Privacy Policy

BoardGameEdge is a small suite of board-game tools run by one person. This page describes exactly what the platform stores, why, and for how long. It is written from the code rather than from a template — if something here stops matching what the software does, that is a bug worth reporting.

Who runs this

BoardGameEdge is operated by an individual, not a company. Questions, corrections and deletion requests all go to admin@boardgameedge.com.

What is stored about you

Your account

When you register, the platform stores your email address, your username, a bcrypt hash of your password (never the password itself), whether your email has been verified, and the date the account was created. Email verification and password-reset links are stored as single-use tokens with an expiry.

Access to individual apps

Some apps in the suite are gated. The platform records which apps you have been granted access to and when, any access request you submit (the app and the email you submitted), and whether you hold an administrator role.

Signing in

Signing in sets one first-party cookie, bge_session, scoped to .boardgameedge.com so a single sign-in works across every app in the suite. It contains a signed token identifying your account and expires after 30 days. It is strictly necessary for the service to function.

There are no analytics cookies, no advertising cookies, and no third-party trackers on this site. Nothing here profiles you, and nothing is sold or shared for marketing.

If you use an installed application that signs in to BoardGameEdge, the authorization codes and refresh tokens behind that sign-in are stored hashed, so a copy of the database cannot be used to replay them.

Game data

Apps that record play history store one row per finished game: the date played, whether you won, the scores, the difficulty settings, and an app-specific summary of the game. This is yours — the apps that record it also let you export it.

Email you forward to the platform

Some features work by letting you forward email (for example an order confirmation or a shipping notice) to a BoardGameEdge address. When you do, the platform stores the message: sender, recipient, subject, the text and HTML bodies, the message headers, and a copy of any attachments.

Message bodies and attachments are deleted after 90 days. A minimal record that the message arrived is kept beyond that. Forwarding is always something you choose to do, message by message — so please forward only what you are comfortable having stored, and note that a forwarded email carries whatever the original sender put in it.

admin@boardgameedge.com is a public contact address. Mail sent to it is stored the same way and read by the operator.

Who else touches your data

The platform runs on a single virtual server rented from a cloud hosting provider, and the database lives on that server. Beyond the hosting provider, three services are involved:

• Resend delivers and receives email — verification and password-reset messages, and the forwarded mail described above.
• Ko-fi handles donations, if you choose to make one. Donations happen entirely on Ko-fi's site.
• PayPal processes the donation payment on Ko-fi's behalf.

The platform never sees or stores your card or bank details. Donating is optional and is not connected to your BoardGameEdge account.

Your data is not sold, rented, or shared with anyone else. It would be disclosed only if legally required.

How it is protected

Passwords are hashed with bcrypt. Sign-in tokens are signed, and the tokens behind installed-app sign-in are stored hashed. Every page and API is served over HTTPS. If a breach affecting accounts is ever discovered, affected users will be notified by email at the address on their account.

Deleting your account

Email admin@boardgameedge.com from the address on the account and ask. Your account, access grants and game data will be deleted. There is no self-service delete button yet; the request is handled by hand.

You can also ask for a copy of what is stored about you, or ask for something to be corrected, the same way.

Children

These tools are not directed at children under 13, and accounts are not knowingly created for them.

Changes

If this policy changes, the date at the top changes with it. Material changes to how your data is handled will be announced by email to registered users.