Privacy Policy

This policy explains what personal data Boardly processes, why, on what legal basis, who receives it, how long we keep it and which rights you have. "We" means the Boardly team.

1. Who is responsible for your data

The controller for the personal data described in this policy is Denys Koval, Gøteborggata 42, 0567 Oslo, Norway, who runs Boardly.

Write to support@boardly.online about anything in this policy, including access, correction, deletion, export and objections.

We have not appointed a data protection officer: the law does not require one for a service of this kind.

2. What we process, why, and on what legal basis

The legal bases come from the GDPR, which applies in Norway through the Personal Data Act: contract (Art. 6(1)(b)) where we need the data to give you the service you asked for, legitimate interest (Art. 6(1)(f)) where we name the interest, and consent (Art. 6(1)(a)) where you chose to give it and can withdraw it at any time.

Your account

What we process: Username, email address, your password stored only as a one-way bcrypt hash, profile picture, bio, accent colour and preferences, the sign-in providers you linked, the time of your last password reset or email change (used only to sign out older sessions), the site or campaign you arrived from when you signed up, and when you accepted the Terms and confirmed that you are 13 or older.
Legal basis: Contract: your account rests on the Terms you accept when you create it, not on consent, and we need this to run it. The sign-up source: our legitimate interest in knowing which channels bring new players.
How long we keep it: Until you delete the account. From January 1, 2027 we also delete an account that has not been used for 24 months: we email you 30 days before, and signing in once keeps the account. An account that has or has had Premium, has ever started a Premium purchase or is suspended is not deleted for that reason. If you sign up with an email address and password and never verify the address, the account is deleted after 7 days, unless you have linked Google, GitHub or Discord to it or it has Premium or has ever started a Premium purchase.

Your username, your picture and your leaderboard results are visible to everyone, whatever your settings: the public leaderboard lists them for every account with enough finished games, and your profile page always shows your username and picture, with a note that the profile is private when it is. The rest of your profile (bio, game statistics, achievements, Premium status, and online status, which you can also switch off on its own) follows its visibility setting: everyone can see it if the profile is public, only your friends if it is friends-only, and nobody but you if it is private. In lobbies and games you shared, the other players also see your Premium badge and the game results, including on your player card there, whatever the setting. A new account starts friends-only, with online status hidden. When you first sign in we offer to make the profile public, and you can change both at any time in your profile settings. Accounts created before this change keep the settings they had: a public profile and online status shown, unless changed.

Playing as a guest

What we process: A guest name, a random guest id, when you were last active, and your seats in games. No email address and no password.
Legal basis: Contract: we need this to let you play without an account.
How long we keep it: A guest who never played is deleted after 3 days without activity, a guest who played after 90 days. The name is then replaced with "Deleted player" in other players' game records and replays.

Games, lobbies, chat and friends

What we process: The lobbies you create or join, your moves, scores and results, game replays, lobby chat messages, friends, friend requests, lobby invites, notifications and achievements.
Legal basis: Contract: this is the service itself.
How long we keep it: Games: 12 months after the game ends, we remove the names, questions, answers, guesses and drawings from the game record; the scores and results stay, tied to a player id instead of a name, for your statistics, the leaderboard and achievements. Lobbies: 12 months after creation, an inactive lobby in which no game ever started is deleted together with those games; a lobby in which a game was played gets a neutral name, and its code is released for new lobbies, once its games have been through the step above. Replays: 90 days. Lobby chat: 24 hours, except a message someone reports: the report keeps a copy of it (see "Reports of chat, drawings and profiles"). Notifications: 12 months. Friends and achievements: until the account is deleted.

Signing in with Google, GitHub or Discord

What we process: Your account id at that provider, your name, email address and picture, and the tokens the provider issues to us. The provider learns that you signed in to Boardly.
Legal basis: Contract: you chose this way to sign in.
How long we keep it: Until you unlink the provider or delete the account.

Emails we send you

What we process: Your email address and the message: verification and password-reset links, security notices, game invites from friends, the notifications you choose, purchase confirmations, notices of changes to our Terms, a warning before an account that has not been used is deleted and, while a Premium subscription runs, a reminder at least every six months that it is running and how to end it. When someone asks to change an account's email address, we send a security notice to the old address with the new one partly hidden. To stop floods of verification and reset emails we keep a shortened one-way hash of the address for 10 minutes and a daily counter for 26 hours.
Legal basis: Contract. The subscription reminder: a legal obligation (the Norwegian act on digital services, digitalytelsesloven § 33). Security notices and the email limits: our legitimate interest in protecting accounts and preventing abuse.
How long we keep it: Notification records: 12 months. Resend, which delivers the emails, keeps its own delivery log for the period its service sets.

News about Boardly by email

What we process: Only if you tick the box at sign-up or turn it on in your profile settings: that you agreed, and when. We do not send such emails yet.
Legal basis: Consent.
How long we keep it: Until you withdraw it or delete the account. You can withdraw it with the setting in your profile, or with the one-click unsubscribe link every such email will carry, free of charge and without signing in.

Push notifications

What we process: Only if you turn them on: the push address and keys your browser gives us, and your browser type. Each notification travels through your browser maker's push service.
Legal basis: Consent: you turn them on and can turn them off.
How long we keep it: Until you turn them off or delete the account.

Premium

What we process: Premium is sold through Link: Stripe's affiliate Sold through Link, LLC (USA) is the merchant of record and takes the payment. To calculate VAT or sales tax, Link collects your name, billing address and any tax ID at checkout, and it shares the order information with us: your contact details, billing address, payment information, tax ID and the order details. It also updates the name and billing address on your customer record in our Stripe account. We never receive your full card number. We keep your Stripe customer and subscription ids, your Premium status and dates, and a record of what you agreed to at checkout: the plan, the versions of the terms and the withdrawal information you were shown, and when you agreed.
Legal basis: Contract. The checkout record: also our legitimate interest in being able to show what you agreed to.
How long we keep it: Until you delete the account. We then cancel any subscription and delete your customer record at Stripe. Stripe and Link keep their own payment and order records as their privacy policies describe. Deleting your Link account cancels a subscription sold through Link and deletes the information you gave for that order.

Feedback and support

What we process: What you write in the feedback form, its type, the page you sent it from, an email address if you give one, and your account if you are signed in. A notification is posted to our team's feedback channel on our Discord server: the type, the first 200 characters of the message and the feedback's id. The email address you give, your username and the page are not posted. Emails to the support address reach us through Resend.
Legal basis: Our legitimate interest in answering you and improving Boardly.
How long we keep it: Feedback, including its notification in our Discord feedback channel: 12 months. Support emails: as long as we need them to handle your request.

Reports of chat, drawings and profiles

What we process: When a player reports a chat message, a Sketch & Guess drawing, or another player's username, profile picture or bio, we keep the report: who sent it, which player it is about, where it happened (the lobby, game and round), the reason and any note the reporter adds, and a copy of the reported content as it was at that moment – the message, the drawing, the name, the picture's address or the bio. Our staff read reports in our admin panel. A notification is posted to our team's feedback channel on our Discord server: the kind of content, the reason, the report's id and a short preview of the reported content – never who sent the report or their note. We never tell the reported player who reported them.
Legal basis: Our legitimate interest in keeping Boardly safe and in acting without undue delay on notices of unlawful or harmful content, as a service that stores what its users post (the Norwegian E-Commerce Act, ehandelsloven, section 18).
How long we keep it: Reports, including their notification in our Discord feedback channel: 12 months. The copy of the reported content is kept as long as the report, even when the original is gone sooner, and it stays if its author deletes their account; the report then loses its link to that account.

Keeping Boardly secure and running

What we process: Your IP address and browser details in our hosting provider's request logs; counters tied to your IP address that limit how often sign-in, joining, chat and similar actions can be repeated; error reports (the error, the page, browser and operating system) sent to Sentry; reports from your browser about content our security policy blocked (the rule, the page, the blocked address and sometimes a short piece of script), stored without any link to an account; technical events about how the site is running; and a log of actions our administrators take on accounts.
Legal basis: Our legitimate interest in keeping Boardly secure, available and free of abuse.
How long we keep it: Request logs: 1 day. Rate-limit counters: until their time window ends. Error reports: at most 90 days. Technical events and blocked-content reports: 180 days. Administrator log: 24 months.

