Board Game Metrics

Privacy Policy

Last updated

This policy explains how Board Game Metrics (“we”, “us”) handles personal information when you use the Board Game Metrics app on iPhone or Android, or this website. Board Game Metrics is made and run by an independent developer in New South Wales, Australia, who is responsible for your information.

We follow the Australian Privacy Principles in the Privacy Act 1988. If you live in the European Union, the United Kingdom or California, you also have the rights described in section 8.

The short version: we keep what you log so the app can work, show it only to the people you play with, use a privacy-friendly amount of analytics, never sell your data and never show you ads. You can delete everything from the app.

Who we are

Board Game Metrics, New South Wales, Australia. For anything about your privacy, email privacy@boardgamemetrics.com.

What we collect, and why

Your account

Your email address and a password (stored only as a secure hash), or, if you sign in with Apple or Google, the name, email address and profile picture they share with us. We use them to sign you in, to recover your account, and to send the emails the service needs (confirming your address, resetting your password). We don’t send marketing emails.

Using the app without an account

If you choose Continue without an account, the app creates a guest account on our servers, with no email address or password, so that what you log is kept. It has the name “Player” and nobody else can find it, see it or contact it. If you later create an account, everything you logged moves to it. A guest account that hasn’t been used for 30 days and has nothing in it is deleted, and so is any guest account that hasn’t been used for 12 months.

Your profile

Your display name, a handle (a username others can find you by), a profile picture if you add one, and whether you are an ordinary user or one of our administrators. Your name, handle and picture are seen by other users (see section 4).

Your games

The games in your library: which you own, want, want to play, used to own or would trade, your favourites, your own rating of each, and your ranking — including every “which do you prefer?” comparison you answer, kept so that your ranking can be recalculated.

Your play records

For each game you log: the game and expansions, the date, how long it took, where you played and notes (both optional, free text), the players, their scores, placings, teams and who won, and the group it was played in.

People you play with

The players in a session. A player is either another user or a guest — a name for someone who doesn’t use the app. We store only the name: the one you type, or, for plays you import from BoardGameGeek, the name the player has on BoardGameGeek (or their BGG username if they have no name there). Please use a name the person is happy with (our Terms ask the same).

Friends and groups

Your friends, your pending friend requests, the people you’ve blocked, and your personal invite code. For groups: the name, description and picture, the members and their roles, and invitations.

If you link a BoardGameGeek account, its username, and the code you put on your BGG profile to prove it’s yours. We use the username to import your BGG collection (owned, wishlist and the other lists, and your BGG ratings) into your library.

If you import your plays from BGG, we copy each play you logged there into your play records: the game, date, how long it took, where you played, your comments (as notes), the players, their scores and who won. We keep BGG’s number for each play, so that a play is never imported twice. The other players become guest players in your account (see “People you play with”).

Plus during the early beta

Board Game Metrics is in early beta: every account has Plus for free, and nothing can be bought in the app. We record that your account has Plus, when that started and when it ends; that record also tells us who took part in the beta. We can also give an account Plus ourselves, with a note of why. Before Plus goes on sale we’ll update this policy to describe purchases, and tell you in the app.

Analytics

In the release version of the app we use Google Analytics for Firebase to learn which screens are used and how often key things happen. We record: screen views (with any ids removed from the screen’s address); starting a guest account; signing up (and whether it was from a guest account), signing in and out (and whether by email, Apple or Google); logging a game (with the number of players); and adding a game to your owned games or wishlist (with the game’s BoardGameGeek id), or removing one; which features you use, such as sorting a list, opening a chart or importing plays from BoardGameGeek (the feature’s name only, never what you typed or who it involves); and whether you use a guest account or an account, and whether it has Plus. These events are linked to your account’s id, a random code, not to your name or email. Firebase also records basic device information (model, system version, app version, country derived from your IP address).

We don’t use analytics for advertising, we don’t track you across other companies’ apps or websites, and we don’t collect your advertising identifier.

You can turn analytics off at any time in the app: Settings → Privacy → Share usage statistics. Turning it off stops collection on that device and clears the analytics data Firebase keeps there.

Error reports

When something goes wrong in the app, it sends an error report to Sentry: what failed and where in the app’s code, what the app did just before (the screens opened, the buttons tapped, and the addresses of its requests to our servers, without search terms), the app’s version, and device information such as the model and system version. If the app crashes, the report is sent the next time it starts. The app also tells Sentry each time it starts, so we can see how many uses end in a crash, and measures how long some screens and requests take.

Reports are linked to your account’s id, not to your name or email, and Sentry doesn’t keep your IP address. We use them only to find and fix problems. Share usage statistics doesn’t turn error reports off: they are how we learn about a problem you didn’t tell us about.

Push notifications

If you turn notifications on, we store your phone’s push token with your account, and whether it’s an iPhone or Android: the token is an identifier that Firebase Cloud Messaging gives the app on that phone, so we can send you notifications. A notification says what happened and names the people and games involved (for example, “Alex sent you a friend request”), so these names can show on your lock screen. On an iPhone, Firebase hands the notification to Apple’s push service to deliver.

Signing out on that phone removes the token from your account. It is also deleted when you delete your account, when someone else signs in on that phone, or when it stops working. You can switch kinds of notification off in Settings → Notifications, or turn notifications off in your phone’s settings.

Notifications in the app

The app’s list of notifications (friend requests, invitations, games logged with you) is stored with the name of the person and of the game or group as they were when it was sent. Each notification is deleted 90 days after it was sent.

Feedback and the beta survey

If you send feedback from the app (Feedback, in the menu behind your profile picture): whether it’s a problem, an idea or something else, what you write to us, the app version and whether you use an iPhone or Android. We use it to fix problems and decide what to build next.

If you answer the beta survey in the app: which features you value most, the yearly prices you’d find an easy yes and too expensive, what you write to us, the app version and whether you use an iPhone or Android. We use it to decide what to build next and what Plus should cost.

Both are linked to your account until you delete it, and only our administrators can read them.

Technical information

Our servers record IP addresses and request details in short-lived logs, to keep the service secure and find faults. To stop spam and keep BoardGameGeek’s service fair to everyone, we also keep a short note of who sent a friend request or group invitation to whom (for a day) and of each account’s requests to BoardGameGeek through us (for a minute).

When you contact us

The emails you send and our replies.

If you use the contact form on this website: your name if you give it, your email address, what your message is about and what you write. We use them to answer you. The message is stored in our database, where only our administrators can read it, and emailed to us so we can reply from our inbox. To stop the form being flooded, our server keeps a scrambled code made from your IP address, never the address itself, for a day, and lets each one send a few messages an hour.

What we don’t collect

Your location, your contacts, your date of birth, or anything from your phone beyond what’s described here. The app uses the camera only when you choose to take a profile or group picture or scan a friend’s QR code, and your photo library only when you choose a picture.

We use your information to provide the app (keeping your records, showing them to the people you share with, working out statistics and rankings), to manage your account and Plus, to keep the service secure, to answer you, and to improve the app.

For users in the EU and UK, our legal grounds are: performing our contract with you (everything the app does for you, and Plus); our legitimate interests in keeping the service secure and improving it with analytics and error reports, balanced against your rights (you can object, section 8); and legal obligations.

We never sell personal information, and we don’t share it for advertising.

Who can see what you put in the app

  • Your name, handle and picture can be seen by your friends, by people in your groups, by people you’ve played a game with, by people you’ve invited or sent a friend request to (and who’ve sent you one), and by any signed-in user who searches for you by name or handle. Your profile picture is stored at a public web address that can’t be guessed. A picture from your Google account stays on Google’s servers, and the app shows it from there.
  • A guest account can’t be found or seen by anyone else.
  • Your library and rankings are private. Friends see only the games you both own.
  • A play session can be seen by the person who logged it, every player tagged in it, and, for a group session, every member of the group.
  • Guest players can be seen by the person who added them, by everyone tagged in a session they’re in, and, in a group, by its members.
  • Our administrators can see the email address and Plus status of each account, the feedback sent from it and the messages sent through the website’s contact form, in our own dashboard. They access other data only where needed to run the service, fix problems or respond to a request.

Service providers

We use these companies to run Board Game Metrics. Each handles your information only to provide its service to us.

