Privacy Policy

Last updated: July 18, 2026

Introduction

Board Games Tracker is operated by Dennis Essenburg, an individual based in the Netherlands ("we," "our," or "us"). We are the data controller responsible for your personal data. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our mobile application and website (collectively, the "Service").

By using our Service, you agree to the collection and use of information in accordance with this policy. If you do not agree with the terms of this policy, please do not access or use the Service.

Information We Collect

Personal Information

When you create an account, we collect:

  • Email address - Used for account authentication and communication
  • Display name - Used to identify you within the app
  • Profile picture - Optional, provided through your social login provider

Usage Data

We collect data you voluntarily provide while using the Service:

  • Game results - Records of board games you've played and their outcomes
  • Player statistics - Win/loss records and performance data
  • Game collection - Board games you've added to your library
  • Custom games - Games you create yourself, including a name, description, and an optional image. Custom games you create are visible to your friends.
  • Comments - Free-text comments you leave on game results. Comments are visible to the friends of the game result's owner.
  • Offline players - Names of players you create to track friends who don't have accounts
  • Game photos - Optional photos you take or upload to document your game sessions
  • Friends and connections - Your friend relationships, friend requests, and blocked users
  • Achievements - Records of achievements you've earned and when you earned them
  • Notification preferences - Your choices for email and push notification settings

Device Permissions

Our mobile app may request the following device permissions:

  • Camera - Used for two features you initiate: taking a photo of your game session, and scanning a game's barcode to add it to your collection. Barcode scanning is performed on your device using on-device machine learning (Google ML Kit); the image itself is not uploaded for scanning. Only the resulting barcode value is sent to the GameUPC service to look up the matching game (see Third-Party Services below). Photos you choose to keep are uploaded to our storage and associated with your game results, and you can remove them at any time by editing the game result.
  • Photo Library - Used only when you choose to select an existing photo from your device to attach to a game result.
  • Push Notifications - Used to send you notifications about friend requests, achievements, and other updates you've opted into. When you enable push notifications, we store a device token (FCM token) to deliver notifications to your device. You can disable notifications at any time in the app settings.

These permissions are optional and only requested when you initiate the relevant feature. The app functions fully without granting these permissions.

Authentication Data

We use third-party authentication providers (Google, Facebook, Discord) for sign-in. We only receive basic profile information from these providers as outlined above. We do not receive or store your passwords from these services.

How We Use Your Information

We use the information we collect to:

  • Provide, maintain, and improve the Service
  • Create and manage your account
  • Display your game history and statistics
  • Enable you to track games with friends
  • Enable friend connections and social features within the app
  • Track and award achievements based on your gaming activity
  • Send notifications you've opted into (email and push notifications)
  • Communicate with you about the Service (e.g., updates, security alerts)
  • Respond to your inquiries and support requests

Friends and Social Features

Our Service includes social features that allow you to connect with other users. When you use these features, we collect and store:

  • Friend relationships - Records of who you are connected with as friends
  • Friend requests - Pending, accepted, and rejected friend requests
  • Blocked users - Users you have chosen to block from contacting you
  • Friend invite links - Shareable invite codes you create to invite others (expire after use or time limit)

Your profile information (display name and avatar) is visible to other users when they search for friends or view game results you've participated in together. Blocked users cannot see your profile or send you friend requests.

Achievements

We automatically track your gaming milestones and award achievements based on your activity. Achievement data includes:

  • Which achievements you have earned
  • The date and time each achievement was earned
  • Progress toward unearned achievements (calculated from your game history)

Achievement progress is derived from your existing game results and does not require additional data collection. Your earned achievements may be visible on your profile to friends.

Notifications

We offer optional email and push notifications to keep you informed about activity in the app. You have full control over your notification preferences.

Email Notifications

If you opt in, we may send you emails about:

  • Friend requests received
  • Achievements you've earned
  • Weekly activity summaries

Push Notifications

If you enable push notifications on your mobile device, we may notify you about:

  • Friend requests received and accepted
  • Achievements you've earned
  • Game results from sessions you participated in

To deliver push notifications, we store a device token (Firebase Cloud Messaging token) associated with your account. This token is used solely for delivering notifications and is deleted when you disable push notifications or delete your account.

You can manage your notification preferences at any time in the app's notification settings, accessible from your profile page.

Data Storage and Security

Your data is stored securely using Supabase, a trusted backend-as-a-service platform that uses PostgreSQL databases with enterprise-grade security.

We implement appropriate security measures including:

  • Encryption of data in transit using HTTPS/TLS
  • Secure authentication using OAuth 2.0 protocols
  • Row-level security policies to ensure you can only access your own data
  • Regular security updates and monitoring

Photo and Image Storage

Game photos, custom-game images, and profile avatars you upload are stored in Supabase Storage. Please note the following about how these images are stored and who can see them:

  • Images are publicly accessible by URL. Game photos, custom-game images, and avatars are held in public storage buckets. This means the underlying image files are not access-restricted: anyone who has, is given, or guesses the direct link to an image can view it without logging in, even if they do not have a Board Games Tracker account. The images are not indexed or listed publicly within the app, but the files themselves are not private. For this reason, please avoid uploading images that contain sensitive or private information.
  • Images are resized and optimized before upload to reduce storage and bandwidth
  • You control your own uploads: you can remove a game photo or custom-game image by editing the relevant record, and you can change or remove your avatar from your profile
  • When you delete a game result, its associated photos are removed
  • Your uploaded images are deleted when you delete your account

Data Sharing

We do not sell your personal information.