Understanding how Boardly is used

What we process: Through Vercel Web Analytics and Speed Insights: the page, the referring site, country and region, browser, operating system, device type and load times. Vercel tells visits apart with a hash made from the request instead of a cookie and discards it after 24 hours. We also send game events such as the game, the number of players and how long it lasted; at the end of a Yahtzee game this includes each seat's score and which seat won (and whether it was a bot), never a name. For year-on-year counts we keep a record of lobby joins that holds only a salted hash, no id and no name.
Legal basis: Our legitimate interest in knowing which pages and games work and fixing what is slow.
How long we keep it: Lobby-join records: 24 months. Vercel keeps the analytics for the period its service sets.

3. Who receives your data

We do not sell your personal data. The providers below process it for us, except where we say they act on their own account. We disclose data to authorities only where the law requires it.

Supabase

What we use it for: Database, profile pictures and live game updates
Where the data is, and the safeguard for transfers outside the EEA: Stored in Zurich, Switzerland, which the EU recognises as adequate. Supabase is a US company and uses Standard Contractual Clauses.

Vercel

What we use it for: Hosting, server code, request logs, firewall and analytics
Where the data is, and the safeguard for transfers outside the EEA: Our server code runs in Frankfurt, Germany; requests reach it through Vercel's global edge network. Vercel is a US company and uses Standard Contractual Clauses.

Upstash

What we use it for: Lobby chat, rate limits and email limits
Where the data is, and the safeguard for transfers outside the EEA: Stored in Frankfurt, Germany. Upstash is a US company and relies on the EU-US Data Privacy Framework or Standard Contractual Clauses for any transfer.

Resend

What we use it for: Sending our emails and receiving mail to the support address
Where the data is, and the safeguard for transfers outside the EEA: USA. Resend uses Standard Contractual Clauses and is certified under the EU-US Data Privacy Framework.

Stripe / Link (Sold through Link, LLC)

What we use it for: Premium payments. Stripe keeps our customer and subscription records for us. Its affiliate Sold through Link, LLC is the merchant of record for Premium and acts on its own account, as an independent controller under Link's terms and privacy policy.
Where the data is, and the safeguard for transfers outside the EEA: Stripe: Stripe Payments Europe in Ireland, with transfers to Stripe in the USA under the EU-US Data Privacy Framework and Standard Contractual Clauses. Sold through Link, LLC: in the USA, so your order data is transferred there; Link's privacy policy names the EU-US Data Privacy Framework, which Stripe complies with, and Standard Contractual Clauses as its safeguards.

Sentry

What we use it for: Error reports
Where the data is, and the safeguard for transfers outside the EEA: Stored in Sentry's EU data region in Frankfurt, Germany. Sentry is a US company and relies on the EU-US Data Privacy Framework, with Standard Contractual Clauses as the fallback.

Discord

What we use it for: Sign-in, Linked Roles and the public lobby feed (on its own account), our feedback and alert channels
Where the data is, and the safeguard for transfers outside the EEA: USA. Discord is certified under the EU-US Data Privacy Framework and uses Standard Contractual Clauses.

Google

What we use it for: Sign-in with Google, and the AdSense script with its consent message (on its own account)
Where the data is, and the safeguard for transfers outside the EEA: USA. Google is certified under the EU-US Data Privacy Framework and also uses Standard Contractual Clauses.

GitHub

What we use it for: Sign-in with GitHub (on its own account)
Where the data is, and the safeguard for transfers outside the EEA: USA. GitHub uses Standard Contractual Clauses and is also certified under the EU-US Data Privacy Framework.

Your browser's push service

What we use it for: Delivering the push notifications you turned on
Where the data is, and the safeguard for transfers outside the EEA: Chosen by your browser's maker (for example Google, Mozilla or Apple), not by us.

The European Commission has recognised US companies that take part in the EU-US Data Privacy Framework as providing adequate protection. Standard Contractual Clauses are contract terms approved by the Commission.

4. Discord integration

Open public lobbies are listed in our Discord server so other players can join. The listing carries the game, the number of free seats and the lobby link – never the host's name. Private lobbies are never listed.
The bot behind that feed runs on our own hardware, not at a third-party host, and reads only the public lobby list every visitor can already see.
Linked Roles: if you link Discord to Boardly with permission to update your connection, we send Discord your Boardly username and four values – whether you have Premium, how many games you have played, when you joined and whether your email address is verified – when you link, when your Premium changes, and once a night. Servers that use them can give you roles. When you unlink Discord or delete your account, we clear them. The legal basis is your consent; unlinking withdraws it.

