Privacy Policy

Last updated: March 2026

1. Data Controller

The data controller for personal information processed through Boardoor is the sole proprietor operating Boardoor.

Contact: support@boardoor.com

2. Information We Collect

We collect the following categories of information:

• Account information: username, email address, avatar URL, and profile information such as slug and bio
• Authentication data: hashed passwords for email/password accounts, and Google account identifiers and profile information received from Google when you sign in with Google. We do not persistently store OAuth access tokens or refresh tokens.
• Game data: match history, match results, game actions, ratings, and game statistics
• Technical data: IP address, browser type, and access timestamps for security, rate limiting, and abuse prevention

3. How We Use Your Information

We use your information for the following purposes:

1. To register accounts, verify identity, and maintain login sessions
2. To create and join matches, operate gameplay, and display match records
3. To display your profile to other users
4. To respond to inquiries and send important notices
5. To prevent abuse, enforce rate limits, and monitor security
6. To analyze incidents, improve performance, and conduct access analytics
7. To comply with legal obligations, exercise rights, and handle disputes

4. Legal Basis for Processing

For users in the EU, EEA, and UK, we process personal data on the following legal bases under GDPR and equivalent laws:

5. Data Sharing

• We do not sell personal information and do not share personal information for cross-context behavioral targeted advertising.
• Cloudflare: We use Cloudflare as an infrastructure provider and processor. Cloudflare may process personal information to the extent necessary for hosting, content delivery, data storage, security, and log management.
• Google: We use Google as an external authentication provider. If you choose Google sign-in, we receive verified profile information from Google. Google's processing of data is governed by Google's privacy policy.
• We may share information to comply with legal obligations.
• We may share information where you have given consent.

6. International Data Transfers

• Data may be processed on Cloudflare, Inc.'s global network.
• This may include transfers to the United States and other countries or regions where Cloudflare's network operates.
• Where required by applicable law, we rely on Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms.

7. Cookies and Similar Technologies

We use the following cookies and similar technologies:

• Session management: to maintain your logged-in state
• Authentication: for CSRF and PKCE protections, including OAuth security cookies
• Language preference: `lng`
• Theme preference: `theme`
• Invitation code storage: to retain invitation codes
• Post-login redirect control: to return you to the intended page after login
• We do not use advertising cookies or cross-site tracking cookies.
• We may use Cloudflare Web Analytics to collect technical data about access to the service.

8. Data Retention

We retain personal information by category as follows:

• Sessions: until last use or expiration
• OAuth security cookies: for up to 10 minutes
• Account information: until account deletion, although we may retain some information for a reasonable period afterward for legal compliance or dispute handling
• Match history and records: for as long as needed to display match results and records
• Rate limiting and IP logs: for the period necessary for abuse prevention
• After account deletion, we delete data except where retention is required by law.

9. Your Rights

All users have the following rights:

• Right of access
• Right to rectification
• Right to erasure
• Right to data portability

Users in the EU, EEA, and UK may also have the following additional rights:

• Right to request restriction of processing
• Right to object
• Right to withdraw consent
• Right to lodge a complaint with a data protection supervisory authority in the place of your habitual residence, place of work, or the place of the alleged infringement

To exercise your rights, contact support@boardoor.com.

10. Security

• Password hashing using scrypt
• Encryption of communications using HTTPS
• Cookies with HttpOnly and Secure attributes
• Access controls
• Rate limiting and unauthorized access countermeasures
• Vendor selection and contractual management
• However, no method of transmission or storage is 100% secure.

11. Confidentiality of Communications

• We may handle communications-related information to the extent necessary to provide the online gameplay service, maintain connections, respond to incidents, implement security measures, and prevent abuse.
• Except where permitted by law, we do not use information protected by the confidentiality of communications for purposes other than providing the service.

12. Children's Privacy

• The service is not directed to children under 13, and we do not knowingly collect personal information from children under 13.
• If we learn that we have collected personal information from a user under 13, we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If changes are material, we will post a notice within the service.

14. Contact

Contact: support@boardoor.com