Privacy policy

Effective date: 2026-11-01

This Privacy Policy is the full information about the personal data processed in BoardConquest under art. 13 and 14 of the GDPR (Regulation (EU) 2016/679): what data, why, on what legal basis, who receives it, how long we keep it and what your rights are. The Terms of service refer to it in section 12.

1. Controller and contact

The controller is Dawid Sugajski, who owns the BoardConquest SaaS application and runs it as an unregistered business activity. Contact for privacy, account and technical support matters: admin@boardconquest.com.

Postal address: Grodzieńska 16 Wrocław 51-356

2. Data we process

  • account data: e-mail address, password hash (or the link to your Google account if you sign in with Google), nickname, profile picture, privacy and newsletter settings,
  • library data: game titles, metadata, covers, PDF rulebooks, language versions, favourites,
  • Rules Arbiter data: questions, answers and the context needed to search a rulebook; a conversation is deleted 90 days after its last message,
  • BoardGameGeek data if you start a sync: BGG username, collection, game statuses, expansions, logged plays,
  • planner data: meetings, invitations, invited e-mail addresses, votes, locations, scores, photos and play history,
  • clubs and friends: clubs you run or join, club pages, board posts, club meetings, friend links and what you share with friends (for example your library, if you turn it on),
  • people invited by e-mail who have no account: the e-mail address (and the name, if given) that the inviting user enters and the answer to the invitation, used only for that invitation and its updates; an address that asks for no more invitations is kept only as a hash, so that it is not invited again,
  • calendar integration data: identifiers and technical information needed for Google Calendar or ICS feeds,
  • push notifications, if you turn them on: the address of your browser's push service and its keys,
  • publisher accounts: the publisher's name, website, contact e-mail, the information given for verification, the accepted version of the publisher terms and the rulebooks published,
  • payment and subscription data received from Paddle, such as transaction ID, subscription status and plan,
  • withdrawal from a contract: the confirmation we send to your e-mail, and a message to us with your e-mail address, account, plan, Paddle subscription number and the time of the withdrawal,
  • content reports and moderation: a copy of the reported content, its author's account, the reason and explanation given, the reporter's account if signed in, and the reporter's name and e-mail if given (both optional), the decision and its reasons; decisions about your content or Account and the reasons sent to you,
  • messages to us: what you write through the contact page or by e-mail, with your e-mail address, including complaints and requests about your data,
  • technical data: security logs, IP address, error information, necessary cookies and localStorage,
  • usage statistics - only after consent and only in anonymous form: which features are used, with no account, e-mail, device or other identifier. To count people once a day, a key made from your account and a random value is kept only in temporary server memory until the end of that day and then deleted, so the statistics cannot be linked to you or across days; optional preferences - only after consent.
  • game counts for publishers - only with a separate consent, which stays off unless you tick it at sign-up or in your privacy settings: from the libraries, logged plays, rankings, chosen player counts, rulebook languages and Rules Arbiter questions of consenting accounts we count, per game, how many accounts own it, play it, rank it or ask about it. Board game publishers may receive these counts, only for groups of at least 5 accounts and with nothing that identifies a person. You can withdraw the consent at any time in your privacy settings; your account is then left out of the next counts. The legal basis is your consent - GDPR art. 6(1)(a).
  • Messages and pictures you send to other players: kept for 90 days, then deleted.

3. Purposes and legal bases

Account, library, Rules Arbiter, BGG, planner, club, friend, push notification, publisher and subscription data is processed to perform the service contract - GDPR art. 6(1)(b). The confirmation of a withdrawal from a contract is part of performing it - art. 6(1)(b). Data required by tax and accounting law, answers to complaints, the handling of content reports and statements of reasons under the Digital Services Act, and informing the authorities of a threat to life or safety (DSA art. 18) are processed to meet legal obligations - art. 6(1)(c). Security logs, abuse prevention, the bot check, invitations that a user sends to people without an account, answers to other messages, keeping withdrawal records and the defence of claims rely on our legitimate interests in a safe service, in letting users invite others and in handling matters - art. 6(1)(f); you can object to this processing (section 9). The newsletter is based on consent - art. 6(1)(a) and art. 398 of the Polish Electronic Communications Law. Usage statistics, game counts for publishers and optional preferences are each based on a separate consent - art. 6(1)(a).

