Privacy Policy

Who runs this site

Boardit (playboardit.com) is run by Ahmed Moaz, an independent developer. For any privacy question, or to have an account and its data deleted, email privacy@playboardit.com.

At a glance

What is stored about you

If you create an account, Supabase Auth processes your email address and password. The password is stored as a hash, not readable by Boardit. Supabase assigns an account ID. Your profile stores your display name, handle, avatar colour, the look of your Tok (the hat, glasses, scarf, pin and frame you pick), guest/account status, and sound and motion preferences. Your signup display name is also stored in Auth user metadata.

You can play as a guest without an email or password, but a guest still has an anonymous account ID and a profile. Joining a table stores your seat and activity timestamps. Room chat, game state and game events are stored while the room data remains. After a game, a short tally of the evening (which games were played, who played and who won) is kept so the end screen can show the night’s scoreboard; it is deleted once no room uses it. Please do not put sensitive information in a display name or chat message.

Boardit also keeps restricted operational history after some live room data is removed. This includes account IDs and display names, game and room metadata, who played, and activity timestamps. It helps us understand site and game usage and is not visible to other players. It is deleted automatically after 400 days, except that a game a registered account played in stays part of that account’s record (its wins and best scores) until the account is deleted. Contact privacy@playboardit.com to request access, correction or deletion, and we will explain what can be removed from each system.

To stop password guessing and abuse, Boardit counts failed sign-ins, new guest sessions and account emails, per network address and per email address. These counters never store the address or the email itself, only a scrambled code made from it with a secret key, and they are deleted after one day.

There is no payment processing on this site, so Boardit does not collect card or billing details.

Why we use it (legal bases)

Where the GDPR or a similar law applies: running your guest seat or account, your tables, chat and the account emails you ask for is necessary to provide the service you asked for. Keeping the site secure (the attempt counters, abuse controls and operational history) and measuring how it is used with the analytics described below are our legitimate interests, kept to what that needs. Advertising cookies in the European Economic Area, the United Kingdom and Switzerland are used only with the consent you give in Google’s message.

Room codes

A room code lets someone join a table, so treat it like a password. Boardit’s Google Analytics and PostHog URL handling replaces room codes in page paths and path-like query values before those browser pageview URLs are sent. Product events can still contain a room’s internal UUID, which is different from its join code. Room and join routes are omitted from the sitemap and disallowed to crawlers. Those crawler settings do not make a room private or prevent someone from requesting its URL. Hosting and network providers also process technical request data; analytics URL redaction is not a guarantee about every provider request.

Cookies and analytics

Sign-in cookies. Supabase session cookies keep your authenticated session available and are refreshed as needed. They support sign-in and access to account and game features. Public pages can be viewed without signing in. Cookie lifetime depends on session and provider settings.

Google Analytics 4. Where enabled on production, Boardit sends pageview events with a redacted page path and query string to measure visits and traffic sources. The integration does not set a Google Analytics user ID or send room chat or game-state contents. Google receives technical request data needed to provide the service and may use cookies. Additional collection and retention depend on the Google Analytics account settings.

PostHog. Boardit uses the EU-hosted service to measure page views, page exits and product activity. Events cover account activity, game selection, room creation and joining, game starts and finishes, player joins and leaves, invitations, abandonments, errors and optional after-game feedback. Feedback includes your selected answer and an optional note of up to 140 characters. The note is cleaned for URLs, email-shaped text and the room code before sending, and is not stored in Boardit’s app database. Please do not include sensitive information in it.

Other PostHog events can include the game type, internal room UUID, public/private status and how an action happened. When identifying a player, Boardit sends the account UUID, public handle and whether the profile is a guest; email and password are not sent as analytics properties. Page paths are redacted before capture. Automatic click capture, session replay, heatmaps, dead-click capture and surveys are disabled in Boardit’s code. PostHog’s account settings also affect collection and retention.

Google AdSense. Boardit loads Google’s AdSense script on the home page and the six game pages when configured. It never loads in a room, at a game table, on sign-in pages or on this page. Loading the tag can send requests and use cookies or similar technologies even when no ad is displayed. Google and its advertising partners may process identifiers, IP addresses and browser/request information to provide, measure and protect advertising. Third-party vendors, including Google, use cookies, web beacons and similar identifiers to serve ads based on a visitor’s prior visits to this and other websites; Google’s advertising cookies let it and its partners do this. Personalization depends on the ad request and account settings. You can turn off personalized advertising from Google, and review its advertising preferences, at My Ad Center and read how Google uses information from sites that use its services. Other participating third-party vendors can be opted out of at aboutads.info, or, in Europe, youronlinechoices.eu.

