, or sale of assets, information may be transferred as part of that transaction.

5) Public and community visibility

Some organisations may configure settings so that certain information is visible to other members (e.g., leaderboards, season standings, awards). Organisation administrators control member access, permissions, and certain visibility settings.

6) Cookies, pixels, and tracking technologies

We use cookies and similar technologies for the following purposes:

A. Essential cookies

Required for the Service to function, such as authentication, security, and session management. Disabling these may prevent you from using the Service.

B. Preferences cookies

Remember settings and preferences to improve your experience.

C. Analytics (Google Analytics / Google Tag)

We use Google Analytics and Google Tag to understand how users interact with our Service (e.g., pages visited, time spent, feature usage). This helps us improve performance and usability.

D. Advertising/measurement pixels (Meta Pixel and Reddit Pixel)

We use the Meta (Facebook) Pixel and Reddit Pixel to measure ad performance, understand conversions, and build audiences for advertising campaigns (where applicable). These pixels may use cookies or similar technologies to collect information about your device and your interaction with our Service.

Your choices: You can control cookies through your browser settings. You may also be able to limit targeted advertising through your device or browser controls. Some features may not function properly without essential cookies.

7) Data retention

We retain personal information for as long as needed to provide the Service and for legitimate business purposes (e.g., security, backups, dispute resolution, and legal compliance).

• •Account and organisation data: retained until deleted by you or your organisation admin, subject to backup retention.
• •Backups: may be retained for up to 180 days before being overwritten or deleted.

8) Security

We use reasonable administrative, technical, and organisational measures to protect personal information. However, no method of transmission or storage is completely secure, and we cannot guarantee absolute security.

9) Your rights and choices

Depending on your location, you may have rights to:

• •Access the personal information we hold about you
• •Correct inaccurate information
• •Request deletion
• •Object to or restrict certain processing
• •Request a copy of your data (data portability, where applicable)
• •Withdraw consent (where processing is based on consent)

To exercise these rights, contact us at admin@boardgametally.com. We may need to verify your identity.

Organisation-controlled data

If your data is controlled by an organisation (for example, you are a member of an organisation created by someone else), the organisation admin may control access, deletion, and permissions. In those cases, contact your organisation admin first.

10) Children's privacy

The Service is not intended for children under 13 (or under 16 where required by law). We do not knowingly collect personal information from children without appropriate consent. If you believe a child has provided personal information, contact us and we will take steps to delete it.

11) International data transfers

We may process and store information in countries other than where you live. Where required, we use appropriate safeguards to protect personal information when it is transferred internationally.

12) Third-party websites and services

The Service may link to third-party websites or integrate with third-party services. Their privacy practices are governed by their own policies, not this Privacy Policy.

13) Changes to this Privacy Policy

We may update this Privacy Policy from time to time. We will post the updated version on this page and update the "Last updated" date. If changes are material, we may provide additional notice.

14) Contact us

If you have questions or requests about this Privacy Policy, contact: