Privacy policy

Last updated: November 2, 2026

Boardweaver, Inc. ("Boardweaver," "we," "us," or "our") provides a service for creating, hosting, playtesting, and playing digital board games. This policy explains how we handle personal information through our website, Studio, multiplayer games, events, support, and connected AI tools.

For privacy questions or requests, email [email protected] or use our contact form.

1. Information we collect

• Accounts and profiles: your email address, username, profile description, avatar, account identifiers, sign-in credentials, account settings, and plan information. Password-based accounts use a password hash. If you sign in with Discord, we receive the account information Discord supplies for that sign-in, including your Discord identifier, email address, username, and avatar.
• Guest play: a display name, a browser/session identifier, and records of the games and events you join. Playing without creating an account does not make your activity anonymous to Boardweaver.
• Game development: game source code, rules, descriptions, themes, artwork, sounds, uploaded files, version history, checkpoints, membership and invitation information, publication submissions, and test-session information you create or send us.
• Play and feedback: match membership, moves, game state, results, scores, replays, activity measurements, favorites, event and table participation, and playtest feedback. Game errors can include diagnostic information and game state needed to investigate the problem.
• Communications: contact-form messages, support tickets, collaborator invitations, feedback, email delivery records, and notification preferences. Invitations can include an email address someone else gives us to invite you.
• Studio chat: the messages you send to the Studio's AI assistant, its replies, the actions it takes on your game, and the model, token counts, cost, timing, and model host of each request it makes.
• Connected tools: authorization and client information for an AI assistant or other app you connect, tool names, tool inputs and outputs, errors, and execution times. These records can contain game code, content, and other information included in a tool request or response.
• Technical and usage information: IP addresses and request information received by our hosting and logging systems; browser, device, page, referral, interaction, and performance information; and identifiers used for sessions and analytics. If you enable browser push notifications, we store the subscription endpoint and keys needed to send them.

2. How we use information

We use this information to provide accounts and guest access; save and run games; coordinate multiplayer matches and events; display profiles, game pages, and replays; manage collaboration and publication; deliver requested notifications and service emails; answer support requests; maintain security; investigate errors and abuse; and understand and improve the service.

Game creators and their authorized collaborators can receive playtest feedback and match information, including the submitting player's username, answers, results, and activity statistics. We also use aggregated statistics to understand how games and the platform are used.

3. What other people can see

Your username, avatar, and public profile information may be visible to other users. Published games and their public pages, artwork, rules, and descriptions are available to visitors. Game membership, release settings, and event access affect who can edit or play a game. People with a table code or shared link may be able to join where the game's or event's settings allow it.

Other players and spectators can see the match information the game and service show them. Game creators and authorized team members can inspect playtest matches, feedback, replays, and diagnostics. Information described as hidden or private game state is part of a game's rules and presentation; it is not a promise that the information is inaccessible to Boardweaver or an authorized game editor.

Uploaded media may be served through publicly reachable asset URLs. Unpublishing or deleting an item does not retrieve copies other people have already downloaded or remove every cached copy immediately. Avoid putting personal or confidential information in public game content, feedback, or uploaded assets.

4. AI assistants and other connected apps

When you authorize a connection, such as an AI assistant using the Model Context Protocol (MCP), that client can request information and perform actions allowed by your authorization and game access. Depending on the tools it calls, it may read game files, edit content, upload assets, run tests, save versions or checkpoints, or delete a game. The client receives the results of its requests.

We receive the requests and content that the client sends to Boardweaver. A connection does not itself give us blanket access to your conversations with the AI provider. However, a request can include conversation excerpts or other personal information if you or the client include them. Tool inputs and outputs are recorded for troubleshooting and accountability, so avoid including secrets or unrelated personal information.

You can review and revoke connection credentials in MCP Connections. Revoking a credential does not erase information already received by the connected provider, and you may also need to disconnect Boardweaver in that provider's settings. That provider's own terms and privacy policy govern its handling of your conversations and the information it receives.

