Boardgammon Privacy Policy

1. What we collect

Account and identity

• Email address when you sign in by email code or through Apple, Google, or Google Play Games.
• Display name and the Boardgammon user ID we mint for your account.
• Provider subject identifiers for Apple, Google, Google Play Games, and email sign-in.

Gameplay

• Match state, moves, dice commit-reveal proofs, and the replay hash chain that makes online games auditable.
• Ratings, games-played counters, puzzle progress, streaks, and daily puzzle activity.

Social and safety

• Table reactions and canned-message catalog IDs. Boardgammon does not support free-form chat in v1.
• Friend relationships, blocks, mutes, and abuse reports.

Notifications, purchases, and diagnostics

• Push tokens and the app version / locale received with them.
• Purchase entitlement state for Pro, coin packs, and themes. Apple, Google, or Stripe handle payment details directly; Boardgammon does not receive or store full card numbers.
• Crash and performance telemetry through Sentry, plus aggregate product-usage analytics through Firebase.

Website statistics

Pages on boardgammon.com — everything except the game at/play — are counted by Umami, which we run ourselves on our own server in Germany. It records the page you opened, the site that linked you and any campaign tag on the link, your browser, operating system, screen size, browser language, the language the page was served in, and an approximate location. It also counts two deliberate actions: clicking an App Store or Google Play badge, and clicking a link into the browser game.

• It sets no cookie and stores nothing on your device.
• Your IP address is used at the moment of the request to work out the approximate location and to derive a one-way visitor hash, and is then discarded. We never store it, and the hash is re-salted every month, so visits cannot be linked back to you or joined up across months.
• The data never leaves our own infrastructure, is not shared with an analytics company, and cannot follow you to another website.

2. Optional in-match voice chat

Voice chat is optional, available only to the two seated opponents in a live realtime match, and requires both players to opt in. Either player can mute the other at any time. Boardgammon uses WebRTC with relay-only TURN transport.

• Boardgammon does not record or store audio content.
• We store only voice metadata: who called whom, when the call started and ended, duration, end reason, and relay-usage estimates.
• We also store a self-attested date of birth and a voice opt-in flag so voice can fail closed when age or consent is missing.
• Cloudflare Realtime TURN relays encrypted media and necessarily sees connection metadata and IP addresses as a service provider.
• The safety claim is limited to hiding each player's IP from the other player. It does not hide IPs from Cloudflare or Boardgammon ops.

3. What we do not collect

Boardgammon does not collect precise location, contacts, calendar, photos, videos, health data, free-form chat transcripts, or recorded audio. We do not sell personal data.

4. Retention

• Account rows, social data, push tokens, and entitlement state are retained until deletion is requested.
• Replay and fair-play audit records are retained so completed online games remain verifiable. When an account is deleted, player identity in past game history is anonymized instead of removing the audit chain.
• Diagnostics retain the provider defaults, typically 30 to 90 days.
• Short-lived auth codes are deleted on use or expiry.

5. Account deletion and data requests

Both of the main data-subject requests are self-serve inside the app, and neither requires you to email anyone or wait for a human. This section is the public delete-account and data-export reference for app-store disclosures.

Export a copy of your data

1. In the app, open Settings → Privacy & data → Download my data.
2. The app fetches your complete archive immediately from the signed-in account and shows it on screen, ready to copy or save. Nothing is queued and no email is sent.
3. The archive is a single JSON document covering your profile, consent settings, match history for backgammon and checkers, coin wallet balance and ledger, social graph, referrals, notification settings, and feedback you have submitted.

Delete your account

1. In the app, open Settings → Account → Delete account.
2. Confirm the deletion request from the signed-in account.
3. Email [email protected] from the address tied to the account only if you cannot reach the in-app flow — for example if you have lost access to the sign-in address.

Deleted data includes the account row, linked provider subjects, push tokens, social rows, blocks, mutes, reports filed by the user, and voice metadata rows tied to the account.

Completed match audit logs are kept in anonymized form so previously played online games remain provably fair and replayable. Voice audio is never stored, so there is no audio archive to delete.

Authenticated API surfaces also exist for export and deletion:GET https://api.boardgammon.com/privacy/export (the full archive the in-app button uses),GET https://api.boardgammon.com/privacy/training-export (AI training contributions only), andDELETE https://api.boardgammon.com/privacy/users/{userId}.

6. European privacy rights (UK/EU GDPR)

This section applies if you are in the European Economic Area, the United Kingdom, or Switzerland. It is the information we owe you under Articles 13 and 14 of the General Data Protection Regulation, and it sits alongside the rest of this policy rather than replacing it.

