Privacy Policy

Last updated: July 29, 2026

1. Data Controller

The data controller for personal information processed through Boardoor is the sole proprietor operating Boardoor.

Contact: support@boardoor.com

2. Information We Collect

We collect the following categories of information:

• Account information: username, email address, avatar URL, and profile information such as slug and bio
• Authentication data: hashed passwords for email/password accounts, and Google account identifiers and profile information received from Google when you sign in with Google. We do not persistently store OAuth access tokens or refresh tokens.
• Game data: match history, match results, game actions, ratings, and game statistics
• Communication and safety data: direct and match-room messages, blocks, notification preferences, moderation reports, appeals, and the minimum evidence needed to investigate abuse or disputes
• Commerce data: seller profile, legal disclosure and identity-verification status; product, order, shipping, payment, refund, payout, dispute, and review records. We do not store complete payment-card numbers.
• Technical data: IP address, browser type, and access timestamps for security, rate limiting, and abuse prevention

3. How We Use Your Information

We use your information for the following purposes:

1. To register accounts, verify identity, and maintain login sessions
2. To create and join matches, operate gameplay, and display match records
3. To display your profile to other users
4. To respond to inquiries and send important notices
5. To prevent abuse, enforce rate limits, and monitor security
6. To analyze incidents, improve performance, and conduct access analytics
7. To comply with legal obligations, exercise rights, and handle disputes

4. Legal Basis for Processing

For users in the EU, EEA, and UK, we process personal data on the following legal bases under GDPR and equivalent laws:

5. Data Sharing

• We do not sell personal information and do not share personal information for cross-context behavioral targeted advertising.
• Cloudflare: We use Cloudflare as an infrastructure provider and processor. Cloudflare may process personal information to the extent necessary for hosting, content delivery, data storage, security, and log management.
• Google: We use Google as an external authentication provider. If you choose Google sign-in, we receive verified profile information from Google. Google's processing of data is governed by Google's privacy policy.
• We may share information to comply with legal obligations.
• We may share information where you have given consent.

6. International Data Transfers

• Data may be processed on Cloudflare, Inc.'s global network.
• This may include transfers to the United States and other countries or regions where Cloudflare's network operates.
• Where required by applicable law, we rely on Standard Contractual Clauses (SCCs) or other lawful transfer mechanisms.

7. Cookies and Similar Technologies

We use the following cookies and similar technologies:

• Session management: to maintain your logged-in state
• Authentication: for CSRF and PKCE protections, including OAuth security cookies
• Language preference: `lng`
• Theme preference: `theme`
• Invitation code storage: to retain invitation codes
• Post-login redirect control: to return you to the intended page after login
• Cookie attributes: authentication and session cookies use HttpOnly and Secure attributes. Preference cookies such as lng and theme are client-readable so the app can apply language and theme settings.
• We do not use advertising cookies or cross-site tracking cookies.
• We may use Cloudflare Web Analytics to collect technical data about access to the service.

8. Data Retention

We retain personal information by category as follows:

• Sessions: until last use or expiration
• OAuth security cookies: for up to 10 minutes
• Self-service account deletion: the request immediately deactivates the account, revokes all sessions, and hides the profile and seller listings. For 30 days, the account may be recovered only with its original password or Google sign-in method. After that deadline, later sign-in does not restore the account and final purge removes or anonymizes personal data where possible.
• Moderation action: a moderation-initiated suspension or deactivation is not recoverable through the self-service account-deletion flow.
• Matches: full match state and technical logs are normally kept for 90 days after a match ends. Match summaries may remain while participants use the service and are anonymized when required by participant deletion. Replay data is currently held without an automatic expiry while its retention policy is under review; the final period will be disclosed before public Replay activation.
• Messages: direct messages have no inactivity expiry. When a sender reaches final account purge, that sender's direct-message body is removed and replaced by a deleted-account marker. Match-room messages are normally kept for 180 days after the match ends. Active moderation or legal holds suspend the relevant expiry.
• Moderation: unresolved reports and appeals are held without an automatic expiry. After case closure, minimum evidence is normally kept for one year, or longer while a legal hold applies.
• Commerce: shared reviews may remain with a masked or deleted-account author. Seller legal/KYC and order, payment, refund, payout, and dispute records may be kept privately for legal, statutory, contract, safety, and dispute-handling purposes. They are not restored to public seller listings after final purge.
• Rate limiting and IP logs: for the period necessary for abuse prevention
• Shared match/chat content, moderation evidence, legal holds, and commerce records may remain or be anonymized where necessary for communication integrity, safety, disputes, legal obligations, or statutory recordkeeping.

9. Your Rights

All users have the following rights:

• Right of access
• Right to rectification
• Right to erasure
• Right to data portability

Users in the EU, EEA, and UK may also have the following additional rights:

• Right to request restriction of processing
• Right to object
• Right to withdraw consent
• Right to lodge a complaint with a data protection supervisory authority in the place of your habitual residence, place of work, or the place of the alleged infringement

To exercise your rights, please contact support@boardoor.com. Include enough information to verify your identity (e.g., your registered email address). We will respond within approximately two weeks of receiving your request. There is no fee for submitting a request.

10. Security

• Password hashing using scrypt
• Encryption of communications using HTTPS
• Authentication and session cookies with HttpOnly and Secure attributes
• Access controls
• Rate limiting and unauthorized access countermeasures
• Vendor selection and contractual management
• However, no method of transmission or storage is 100% secure.

11. Confidentiality of Communications

• We may handle communications-related information to the extent necessary to provide the online gameplay service, maintain connections, respond to incidents, implement security measures, prevent abuse, investigate moderation reports, and preserve evidence subject to the retention and legal-hold limits in Section 8.
• Except where permitted by law, we do not use information protected by the confidentiality of communications for purposes other than providing the service.

12. Children's Privacy

• The service is not directed to children under 13, and we do not knowingly collect personal information from children under 13.
• If we learn that we have collected personal information from a user under 13, we will delete it promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. If changes are material, we will post a notice within the service.

14. Contact

Contact: support@boardoor.com