Privacy Policy

On registration: username, display name, email and password (stored only as a cryptographic hash — we never store passwords in plain text). Optional: phone number — shown only to the other party of a marketplace deal. User content: your board game collection, wishlist, game nights, marketplace listings, avatar and friends list. We do not collect or process payment data, precise geolocation, or microphone/camera data (other than images you explicitly upload).

When you sign in with Google, we request only the basic Google OAuth 2.0 scopes: openid, email and profile. From Google we receive exclusively: your email address, display name and profile picture URL. This Google user data is used solely to: create your MyBoardGame account, authenticate you, and display your name/avatar to other users you interact with. We do NOT access your Gmail, contacts, calendar, Google Drive files or any other Google account data. We do not store or transfer Google access tokens to third parties, and we never use Google user data for advertising, analytics or sale.

The email and name received from Google are stored in our database as part of your account profile. OAuth tokens are used only during the sign-in exchange and are not persisted on our servers once authentication completes. Protection: all traffic is served over HTTPS, passwords are stored as bcrypt hashes, and data access requires an authorization token. The Google client secret is kept server-side and never exposed to the browser.

Email — for sign-in and notifications. Name and avatar — for display in collections, game nights and deals. Content — to power app features. We do not use data for advertising, do not build advertising profiles and do not share it with ad networks.

We use no cookies, analytics or third-party trackers. Your interface language and login token are stored in your browser's localStorage and are never sent to third parties.

Your email is used for notifications about site events: game night invites from friends, marketplace reservations and sales, password recovery. Notifications can be disabled in your profile (the Notifications section). Service emails (password reset codes) are always sent — access recovery is impossible without them.

We do not sell or share personal data (including Google user data) with third parties. External services used by the app: Google — for OAuth sign-in only; BoardGameGeek and Tesera — to fetch public game data (only the username you enter for collection import is sent to them). Only what you explicitly publish is publicly visible: your collection via a share link, open meetings and marketplace listings.

Data is kept while your account exists. Profile data and content can be edited or deleted in settings at any time. Revoking Google access: you can revoke the app's access anytime on your Google account permissions page (myaccount.google.com/permissions). After revocation we stop receiving data from Google; previously stored email and name remain part of your account until you request deletion. Full deletion: contact us via "Contact us" in the menu — we will delete your account and all associated data within 30 days.

Access to, correction and deletion of your data are available in profile settings. You may request a data export or full deletion via the contacts below.

If we change how we use data (including Google user data), we will update this page and the date below. Continued use of the app after changes means acceptance of the updated policy.

Data controller: MyBoardGame, myboardgame.net. For privacy questions and deletion requests: the "Contact us" form in the app menu or our page at https://www.facebook.com/profile.php?id=61594606483847