Who is responsible for your data

• Controller: Peyman Ghaderkourehpaz, trading as Boardgammon. An EU establishment is being set up and will become the controller of record for players in the EEA; this page will name it, and the date it takes over, before that happens.
• Registered address: to be published — please use the email below in the meantime.
• Contact for privacy questions and data-subject requests:[email protected]. A human reads this address; you do not need to use a special form or subject line.
• We have not appointed a Data Protection Officer. Boardgammon is a small operation that does not carry out large-scale monitoring or process special categories of data, so Article 37 does not require one. If that changes we will name one here.

Why we process your data, and on what legal basis

Some of this processing is essential: it is what the game is made of, and it cannot be switched off while you still have an account. The rest is genuinely optional and you control it.

Essential — necessary to provide the game you asked for (Article 6(1)(b))

• Creating and running your account, signing you in, and keeping you signed in across devices.
• Running matches: the server generates every roll and validates every move, because the client is not trusted in online play. Your moves, the dice commit-reveal proofs, and the replay hash chain are the game record — without them there is no provably fair match to play.
• Ratings, matchmaking, tournament standings, coin balances, puzzle and lesson progress, and your purchase entitlements.
• Showing your display name and rating to the opponent you are seated with, and in match history and leaderboards, as described in the Terms.

Because this processing is what the service is, there is no way to object to it individually. The way to stop it is to delete your account (section 5) — and there is a self-serve button for exactly that.

Our legitimate interests (Article 6(1)(f))

• Fair play and anti-cheat. We review play patterns for engine assistance, collusion, and rating manipulation. Our interest is keeping a competitive game honest; the interest of every other player points the same way, and the data used is your own play, which we already hold to run the game. You can object — see below.
• Safety and abuse handling. Blocks, mutes, and reports, so players can protect themselves and we can act on harassment.
• Security and abuse prevention. Rate limiting, sign-in-code throttling, and short-lived web-server access logs.
• Crash and performance diagnostics through Sentry, so we can fix what breaks. Sentry runs in its EU region for us, and the data is technical rather than behavioural.
• Aggregate website statistics for boardgammon.com, so we can tell which pages and which languages are worth writing more of. Our interest is knowing whether the site works; against that sits a measurement that sets no cookie, keeps no IP address, produces only counts, and cannot follow you anywhere else — which is also why it is here rather than under consent, and why this site has no cookie banner. You can object under Article 21, and a browser "Do Not Track" signal already switches it off. This covers the marketing site only: product analytics inside the game is a separate, consent-based matter, immediately below.

Your consent (Article 6(1)(a)) — optional, and withdrawable at any time

• Optional in-match voice chat. Both seated players must opt in, and either can mute or end it. Audio is never recorded.
• Product-usage analytics inside the game, through Firebase Analytics. In the mobile apps it is active and you can turn it off underSettings → Privacy & data. In the browser version at/play the Firebase SDK is also switched on and loads when the game starts — so Google's servers see your IP address and browser details at that moment — but the Google Analytics tag it then tries to load is blocked by the game's own content-security policy, so no usage events currently reach Google Analytics from the browser. We would rather describe that precisely than claim the browser game carries no analytics at all, which is what this page used to say and was wrong. If we change that, we will change this paragraph in the same release.
• Personalised advertising in the mobile apps, which is off by default. When it is off, ad requests carry the non-personalised flag.
• Re-engagement notifications and marketing email. Game notifications you asked for — your opponent moved, your turn in a correspondence match — are part of the service. Anything that is us trying to win you back is marketing, and needs your opt-in.
• Finding friends from your contacts. Off unless you turn it on.

Withdrawing consent is as easy as giving it: the same switch turns it back off, and withdrawal does not affect processing that already happened. Withdrawing consent for an optional feature never costs you access to the game, your rating, your coins, or your entitlements.

Legal obligation (Article 6(1)(c))

• Keeping purchase, tax, and refund records for the period the applicable law requires, and responding to lawful requests and illegal-content notices under the Digital Services Act.

Whether you have to provide it

• Required to have an account: an email address or a linked Apple / Google / Google Play Games identity, and a display name. Without one of these we cannot create an account, though you can still play offline as a guest.
• Required to play online: the gameplay records described above. Not providing them means not playing online.
• Everything else is optional — voice chat, contacts, analytics, marketing, personalised ads. Declining costs you only the feature itself.
• Date of birth is self-attested and used only to gate age-restricted features. If it is missing, those features fail closed rather than opening up.