The Studio's AI assistant sends your chat messages and the game files it needs to OpenRouter, which passes each request to the AI model host that answers it. We send these requests only to hosts that OpenRouter lists as keeping no copy of them (Zero Data Retention), and the assistant does not use web search. OpenRouter keeps request details such as the time, model, token counts, and cost under its own policy. Other people who can edit a game can see its chat, including the messages you sent.

Our team may also use AI-assisted development tools, including Claude Code and Codex, when building, maintaining, or supporting the platform and games. Material submitted for that work can be processed by those providers. A separate agreement for a game implementation may contain additional restrictions on that use.

5. Cookies, local storage, and analytics

We use browser storage and cookies for sign-in, browser identification, sign-in security, preferences, navigation, and analytics. Clearing or blocking storage can sign you out or prevent features from working.

We use PostHog for product analytics, performance measurements, and session replay. This can include page views, clicks and interactions, device and browser information, referral information, and a recording of visible page activity. For signed-in users, analytics profiles can be associated with your account identifier, email address, username, and account creation date. Guest activity can also be associated with a guest identifier.

Our replay configuration masks typed inputs and blocks the code editor and designated sensitive areas. Other visible content can appear in a replay; these measures are not a guarantee that every piece of personal information on a page is excluded. We also send service-side usage events to PostHog.

We do not currently offer a separate in-app analytics opt-out control, and our analytics configuration does not respond to browser Do Not Track signals. You can manage cookies and site storage through your browser or use blocking tools. Blocking browser analytics does not stop operational records or usage events generated by our servers, and revoking an MCP connection does not delete existing analytics records. To request access, deletion, restriction, or objection to analytics processing, email [email protected] or use our contact form. These requests are handled by our team under the rights and limitations in Sections 7 and 8; sending a request does not automatically disable collection.

We do not sell personal information or use it for cross-context behavioral advertising.

6. Service providers and other disclosures

We share information as needed with providers that help operate Boardweaver. These include DigitalOcean and Amazon Web Services for hosting and storage, Redis Cloud for passing live updates between our servers, PostHog for analytics and replay, Better Stack for logging, Cloudflare and OpenRouter for the Studio's AI assistant, Zoho CPaaS (formerly ZeptoMail) for the emails we send, Zoho Mail for the boardweaver.com mailboxes, and browser push-notification services. Google receives connection information when your browser loads Google Fonts. Discord processes a sign-in when you choose to use it. Our team also uses file-storage, collaboration, and AI development services for the work described above.

A connected app, an external application form, a community service such as Discord, or a website you follow a link to has its own privacy practices. We share information with other users and game teams as described in this policy, and with a connected provider when you authorize its requests.

We may also disclose information when reasonably necessary to comply with law or valid legal process; protect people's safety, rights, and the service; investigate fraud or abuse; or complete a merger, acquisition, financing, or transfer of our business, subject to applicable privacy obligations.

7. Retention and deletion

We keep each kind of information for the period below:

• Account and profile information: until you delete your account.
• Games, their versions, and their files: while the game exists. Deleting a game, or deleting the account of its only admin, takes the game down: we hide it from everyone, but we keep its stored content and history.
• Match histories and the answers you give to a game's feedback questions: kept after you delete your account, with your seat shown as "Former player."
• Records of connected-app tool calls (inputs, outputs, errors, and execution times): until you delete your account.
• Studio chat messages you send and the replies to them: until you delete your account.
• Model usage and cost records for Studio chat (no message content): kept without your account details after you delete your account.
• Support tickets you file, including through a connected app: kept after you delete your account, so we have a record of the support we gave.
• Our record of emails we sent you: until you delete your account. After that we keep only which kind of email was sent and when. If you have no account (for example, someone invited you to a game), we keep this record, and the invitation with your email address, indefinitely.
• Emails we send, with their content and delivery records, at Zoho CPaaS, our email delivery provider: 60 days.
• Emails you send to a boardweaver.com address, and messages you send through our contact form (for example, support or deletion requests): kept indefinitely.
• PostHog session recordings: 30 days.
• PostHog analytics events and profiles: up to 7 years. When we erase your account, we ask PostHog to delete your profile and its events. If a browser you used visits Boardweaver after that, PostHog can record the first events of that visit under your former account number, such as a page view, clicks, page performance, and the start of a session recording, and keeps them for the periods above.
• Application logs (Better Stack): up to 30 days.
• Database backups: 7 days.
• AI playtest sessions: about 30 minutes after their last state update. A checkpoint saved from a session is a separate saved record and does not expire with the session.

