CyBoard ("we", "us", "our") provides a mobile and web application that helps players of tabletop board games and card games discover each other, organize game sessions, track match results, and connect with local game shops. This Privacy Policy explains what we collect, how we use it, who we share it with, and the choices you have. It applies to the CyBoard mobile app, the CyBoard website at https://cyboard.games, and all related services (together, the "Service").
By creating an account or using the Service you agree to this Privacy Policy. If you do not agree, please do not use the Service.
1. Information We Collect
a) Account information you provide
- Email address, display name, username, and password (hashed).
- Optional profile data: bio, avatar image, preferred games, play style, and a self-reported city/region.
- If you sign in with Google or Apple, we receive your name, email address, and (Google only) profile picture from that provider. We do not receive your social-network contacts or post on your behalf.
b) Content you create
- Game sessions you host (title, description, date/time, location).
- Messages you send in session chats and direct messages.
- Match records, reviews, social-feed posts, and other in-app contributions.
- Photos you optionally capture or upload for board-state detection (analyzed in real time; not retained beyond the analysis unless you save them to a session).
c) Location data
We collect the city and ZIP/postal code you choose to share for matchmaking. We do not collect precise GPS coordinates and we do not track your location in the background. The exact street address of any private event you host is shared only with players you explicitly approve.
d) Device and usage information
- Device type, operating system, app version, language, and time zone.
- Crash logs and basic performance metrics.
- Pages visited and features used, to improve the product.
e) Push notification tokens
If you opt in to push notifications, we store the device token issued by Apple Push Notification Service (APNs), Google Firebase Cloud Messaging (FCM), or the Web Push standard, used only to deliver notifications you have opted in to receive.
2. How We Use Your Information
- To create and operate your account.
- To match you with nearby players and recommend events.
- To deliver in-app notifications, emails (e.g., password resets), and push notifications you opt in to.
- To compute leaderboards, rankings, achievements, and aggregated game statistics.
- To analyze a board image you capture (computer vision) for game-state assistance — these images are processed transiently and not used to train third-party models.
- To detect, investigate, and prevent abuse, fraud, harassment, or violations of our Terms.
- To comply with legal obligations and respond to lawful requests.
3. How We Share Information
We do not sell your personal data. We share data only as described below:
- Other players: Your public profile (name, username, avatar, city, level, badges, public match history) is visible to other signed-in users. Private session locations are only revealed to approved guests.
- Service providers: We use third-party processors to operate the Service: MongoDB Atlas (database hosting), Microsoft Graph (transactional email), Apple/Google/web-push providers (notifications), and OpenAI (computer-vision board detection, transient processing only). These vendors are contractually limited to processing data on our behalf.
- Authentication providers: Google and Apple receive limited data only when you choose to sign in with them.
- Game shops & event hosts: If you join an event or check in at a shop, that host sees the same public profile information any player can see.
- Legal: We may disclose information when required by law, valid legal process, to enforce our Terms, or to protect the safety of users.
- Business transfers: If CyBoard is acquired or merged, your data may be transferred to the successor entity, subject to this Privacy Policy.
4. Data Retention
We retain your account information for as long as your account is active. If you delete your account from the app (Profile → Delete my account), we soft-delete your record immediately: your personally identifiable information (email, name, avatar, bio, location, OAuth identifiers) is scrubbed, and your account is marked deleted. Aggregate, de-identified match statistics may be retained for leaderboard integrity. After 30 days the soft-deleted record is purged from backups in the ordinary backup-retention cycle.
If you only contact us by email to request deletion, we will action it within 30 days.
5. Your Rights & Choices
- Access & download: Email support@cyboard.games and we will provide a copy of the personal data we hold on you within 30 days.
- Correction: Edit your profile in-app at any time, or email us.
- Deletion: Use Profile → Delete my account, or email support@cyboard.games.
- Opt-out of marketing emails: Click "unsubscribe" in any marketing email. Transactional emails (password resets, account-security notices) cannot be opted out of while your account is active.
- Push notifications: Toggle off in Settings → Notifications, or revoke at the OS level.
- EU / UK (GDPR): You have rights of access, rectification, erasure, restriction, portability, and objection. To exercise them or to lodge a complaint with a supervisory authority, contact support@cyboard.games.
- California (CCPA/CPRA): California residents have the right to know, to delete, to correct, to opt out of "sale" or "sharing" of personal information, and to non-discrimination. We do not sell your personal information.
6. Security
We use industry-standard security including TLS in transit, encrypted database storage, hashed (bcrypt) passwords, HTTP-only session cookies, and least-privilege access controls. No system is perfectly secure — please use a unique, strong password and notify us immediately if you suspect unauthorized access to your account.
7. Children's Privacy
CyBoard is not directed to children under 13 (or under 16 in the European Economic Area). We do not knowingly collect personal information from children. If you believe a child has provided us personal data, please email support@cyboard.games and we will delete the account.
8. International Transfers
CyBoard is operated from the United States. If you use the Service from outside the U.S., your information may be transferred to and processed in the U.S. or other countries where our service providers operate. Where required, we rely on standard contractual clauses or equivalent safeguards.
9. Cookies & Local Storage
We use only the cookies and local-storage entries that are necessary to keep you signed in and to remember your preferences. We do not use third-party advertising or tracking cookies.
10. Changes to this Policy
We may update this Privacy Policy from time to time. We will post the updated policy here and update the "Effective" date. Material changes will be notified to you in-app or by email.
11. Contact Us
For privacy questions or to exercise your rights, contact support@cyboard.games.