We may share your information only in the following limited circumstances:

  • Service Providers: We use Supabase for data storage and authentication, and Firebase Hosting (Google) to host our website and app. These providers process data on our behalf and are bound by confidentiality obligations.
  • Barcode Lookup (GameUPC): When you scan a game's barcode, the barcode value is sent to the GameUPC service to identify the matching game. Only the barcode number is sent — no personal information about you is included in that request.
  • Legal Requirements: We may disclose your information if required by law or in response to valid legal process.
  • With Your Consent: We may share information with your explicit consent.

Your Rights and Choices

The data controller responsible for your personal data is Dennis Essenburg, based in the Netherlands. Because we operate from the Netherlands, the EU General Data Protection Regulation (GDPR) applies to our processing of your personal data.

Legal Basis for Processing

We process your personal data on the following legal bases:

  • Performance of a contract - To create and operate your account and provide the core features of the Service you have signed up for (for example, recording game results, your collection, and social features).
  • Consent - For optional features you choose to enable, such as email and push notifications, and camera or photo-library access. You can withdraw consent at any time.
  • Legitimate interests - To maintain the security of the Service, prevent abuse, and improve the product, provided these interests are not overridden by your rights.
  • Legal obligation - Where we must process or disclose data to comply with the law.

Your GDPR Rights

Subject to applicable law, you have the right to:

  • Access - Request a copy of the personal data we hold about you.
  • Rectification - Ask us to correct inaccurate or incomplete data.
  • Erasure - Ask us to delete your account and associated personal data ("right to be forgotten").
  • Portability - Receive your personal data in a structured, commonly used, machine-readable format.
  • Objection - Object to processing based on our legitimate interests.
  • Restriction - Ask us to restrict processing while a dispute or request is resolved.
  • Withdraw consent - Withdraw any consent you have given, at any time, without affecting processing carried out before withdrawal.
  • Lodge a complaint - Lodge a complaint with a supervisory authority. In the Netherlands this is the Autoriteit Persoonsgegevens. You may also contact the supervisory authority in your country of residence.

You can exercise many of these rights directly in the app (see below). To make any other request, email us at [email protected] and we will respond within 30 days.

Access and Portability

You can view all your data within the app, including your game history, statistics, and collection.

Correction

You can update your profile information and correct any game results directly within the app.

In-App Account Deletion

You have the right to delete your account and all associated data at any time directly from within the app. To delete your account:

  1. Open the app and go to your Profile
  2. Scroll to the "Danger Zone" section at the bottom
  3. Select "Delete Account"
  4. Type the confirmation phrase and confirm the deletion

This action is permanent and will remove all your data from our servers, including:

  • Your profile information and avatar
  • Your favorite games and collection
  • Your friend relationships and pending requests
  • Your achievements
  • Offline players you created
  • Teams you created
  • Your notification preferences and device tokens
  • All photos you uploaded

Note: Your game history records will be preserved for other participants, but your name will be replaced with "Removed User" to maintain their statistics.

Data Retention

We retain your data for as long as your account is active. If you delete your account, we will delete your data within 30 days, except where retention is required by law.

Third-Party Services

Our Service integrates with the following third-party services:

International Data Transfers

Your account and content data are stored within the European Union. Specifically, our database and authentication are provided by Supabase, hosted on Amazon Web Services in the eu-central-1 (Frankfurt, Germany) region. Keeping this data in the EU means it stays within the protections of the GDPR.

Some of the providers we rely on are global companies, and limited processing may occur outside the European Economic Area (EEA):

  • Google - Provides our website and app hosting (Firebase Hosting), push notification delivery (Firebase Cloud Messaging), and, if you choose Google Sign-In, acts as an authentication data recipient.
  • Other authentication providers - If you sign in with Facebook (Meta) or Discord, those providers process your login outside the EEA.
  • GameUPC - Receives the barcode value when you scan a game.

Where personal data is transferred outside the EEA, we rely on appropriate safeguards recognised under the GDPR — such as the European Commission's Standard Contractual Clauses (SCCs) or an adequacy decision — to ensure your data remains protected.

Cookies and Local Storage

We do not use third-party advertising or tracking cookies, and we do not use analytics that profile you across sites. The only data we keep on your device is essential to the Service:

  • Theme preference - Your choice of dark or light mode is stored in your browser's localStorage under the key ludo-theme. This never leaves your device.
  • Authentication session - Your login session and access tokens are stored in localStorage so you stay signed in. These are used solely to keep you authenticated and are cleared when you sign out.

Because this storage is strictly necessary to provide the Service and does not track you, no cookie-consent banner is required.

Children and Minimum Age

You must be at least 16 years old to use the Service, consistent with our Terms of Service and the age of consent for data processing under the GDPR (Article 8) as applied in the Netherlands. The Service is not directed to, or intended for, children under 16.

We do not knowingly collect personal data from children under 16. If you believe a child under 16 has provided us with personal data, please contact us at [email protected] and we will delete the account and associated data promptly.

Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last updated" date. You are advised to review this Privacy Policy periodically for any changes.

Contact Us

If you have any questions about this Privacy Policy or our data practices, please contact us at: