RivalBoard is a social leaderboard app for tracking board game scores between friend groups. Contact: hello@rivalboard.app
2. Data we collect
When you create an account we collect your name, email address, and a hashed password (we never store your password in plain text). If you sign in with Google, we receive your name and email from Google: no password is stored. We also store the match results, scores, and group data you enter into the app.
3. How we use your data
Your data is used exclusively to provide the RivalBoard service: authenticating you, displaying leaderboards, and storing match history within your friend groups. We do not sell your data or use it for advertising.
4. Third-party services
Neon (neon.tech): our database provider, hosted in the EU.
Cloudflare Workers: our hosting provider.
Google OAuth: optional sign-in provider. Governed by Google's privacy policy.
Resend: used to send transactional emails (e.g. password reset). We share only your email address.
Firebase Cloud Messaging (Google): used to deliver push notifications to the Android app, only if you enable them. A device push token is shared: no personal data.
Google Analytics 4: used to measure which pages and features get used, so we know what to build next. It only runs if you accept analytics in the cookie banner. It never receives your name, email, or match data.
BoardGameGeek (boardgamegeek.com): source of board game catalog data (names, cover images, ratings). Cover images are served from BGG's CDN (geekdo-images.com). No personal data is sent to BoardGameGeek.
5. Data retention
Your data is retained as long as your account is active. You can request deletion of your account and all associated data at any time by contacting hello@rivalboard.app.
6. Your rights (GDPR)
If you are in the EU/EEA, you have the right to access, correct, or delete your personal data, and to object to or restrict its processing. Contact us at hello@rivalboard.app to exercise these rights.
7. Cookies & local storage
RivalBoard uses the following cookies and local storage:
Session cookie: a technical/essential cookie used solely to keep you authenticated. It is set when you log in and expires after 7 days or when you log out. This cookie is strictly necessary for the service to function and does not require your consent.
Google Analytics (_ga, _ga_*): written by Google Analytics to count visits and tell returning readers from new ones. They appear only after you accept: until then Google Consent Mode keeps analytics storage denied, no analytics cookie is written, and measurement falls back to anonymous cookieless pings.
Analytics choice: stored in your browser's localStorage (not a cookie) to remember whether you accepted or rejected analytics. It contains no personal data.
No advertising cookies are used and no data is shared for advertising purposes. You can change your choice at any time:
8. Changes to this policy
We may update this policy occasionally. We will notify users of significant changes via email or an in-app notice.
9. Push notifications
Push notifications are optional and off by default. If you enable them, we store a push subscription for your device (a delivery address issued by your browser or by Google Firebase Cloud Messaging) to notify you about activity in your groups, such as a friend logging a match you played in. You can disable notifications at any time from your profile or your device settings; the subscription is deleted when you disable them or when you delete your account.