5. Advertising

We show no ads today. Every page on boardly.online loads Google's AdSense script, which lets Google confirm that the site is ours and shows Google's consent message to visitors from the EEA and the UK. The script sets a cookie on your device (FCCDCF) to keep track of the message and your answer. Google processes this data as an independent controller under its own privacy policy.

If we start to show ads, they will appear only on content pages such as the guides, never in a game, and not to Premium subscribers. Personalised ads will be shown only to visitors who consent in Google's message; others will get non-personalised ads.

You can change or withdraw your answer at any time with the "Privacy and cookie settings" button below, or the same link in the footer of the home, games and guide pages, and control personalised advertising in Google Ads Settings.

6. Cookies and storage on your device

We store only what the site needs to work, plus the items listed here:

A sign-in cookie that keeps you logged in.
For guests: the guest id, name and identity token that keep you attached to your games. The token lasts 90 days from your last visit, and "Forget me" removes all of them.
Your language, theme, sound and similar choices, and which notices you have dismissed.
Only if you tick "Remember me" when you sign in with an email address and password: that address, so the login page can offer it next time. It stays on the device after you sign out; signing in with "Remember me" unticked, or clearing this site's data in your browser, removes it.
Google's consent cookie described in section 5.
Our service worker, which receives push notifications and keeps a copy of the site's own files so pages load faster.

We set no advertising or analytics identifiers of our own. The site or campaign you arrived from travels with the request that creates your account and is never written to your browser.

7. Your rights

You have the right to access your data, to have it corrected or erased, to restrict its processing, to receive it in a machine-readable format, and to object to processing based on our legitimate interest. Where we rely on consent, you can withdraw it at any time; that does not affect what we did before.

Download your data: the "Download my data" button in the "Your data" section of your profile page gives you a JSON file with your profile, preferences, linked providers, games, lobbies you created, purchases and checkout records, friends, friend requests, invites, notifications, feedback, reports you filed, achievements and push subscriptions.
Correct your data: edit your profile, including your email address, on your profile page.
Delete your account from your profile page; we confirm by email. This also removes your profile picture, replaces your name with "Deleted player" in other players' game records and replays, keeps feedback you sent but removes your email address and account from it and deletes its copy in our Discord feedback channel, and cancels any subscription and deletes your customer record at Stripe. Reports you filed, and reports about you, lose their link to your account; the copy of reported content stays for the report's period.
Guests: "Forget me" in the guest menu deletes your guest record and your seats in games, replaces your name with "Deleted player" in other players' records, and clears the guest data on this device. If you are seated in a running game, finish or leave it first.
Anything else, including data the download does not contain, goes to support@boardly.online. We answer within one month and may ask you to confirm that the account is yours.

You need an email address and a password, or a sign-in provider, to create an account; you can play as a guest without either. We make no decisions about you based solely on automated processing.

8. Complaints

You have the right to complain to Datatilsynet, the Norwegian Data Protection Authority, or to the supervisory authority where you live or work. We would appreciate the chance to put things right first: write to support@boardly.online.

datatilsynet.no

9. Security

Passwords are stored only as bcrypt hashes, all traffic uses HTTPS, and only the services that need it can reach the database. A password reset signs out every other session, and a completed email change signs out all of them.

10. Children

Boardly is not intended for children under 13, and we do not knowingly collect their data. An account rests on the contract you accept when you create it (GDPR Art. 6(1)(b)), not on consent, so the age of consent in Art. 8 of the GDPR and section 5 of the Personal Data Act does not apply to it. You need to be 13 or older to create an account: you confirm it, and accept the Terms, on the sign-up form, or on your first visit if you sign up with Google, GitHub or Discord, and we keep the time you did. If you believe a child under 13 has given us personal data, write to support@boardly.online and we will delete it.

11. Changes to this policy

When we change this policy, we update the date below. We will tell you about significant changes by email or with a notice on the site.

Last updated: October 5, 2026