Privacy Policy

1. Information we collect

• Account data — email, display name, avatar URL (when signed in via Google or Apple; guest accounts have no email and are named automatically).
• Game data — game history, stats, achievements, friend list.
• Device data — FCM push token (for notifications), approximate language/locale.
• Diagnostic data — error and crash reports sent to our own servers (error type and message, stack trace, app version, platform, OS version, and your account id when you are signed in).
• Support data — if you contact support, report a bug or send a suggestion: what you wrote, plus your app version, platform and OS version, captured automatically so we can reproduce the problem.
• Moderation data — reports you file about other players, and the list of accounts you block.
• Usage analytics — which games you open, how matches start and finish, how long they last, and whether you completed onboarding, via Google Firebase Analytics. Events carry your account id and our own identifiers (a game name, a match outcome, a duration). They never carry your username, your chat messages, your email or a room code. Collected only in release builds.

2. How we use it

• To operate the game platform: sync state across devices, update leaderboards, send you notifications when it's your turn or you receive a friend request.
• To fix crashes and bugs, using diagnostic reports grouped by error rather than by person.
• To answer your support requests.
• To keep the service usable: acting on reports, and honouring the accounts you have blocked.
• Never for advertising. We do not sell your data.

3. Where it's stored

• Our own servers — accounts, game state, chat, leaderboards and uploaded avatars are stored on a self-hosted PostgreSQL database on a Hostinger International Ltd VPS in Frankfurt, Germany (EU). Hostinger is the hosting provider; it does not process the data for any purpose of its own.
• Google Cloud / Firebase — Authentication (sign-in identity), Cloud Messaging (push delivery) and Analytics (usage events). Nothing else. Game data, chat, avatars, support conversations and error reports are not stored with Google: Crashlytics and App Check were both removed in August 2026, and diagnostics go to our own servers instead.

4. Retention

Each period below is enforced by a nightly job.

Data	Kept for
Account data	Until you delete your account
Match results and leaderboard positions	Indefinitely — they are the public record of the game
Chat from a finished game	90 days
A finished game's room record	12 months
Crash and error reports	30 days
Support conversations	12 months after the conversation is closed
Reports about other players	12 months after they are resolved
Friend requests you never answered	Kept — an unanswered request is not stale. Accepted or declined ones are removed after 90 days
Database backups	30 days, then overwritten

Two honest notes about the edges, because a retention promise should describe what happens rather than what was intended:

• The chat window applies to games that ended. A room that is still open keeps its thread while it is open. Rooms nobody returns to are collected automatically — a lobby with one person in it after an hour, and a game left mid-play — and the chat goes with the room.
• Backups are compressed, not encrypted, and are held for 30 days. Whether they are copied off the server depends on the deployment's configuration.

You can download a copy of your data at any time from Settings → Download my data.

5. Children

BoardVerse is a family game and is not directed at children under 13. We do not knowingly collect personal information from a child under 13. If you believe a child has created an account, contact us at the address in §7 and we will delete it.

6. Your rights

• Access / export — Settings → Download my data, or ask us at the address in §7.
• Deletion — Settings → Delete Account. In one transaction this removes your account, your push tokens, your avatar, your chat messages, your notifications, the accounts you blocked, and your support conversations; it unlinks your error reports so they can no longer be tied to you; and it deletes your Firebase Authentication record.
• Opt-out of push — Settings → Notifications, or the OS permission.

Two things deliberately survive a deletion, and you should know what they are: match results, so other players' ratings and the leaderboard stay correct, and reports other players filed about you, so deleting an account cannot erase a moderation record.

7. Contact

[email protected]