Consent in Europe. Visitors in the European Economic Area, the United Kingdom and Switzerland are shown Google’s consent message on pages that carry the AdSense script, and the choice made there decides whether Google may use cookies and personal data for advertising. To change it later, clear this site’s cookies in your browser and reload a page: the message appears again. That message covers Google’s advertising only.

Boardit’s own analytics are set more strictly for the same regions. For visitors in the European Economic Area, the United Kingdom and Switzerland, Boardit tells Google Analytics, before it starts, that analytics and advertising storage are denied, so Google Analytics there sets no cookies and sends only cookieless measurement. On a device set to a European time zone, PostHog keeps its identifier in memory for the life of the page and stores nothing on the device.

Boardit currently has no in-site control to opt out of Google Analytics or PostHog. Browser settings or an appropriate browser tool can block analytics and ad technologies, but may not remove data already collected by providers. Google advertising preferences do not opt you out of Boardit’s separate analytics.

Who your data is shared with

Boardit does not sell personal information. Supabase provides authentication, database and realtime services; Resend delivers account emails; Cloudflare Workers hosts the site and Cloudflare provides DNS and network/security services; Google provides Analytics and the configured AdSense tag; and PostHog receives product analytics. Each provider processes information under its own terms and privacy notice. Boardit also stores the restricted operational history described above.

How long it is kept

Boardit’s cleanup is scheduled every five minutes. Guests become eligible for deletion after 30 days without relevant sign-in, session-refresh or table activity, with an exception for a guest hosting a retained finished game involving a registered player. New idle lobbies expire after ten minutes. Rooms in progress can remain open for up to twelve hours and become eligible for earlier removal after two hours without player activity. Finished room data becomes eligible for removal after 30 minutes without a player seen. Empty lobbies and finished rooms can be removed sooner. Chat and live game state are removed with the room.

A registered account remains until deletion is requested. Operational account, room, game and site-activity logs are deleted automatically after 400 days (a deleted account’s log entry 400 days after the deletion), and attempt counters after one day. Analytics, advertising, email, authentication logs and backups are subject to provider and account retention settings. Those provider-specific periods are not yet confirmed in this notice; contact us for information about your data.

How it is protected

Every page is served over HTTPS, and browsers are told to refuse a plain connection for two years. Passwords are stored as hashes by Supabase Auth and are never visible to Boardit. Repeated wrong passwords pause sign-in to that account for a while, and the number of new guests, new accounts, account emails and wrong room codes from one place is limited. Access rules in the database limit what each player’s browser can read and change: a private table is never listed for strangers to browse, chat is read only by the people in that room, and a player removed from a room can no longer see it. The chat and name filters run in the database too, so they cannot be skipped. Room codes are treated as passwords: they are stripped from analytics and kept out of search engines and referrer headers. No system is perfectly secure; if you find a security problem, email hello@playboardit.com (also listed in security.txt).

Where your data is processed

Boardit is run from Egypt, and the services listed above run their own infrastructure in several countries, so your data can be processed outside the country you live in. PostHog is used through its EU-hosted service. Each provider applies its own safeguards for international transfers, described in its privacy notice.

Browser privacy signals

Boardit does not currently change what it collects in response to a browser’s Do Not Track or Global Privacy Control signal. The controls that do apply are the ones described above: Google’s consent message in Europe, Google’s ad settings, and your browser’s own blocking tools.

Your rights

To ask what personal data Boardit holds, request correction, or ask for account or data deletion, email privacy@playboardit.com. This is a manual request channel; there is no self-service deletion control. Account deletion does not currently remove every restricted operational-history row, and separate requests to analytics or other providers may be needed. We will explain what can be deleted and any information that must be retained. The rights available to you depend on applicable law. If you are unhappy with how we handle your data, you can also complain to the data protection authority where you live.

Children

Boardit is not directed at children under 13 and does not knowingly collect their data. If you believe a child has made an account, email the address above and it will be removed.

Changes

If this policy changes, the date at the top changes with it. There is no mailing list to announce it on, because there is no mailing list.