Deleting your account. You can delete your account in Settings, Account. You can restore it for 30 days. After that we erase your account, profile, sign-in methods, connected-app tokens, the invitations sent to you, avatar, tool-call records, the Studio chat messages you sent with their replies, and your Studio chat key, take down the games that only you run, and ask PostHog to delete your analytics data. Copies in database backups are gone within a further 7 days, copies in our application logs within a further 30 days, and Zoho CPaaS's copies and delivery records of the emails we sent you within a further 60 days. PostHog deletes your analytics data on its own schedule after we ask. We email you before the account is erased.

What we keep after deletion. Matches you played stay in other players' history, with your seat shown as "Former player," together with the answers you gave to their feedback questions. Games that only you run are taken down, not erased: we keep their stored content and history, hidden from everyone. Games that another admin still runs stay with that admin, with the chat messages other people sent. Support tickets stay, as described above, and so do the emails and contact-form messages you sent us. Records that belong to the matches and games that stay, such as your seat's moves and errors, the events you created, the invitations you sent, and your acceptance of our terms and this policy, stay linked to your former account, which no longer holds your name, email, or profile. If you unsubscribed an address from our emails, we keep it on our unsubscribe list so that we do not email it again. If an address bounced or reported spam, our email provider keeps it on a suppression list to protect delivery. We keep other information longer only when the law requires it, or to resolve a dispute, prevent abuse, or deal with a legal claim.

Deleting a game. Deleting a game through the interface or a connected tool hides it from normal access but does not erase its stored content or history at once. Guest sign-in expiry does not erase the guest's match records. Removing access, revoking a token, and clearing browser storage are different from deleting saved information.

Other deletion requests. To delete specific information without deleting your account, email [email protected] or use our contact form. Identify your account and the records concerned. Do not send passwords, access tokens, or other credentials. Our team may need to verify your identity and authority before handling the request.

Our providers also keep internal backups on their own schedules. Copies other people have already downloaded, and copies a connected app's provider received, are outside our control.

8. Your choices and privacy rights

You can edit available profile settings, manage game collaborators and publication settings, review connected tools, and change notification settings in your account. Optional notification emails include unsubscribe controls. Essential messages, such as security and password-reset emails, may still be sent. You can turn off push notifications in notification settings or in your browser.

Depending on where you live and the law that applies, you may have rights to access, correct, obtain a copy of, delete, or restrict the use of personal information, or to object to processing or withdraw consent. Send requests to [email protected] or through the contact form. We may need to verify your identity and authority before acting. You can also contact the privacy regulator responsible for your location. We will not discriminate against you for exercising an applicable privacy right.

If we decline a privacy request, you can appeal by writing to the same email address and identifying your original request. We will respond within the time required by applicable law. Delaware residents can also find complaint information through the Delaware Department of Justice privacy portal.

9. International processing and security

Boardweaver uses providers and systems that may process information in the United States and other countries with different privacy laws. Where applicable law requires safeguards for an international transfer, those requirements continue to apply.

We use access controls and other technical measures to protect information, but no service can guarantee complete security. Keep your credentials and connector tokens private, and contact us if you suspect unauthorized access.

10. Children

Boardweaver is intended for people aged 13 and older, subject to any higher minimum age required where they live. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information, contact us so we can investigate and take appropriate action. Younger users who cannot agree to binding terms themselves need a parent or guardian's permission as described in our Terms of service.

11. Changes and contact

We will post changes to this policy here and update the date above. For a material change, we will provide additional notice where required by law. This policy does not authorize a use of previously collected information that requires additional consent without obtaining that consent.

Contact Boardweaver, Inc. at [email protected] or through the contact form.