Who receives your data

The full list of processors is in section 9. Beyond those, two things are worth naming explicitly because your browser contacts them directly when you play at boardgammon.com/play:

• Apple and Google — the sign-in libraries for “Sign in with Apple” and “Sign in with Google” are loaded from Apple's and Google's servers, which means those servers see your IP address and browser details when the game loads, before you choose a sign-in method.
• Google Fonts — the game may fetch a fallback font fromfonts.gstatic.com for characters our bundled fonts do not cover, which also discloses your IP address to Google. We are moving these fonts on-device so this request stops happening.

The rest of boardgammon.com — every page other than the game itself — loads entirely from our own servers: no advertising or social-media scripts, no third-party fonts, and no cookies at all. Those pages are counted by our own self-hosted Umami, described in section 1: the counter is served from this domain and reports toapi.boardgammon.com — our own server in Germany, not an analytics company's. Nothing about your visit to those pages is disclosed to a third party.

Sending data outside the EEA

Our servers and database are in Germany (Hetzner), and Sentry processes diagnostics for us in its EU region. Some processors are established in the United States: Apple, Google (including Firebase and AdMob), RevenueCat, Stripe, and Cloudflare. Where a recipient is certified under the EU–US Data Privacy Framework we rely on the European Commission's adequacy decision for that framework; otherwise we rely on the Commission'sStandard Contractual Clauses. You can ask us which applies to a specific processor, and we will tell you.

How long we keep it

Section 4 sets out the periods. In GDPR terms the criteria are: account and profile data for as long as you have an account, then deleted on request; purchase records for the statutory tax-retention period; diagnostics for the provider default of roughly 30–90 days; sign-in codes until used or expired, whichever is first.

One category is deliberately different, and we would rather be plain about it than bury it. Completed online match records are kept indefinitely, because the hash-chained replay is what makes a finished game auditable — removing one player's moves would break the chain that proves the game was fair for the other player. When you delete your account we strip your identity from those records rather than deleting them, so what remains is a game, not a person.

Your rights

• Access (Art 15) — a copy of your data, plus this information. Self-serve: Settings → Privacy & data → Download my data.
• Portability (Art 20) — the same archive, as structured, machine-readable JSON.
• Erasure (Art 17) — self-serve: Settings → Account → Delete account, subject to the match-record limit above.
• Rectification (Art 16) — edit your profile in the app, or email us for anything you cannot reach.
• Restriction (Art 18) — ask us to pause processing while a dispute about accuracy or lawfulness is resolved.
• Objection (Art 21) — object to anything we do on the legitimate-interest basis above, including anti-cheat review. Objection to direct marketing is absolute: say no and we stop, with no balancing on our side.
• Withdraw consent (Art 7(3)) — any time, from the switch that granted it.
• Not to be subject to a purely automated decision (Art 22) — see below.

Two of these need no request at all — export and deletion are buttons, and they act on the signed-in account, which is also how we verify it is really you. For anything else, email us. We answer within one month, and if a request is genuinely complex we may extend once by up to two further months, telling you why before we do. We do not charge for any of this.

Complaining about us

If you think we have handled your data unlawfully, please tell us first — it is usually the fastest fix. But you do not have to go through us: you have the right to lodge a complaint with a data protection supervisory authority, in particular in the EEA country where you live, where you work, or where you think the problem happened. The Commission publishes the list of national authorities, and each one accepts complaints directly. Once our EU establishment is registered we will name its lead supervisory authority here. You also retain the right to go to court.

Cookies and on-device storage

Boardgammon uses no advertising or cross-site tracking cookies anywhere on boardgammon.com, and no analytics cookie either — the website statistics in section 1 are deliberately cookieless, which is why you have never seen a cookie banner here and why there is nothing to ask you about. What the game does store on your device is what it needs to work:

• Your sign-in token, so you are not asked for a code on every visit.
• Your settings, board theme, locale, learn-lesson progress, and an install identifier used to de-duplicate your own events.
• An offline database of your games, and a service-worker cache of the app itself, so the game keeps working on a bad connection.
• If you open an invite or referral link, the code from it, so the invite still works after you sign in.
• At checkout only, Stripe sets its own cookie for payment fraud prevention.

All of these are necessary for a service you actively asked for, which is the exemption in Article 5(3) of the ePrivacy Directive. Clearing your browser storage signs you out and resets local progress; it does not delete your account.