Provider What for Where
Supabase (on Amazon Web Services) Database, sign-in, file storage, server functions Sydney, Australia
Google — Firebase Analytics in the app; push notifications (Firebase Cloud Messaging); hosting this website United States and elsewhere
Apple, Google Sign in with Apple or Google; Apple’s push service delivers notifications to iPhones United States and elsewhere
BoardGameGeek Game information; your BGG username, when you link, import your collection or import your plays. The app loads game pictures straight from BGG’s servers, which see your device’s IP address United States
Resend Sending the app’s emails, such as password reset codes, and passing messages from the website’s contact form to us United States
Google Workspace Our email United States and elsewhere
Sentry Error reports from the app Germany (European Union)

Information sent overseas

Your account and everything you log is stored in Australia (Sydney). Some providers above process information in the United States and other countries. We use providers that protect it to a standard comparable to the Australian Privacy Principles, and for EU and UK users we rely on the European Commission’s and UK’s approved contract terms (standard contractual clauses) or an adequacy decision.

How long we keep it

  • While you have an account, we keep your information so the app can work.
  • Guest accounts are deleted after 30 days without use if nothing was added to them, and after 12 months without use otherwise.
  • When you delete your account, we delete straight away your profile, picture, library, ratings and comparisons, friends, blocks, invite code, BGG link, guest players, memberships, push tokens, notifications and notification settings, and the games you logged that nobody else was in. See Delete your account for what remains: games you played with other people stay in their history with your name, and groups you owned pass to another member.
  • Notifications other people received about you keep your name as it was until they are deleted, 90 days after they were sent.
  • Feedback messages and survey answers are kept after you delete your account, without your name or account, so we can still act on them and the survey’s totals stay right.
  • Plus records: the record of changes to your Plus (when it started and ended, and why) is kept for up to 7 years, without your name, email or profile, to show that Plus was handled correctly.
  • Backups: deleted information is gone from our database backups within 7 days.
  • Analytics: individual events are deleted after 2 months. Totals and trends that can’t identify you (for example, how many games were logged in a month) are kept.
  • Error reports are deleted by Sentry after 30 days.
  • Analytics events and error reports are not deleted when you delete your account: they carry only your account’s id, not your name or email, and expire as above.
  • Server logs are kept for up to 7 days.
  • Messages from the website’s contact form are deleted 12 months after they were sent. If we answered by email, that conversation is kept like any support email.
  • Support emails are kept for up to 2 years after the conversation ends.

Your rights and choices

You can:

  • see and correct most of your information in the app, and ask us for a copy of all of it;
  • delete your account and data in the app (Profile → Delete account, or Delete what I added on a guest account) or by email;
  • ask us to correct anything you can’t change yourself;
  • unlink BoardGameGeek and remove your picture at any time;
  • turn analytics off in the app (Settings → Privacy → Share usage statistics);
  • turn notifications off, or only some kinds, in the app (Settings → Notifications) or in your phone’s settings.

Write to privacy@boardgamemetrics.com. We’ll answer within 30 days, and we may need to confirm it’s you, normally by replying from the email address on the account.

In the EU, UK and similar places, you also have the right to restrict or object to our use of your information (including analytics and error reports), and to receive your data in a portable format. You can complain to your local data protection authority.

In California, you have the right to know, delete and correct personal information, and not to be discriminated against for using these rights. We don’t sell or “share” personal information as those laws define it.

In Australia, if you’re not happy with how we’ve handled a complaint, you can contact the Office of the Australian Information Commissioner.

Children

Board Game Metrics is not meant for children under 13, and we don’t knowingly collect their information. If you believe a child under 13 has an account, tell us and we’ll delete it.

Security

Information travels encrypted between the app and our servers and is encrypted where it is stored. Access is limited by rules in the database, so each person can reach only what they’re allowed to see. No system is perfectly secure; if a breach is likely to cause serious harm, we’ll tell you and the authorities as the law requires.

On your device

The app keeps these in its storage on your phone:

  • your sign-in session, so you stay signed in;
  • ranking answers not yet sent and half-finished forms, such as a game you’re logging with its players and notes, so you don’t lose work. A half-finished form is offered back for a day at most, and never to another account;
  • your settings and what the app has already shown you, such as your choice about usage statistics, the look you picked, whether it has asked you about notifications or shown the beta welcome, and the oldest app version that still works;
  • error reports that couldn’t be sent yet.

Signing out removes the session.

This website

boardgamemetrics.com uses no cookies, no analytics and no advertising. Our host (Firebase Hosting) records basic request logs, including IP addresses, to deliver and protect the site. Fonts are served from our own site.

Changes to this policy

When we change this policy we’ll update the date at the top. If a change matters, we’ll tell you in the app or by email before it takes effect.

Contact

privacy@boardgamemetrics.com