The Board Games

Privacy

The Board Games lets two people play board games through a shared link. You can play as a guest without an account. This page explains what we store, why, and what you can do about it.

01Who is responsible

The controller of your data is the operator of The Board Games: Nguyễn Đức Thọ, [email protected]

02What we collect

  • Guests: nothing on our server, except that a game you play against a member is saved in that member's history (see below). Your browser keeps your guest name (e.g. Anonymous04718263) and a seat key for each game.
  • Members (signed in with Google): your Google account ID (a number, not your email), the display name you choose, when you created the account, and your finished games.
  • Finished games with at least one member: the game, both display names at the time, the result and why it ended, every move in order, and start and end times.
  • IP address: our server needs it to talk to your browser while you play. The Board Games does not store it; our hosting provider's technical logs may record it.

03Why, and on what legal basis

  • To run your account and show your game history: performing the service you asked for (GDPR Art. 6(1)(b)).
  • To keep a guest's moves and guest name inside a member's saved game, so the member has a complete history: our legitimate interest in providing that history (Art. 6(1)(f)). Guest names are pseudonyms and are not linked to any account.
  • Technical logs: our legitimate interest in keeping the service secure and running (Art. 6(1)(f)).
  • Usage analytics: your consent in the EEA, the UK and Switzerland (Art. 6(1)(a)); elsewhere our legitimate interest in learning how the service is used, which you can switch off at any time (Art. 6(1)(f)). See Usage analytics.

04Who receives data

  • Google, as the sign-in provider. When you sign in, Google sends us a signed token that includes your name, email address and profile picture. We read only your account ID from it and do not store the rest.
  • Our hosting providers, Amazon Web Services and Cloudflare, which process the data on our behalf.
  • The other player and anyone with the game link see the display names in that game.
  • Google, for usage analytics, if you allow it (see Usage analytics).

We do not sell data, show ads, or share data with anyone else.

05Transfers outside the EU / UK

Sign-in uses Google, which may process data in the United States under its own safeguards. Our server is in the United States (Amazon Web Services, region us-east-1), and traffic passes through Cloudflare. Data sent to it, such as your IP address and the moves you play, is therefore processed in the United States. For these transfers we rely on the Standard Contractual Clauses in those providers' data processing terms. Usage analytics (Google) may be processed in the United States under the EU–US Data Privacy Framework and the Standard Contractual Clauses; see Usage analytics.

06How long we keep data

  • Your account and your games: until you delete your account.
  • Sign-in sessions (when each was created and when it expires): 30 days, or until you sign out.
  • Technical logs: as long as our hosting provider keeps them.
  • Usage analytics: 14 months at Google, then deleted; see Usage analytics.

07Your rights

You can see and download your data (Account → Download my data), correct your display name (Account → Display name), and delete your account (Account → Delete account). You may also ask us to restrict processing or object to it, using the contact above. You have the right to complain to a data protection supervisory authority, for example the one where you live.

08Do you have to give us data?

No. You can play as a guest. Signing in is needed only if you want a saved history; we need your Google account ID to recognise you.

09Automated decisions

We make no decisions about you by automated means.

10Storage on your device

We use one cookie, sid, to keep you signed in, and your browser's local storage for your guest name, your seat in each game, whether you have passed the age check, and your light or dark mode choice (dg-theme). These are strictly necessary for the service, so we do not ask for consent. Google's sign-in script is loaded only after you click Sign in. Google Analytics, and its _ga cookies, are used only as described under Usage analytics; your choice is kept in local storage (dg-analytics).

11Minimum age

Accounts are for people aged 16 or older. We ask for your date of birth before sign-in, use it only to check your age in your browser, and never send or store it.

12Google user data

We use Google Sign-In only to recognise your account. We store only your Google account ID, never share Google user data, and never use it for advertising. Our use of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements.

13Tournaments

Anyone can create a tournament and invite players with its link or code. For each tournament our server stores:

  • the tournament's name, game, time control and settings, and its code;
  • each player's display name at the time (a guest name such as Anonymous04718263, or a member's display name, linked to the member's account);
  • a key for each player's place, kept only as a one-way hash (your browser keeps the key itself, so it can bring you back to your place);
  • the pairings and the result of each game. We do not store the moves of tournament games.

Anyone with the tournament's code or link can see the players' names, the pairings, the results and the standings. Why: to run the tournament you joined (GDPR Art. 6(1)(b)).

How long: a finished tournament is deleted 90 days after it ends; a tournament that never starts is deleted 7 days after it was created; a tournament left with no new result or round for 30 days is closed as abandoned and deleted 90 days after its last result or new round; the organiser can delete it at any time, and everything stored about it goes with it. A member who deletes their account is shown as “Deleted user” in tournaments, and the results stay for the other players.

To prevent abuse, the server counts in memory how many tournaments an IP address has open (at most 5) and how often it looks up codes (as for room codes). These counts are never written to disk and disappear when the tournament closes, the minute ends, or the server restarts.

14Usage analytics

To learn which games and features are used, and to improve them, we use Google Analytics 4, provided by Google Ireland Limited (in the EEA, the UK and Switzerland) or Google LLC (elsewhere), acting as our processor.

  • What is sent: the pages you open, with room and tournament codes taken out of the address (for example /r/:code); events such as a room created or joined, a game started or ended (the game, the time control, the result and how it ended, the number of moves rounded to 10), a practice or pass-and-play game started or ended (the game and the level), a rematch, and tournaments created, joined or started (the game and the number of players rounded to 4); plus what your browser tells any website: device and browser type, screen size, language, and your approximate location (country, region and city), which Google derives from your IP address. Google Analytics 4 does not log or store IP addresses.
  • What is never sent: names, room or tournament codes, moves, seat keys, your account, or any user ID. Google Signals and ad personalisation are off, and we show no ads.
  • On your device: Google Analytics sets the cookies _ga and _ga_<id> (a random ID for this browser) once you allow analytics. The app (iPhone, iPad, Android) does not collect usage analytics.
  • Legal basis: in the EEA, the UK and Switzerland, your consent (GDPR Art. 6(1)(a)): nothing of Google Analytics is loaded until you choose Accept. Elsewhere analytics is on by default, on the basis of our legitimate interest in learning how the service is used (Art. 6(1)(f)), and you can turn it off.
  • How long: Google keeps the event data for 14 months, then deletes it.
  • Transfers: Google may process this data in the United States, under the EU–US Data Privacy Framework (and its UK and Swiss extensions) and the Standard Contractual Clauses in Google's data processing terms.

You can change your choice at any time; turning it off stops measuring at once and removes the _ga cookies on this site.