Children

Boardgammon is not directed at young children. You must be old enough to use online game services where you live — 13 in many countries, and 16 in some EEA member states, in which case that higher age applies to you. Voice chat additionally requires an 18+ self-attestation and both players' opt-in. We do not knowingly process the data of anyone below the applicable age; if you believe a child has an account, email us and we will delete it.

Automated decisions and profiling

We do not make decisions with legal or similarly significant effects about you by automated means alone, and we do not build advertising or demographic profiles. Anti-cheat systems and rating calculations do process your play automatically, but where the outcome affects your account — annulling a game, adjusting a rating, restricting or closing an account — a person makes that call, you get a statement of reasons saying whether automated means were involved, and you can appeal it free of charge under section 8.

7. California privacy rights (CCPA/CPRA)

This section applies to consumers resident in California and is provided under the California Consumer Privacy Act as amended by the CPRA. It describes our practices for the preceding 12 months.

Categories of personal information collected

• Identifiers — email address, display name, the Boardgammon user ID, provider subject identifiers for Apple, Google, Google Play Games, and email sign-in, push tokens, and IP addresses observed by our infrastructure and voice relay.
• Commercial information — purchase and entitlement state for Pro, coin packs, and themes, and the coin wallet ledger. We never receive full card numbers.
• Internet or other electronic network activity — gameplay and match records, dice commit-reveal proofs and replay hash chains, ratings and progress counters, app version and locale, crash and performance telemetry, and aggregate product-usage analytics.
• Audio-adjacent metadata — for optional in-match voice chat, who called whom, start and end times, duration, end reason, and relay-usage estimates. Voice audio content is never recorded or stored.
• Age-band information — a self-attested date of birth used to gate age-restricted features such as voice chat and contact discovery.
• Inferences — skill ratings and matchmaking suitability derived from your own play. We do not build advertising or demographic profiles.

Sources: you, your device, and our service providers listed in section 9. Business purposes: operating and securing the game, matchmaking, fair-play auditing, purchases, support, and product improvement.

Categories disclosed for a business purpose

In the preceding 12 months we disclosed identifiers, commercial information, and electronic network activity to the service providers and processors listed in section 9 — app stores and payment processors for purchases, the voice relay for connection metadata, diagnostics and analytics providers, the ad network where ads are shown, and our hosting provider. Each acts under contract and may only use the data to perform the service for us.

Sale and sharing

Boardgammon does not sell personal information, and does not share personal information for cross-context behavioral advertising. We have not sold or shared personal information in the preceding 12 months, and we do not knowingly sell or share the personal information of consumers under 16 years of age. Personalized advertising is off by default; when it is off, ad requests are sent with the non-personalized flag set. Because we do not sell or share, we do not offer a separate "Do Not Sell or Share My Personal Information" opt-out link — turning the personalized-ads switch off in Settings → Privacy & data is the full extent of the choice, and it is already the default.

Your rights

• Right to know — what we collect, use, and disclose about you, including a portable copy.
• Right to delete — deletion of the personal information we hold, subject to the limits below.
• Right to correct — correction of inaccurate personal information.
• Right to opt out — of sale, sharing, and of profiling for automated decisions with legal or similarly significant effects. We do not carry out any of these.
• Right to limit use of sensitive personal information — we do not collect sensitive personal information as defined by the CPRA for purposes that trigger this right.
• Right to non-discrimination — exercising any of these rights will never change your price, your entitlements, your rating, or the features available to you. We do not offer financial incentives in exchange for personal information.

How to exercise your rights

The fastest route is self-serve and needs no verification email: useSettings → Privacy & data → Download my data to exercise the right to know, and Settings → Account → Delete account to exercise the right to delete. Both act on the signed-in account, which is how we verify the request. For correction, or if you cannot sign in, email[email protected] from the address tied to the account; we may ask for information matching what we already hold before we act. We respond within 45 days and may extend once by a further 45 days where permitted, telling you before we do.

Authorized agents. You may use an authorized agent to submit a request on your behalf. Send the request to the address above together with written permission signed by you, or a valid power of attorney. Unless a power of attorney is provided, we will also verify your identity directly and ask you to confirm that the agent is acting for you. Agent requests received without that proof are placed on hold rather than denied, and we tell the agent what is missing.

Limits: completed match audit logs are retained in anonymized form so previously played online games remain provably fair and replayable, and records required for tax, purchase, security, and fraud-prevention purposes are retained as permitted by law.