Giving the account data is a condition of the contract: without an e-mail address and a password (or a Google sign-in) we cannot create an Account. Everything else is voluntary: you decide what you add, and the newsletter, usage statistics, game counts for publishers and optional preferences need your consent. A content report can be sent without a name or e-mail.

4. Recipients

Data is shared only as needed to run the Service, with: providers of hosting, database, file storage and error monitoring (the app runs on Microsoft Azure); the e-mail delivery provider; the language-model provider OpenAI, which receives rulebook content and your questions only to write answers and analyses; Paddle.com Market Ltd, the Merchant of Record for payments; BoardGameGeek when you start a sync; Google when you sign in with Google or turn on calendar integration; your browser's push service when you turn on notifications. Content you publish is seen by the people it is meant for (friends, club members, or anyone for a public club page). Board game publishers receive only the counts described in section 2, never personal data. The author of reported content is not told who reported it. Law enforcement and judicial authorities receive data only when the law requires it, for example when information suggests a threat to someone's life or safety (DSA art. 18).

To tell people from bots, the sign-up and password reset forms, the report form for signed-out visitors, and the sign-in form after several failed attempts, use Cloudflare Turnstile (Cloudflare, Inc.). For this check, Cloudflare receives your IP address and technical browser signals. Turnstile does not set tracking cookies and its data is not used for advertising.

5. Paddle and payments

Our order process is conducted by Paddle.com. Paddle.com Market Ltd is the Merchant of Record for paid orders, collects payment, calculates taxes and issues purchase documents. BoardConquest receives from Paddle the information needed to activate and manage subscriptions, but does not store full payment card details.

6. Transfers outside the EEA

Some providers process data outside the European Economic Area, in particular in the United States (for example OpenAI) and in the United Kingdom (Paddle). Transfers to the United States rely on the EU-US Data Privacy Framework (Commission Decision (EU) 2023/1795) where the recipient is certified under it, and otherwise on the standard contractual clauses adopted by the European Commission (Decision (EU) 2021/914). Transfers to the United Kingdom rely on the Commission's adequacy decision for the United Kingdom. You can get a copy of these safeguards from admin@boardconquest.com.

7. Retention

Account and content data is kept while the account exists. When you close your account, it is deleted after 30 days (until then you can sign in to keep it); copies in backups disappear when the backups expire, at the latest 12 months after the deletion. Rules Arbiter conversations: 90 days after the last message. Server log files: 14 days. Content reports and their decisions: one year after the decision. Withdrawal records: as long as claims about the purchase may be brought. Billing data that tax and accounting law requires us to keep: for that period (in Poland usually 5 years). Messages to us and complaints: while the matter is handled and then as long as claims about it may be brought. Newsletter data is kept until consent is withdrawn. Anonymous usage statistics are kept for 13 months; as nothing in them identifies you, they cannot be found or deleted for one person, and withdrawing consent stops new ones.

8. Cookies and localStorage

Strictly necessary cookies and browser storage (sign-in, protection against forged requests, your language) need no consent (art. 399 par. 3 point 2 of the Polish Electronic Communications Law and art. 5(3) of the ePrivacy Directive). Functional storage (theme, planner timer, autocomplete history, library filters) and the usage statistics are used only after consent, which you give or withdraw at any time in the cookie banner or, for the statistics, in your privacy settings. Withdrawing the functional consent deletes those entries from your browser.

9. Your rights

You have the right to access your data and get a copy of it (also with "Download my data" in your account settings), to rectify and erase it, to restrict processing, to data portability, to object to processing based on our legitimate interests, and to withdraw consent at any time without affecting the processing before. Send requests to admin@boardconquest.com; we answer within one month. You may also lodge a complaint with a supervisory authority, in particular in the EU country where you live or work or where the infringement took place; in Poland this is the President of the Personal Data Protection Office (Prezes UODO, uodo.gov.pl).

10. Automated decisions

BoardConquest does not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. The automatic check of public club pages may hide a page until a person reviews it; every removal and suspension is decided by a person (Terms, section 20). The Rules Arbiter writes informational answers from rulebooks and does not replace the official rules of a game.