8. EU Digital Services Act — trader identity and illegal-content notices

Trader identity

Boardgammon acts as a trader toward consumers in the European Union within the meaning of the Digital Services Act and the Consumer Rights Directive. The trader behind the Boardgammon apps and boardgammon.com is:

• Trader name: Peyman Ghaderkourehpaz, trading as Boardgammon.
• Registered address:to be published — contact the email address below in the meantime.
• Contact email:[email protected]. This is also the single point of contact for recipients of the service, for Member State authorities, for the Commission, and for the Digital Services Coordinator. It accepts English.
• Trade register and registration number:to be published.
• VAT identification number:to be published.

Payments for in-app purchases are taken by Apple, Google, or Stripe as the merchant or payment processor for the relevant storefront; their own trader details apply to the payment itself.

Notice and action: reporting illegal content

Anyone can notify us of content or behaviour in Boardgammon they consider illegal. The primary route is the report flow already built into the app, so the report arrives with the match and account context attached:

1. Open the opponent's profile, or the in-match menu during or after a game, and chooseReport.
2. Pick the reason that fits and add any detail you want us to see.
3. Submit. The report is tied to your signed-in account and the reported account.

If you are not a player, or cannot reach the in-app flow, send the notice by email to[email protected] with "Illegal content notice" in the subject line.

A valid notice must contain all of the following:

• A sufficiently substantiated explanation of why you consider the content illegal.
• A clear indication of where it is — the Boardgammon display name or user ID, and the match, table, or profile where it appeared, with an approximate date and time.
• Your name and email address, except for notices about child sexual abuse material or certain other offences against children, which may be submitted anonymously.
• A statement confirming your good-faith belief that the information in the notice is accurate and complete.

What to expect. We send an acknowledgement to the email address in the notice without undue delay after we receive it. We then assess the notice in a timely, diligent, non-arbitrary and objective way, and notify you of our decision along with the reasons for it and the redress options below. Where we act against an account or its content — removing a display name, restricting features, suspending, or terminating — we also give the affected user a statement of reasons explaining the ground, the facts relied on, whether automated means were used, and how to appeal. Boardgammon does not support free-form chat, so most reports concern display names, reactions, and conduct rather than user-published text.

Complaints and redress

If you disagree with a decision — whether you filed the notice or were acted against — you can complain free of charge for six months from the decision by emailing[email protected] with "Complaint" in the subject line and the original decision. Complaints are reviewed by a person, not by automated means alone, and we reverse the decision without delay where the complaint shows it was wrong. Using this internal route does not affect your other options: you may pursue out-of-court dispute settlement before a body certified in your Member State under Article 21 DSA, and you retain the right to go to court. You may also lodge a complaint with the Digital Services Coordinator of your Member State.

9. Service providers and processors

• Apple App Store and Google Play for app distribution and in-app purchases.
• RevenueCat for product presentation, subscription lifecycle, entitlement validation, and purchase-state handling.
• Stripe for secure payment processing of purchases made on boardgammon.com.
• Cloudflare for edge delivery and TLS across boardgammon.com, and Cloudflare Realtime TURN for encrypted relay-only voice media and connection metadata.
• Sentry for crash and performance telemetry, processed in Sentry's EU region.
• Firebase Analytics for aggregate usage analytics in the mobile apps. Its SDK also loads in the browser version of the game, which discloses your IP address and browser details to Google when the game starts, although the Google Analytics tag itself is currently blocked there by the game's content-security policy. Section 6 sets this out in full.
• AdMob for mobile ad delivery where applicable. There is no advertising on the web.
• Resend for outbound email that is not a sign-in code — sent from the separate subdomain news.boardgammon.com and processed in the EU. Sign-in codes are sent by our own mail server, deliberately kept apart from anything promotional.
• Apple and Google for the sign-in libraries the browser game loads, and Google Fonts for fallback characters our bundled fonts do not cover. Both see your IP address when the game loads; see section 6.
• Hetzner for production hosting in Germany.

Each of these acts under contract and may only use the data to perform the service for us. If you want to know which transfer safeguard covers a particular one, ask — see section 6.

Website statistics are deliberately not on that list. We runUmami ourselves, on the same Hetzner server in Germany that runs the game, into our own database. There is no analytics vendor in the path, nothing is transferred outside the EEA for it, and no third party ever sees your visit to these pages.

10. Security and transport

Boardgammon uses HTTPS only. The production stack terminates TLS at Cloudflare and again at the origin. Voice media uses standard WebRTC DTLS-SRTP through relay-only TURN.

11. Changes to this policy

Material changes are announced in the app release notes and on this page. Minor wording and link corrections may be made without separate notice.

12. Contact

Boardgammon
Peyman Ghaderkourehpaz
[email protected]