This notice provides a concise GDPR-focused summary of the data controller, purposes, legal bases, retention, recipients, transfers and user rights for BoardGame Friend.
This GDPR Privacy Notice applies to people using BoardGame Friend in the Netherlands or elsewhere in the European Economic Area. It should be read together with our Privacy Policy.
BoardGame Friend processes personal data to provide account, location, notification, profile, support, safety and app functionality. We do not currently use advertising SDKs or in-app purchase systems.
The controller is BoardGame Studio, trading as BoardGame Friend.
| Data category | Purpose | Legal basis | Retention |
|---|---|---|---|
| Name, surname, email address, account identifiers | Create and manage your account, authenticate you, provide support and secure access. | Contract, legitimate interests, legal obligation where applicable. | While the account is active, then deleted or anonymised after deletion unless a legal exception applies. |
| Birthday and age-related information | Eligibility checks, age-appropriate account handling and community safety. | Contract, legal obligation, legitimate interests or consent where required. | While the account is active or as needed to document eligibility decisions. |
| Gender and optional profile data | Profile customisation and optional community features. | Consent or contract depending on the feature. | Until you edit/delete it or until the account is deleted. |
| Location data | Show nearby players, events, places, maps and distance-based results. | Consent for precise device location; contract or legitimate interests for approximate location required for core features. | Only as long as needed for the feature, unless saved by you or needed for safety/security. |
| IP address, device data, app version, logs | Security, abuse prevention, debugging, fraud prevention, service reliability and diagnostics. | Legitimate interests and legal obligation where applicable. | 180 days, unless longer retention is needed for security investigations or legal claims. |
| Preferred language and app preferences | Display the app and messages in your preferred language and remember settings. | Contract and legitimate interests. | Until you change the setting, clear local data or delete your account. |
| Push notification token and notification settings | Send reminders, meetup updates, account alerts and service notifications. | Consent and legitimate interests for essential service messages. | Until notifications are disabled, token expires or the account is deleted. |
| Photos, camera data, files, PDFs and QR code data | Provide features you actively use, such as profile photos, QR scanning, file sharing or PDF viewing. | Consent, contract and legitimate interests. | Local-only unless uploaded or shared. Uploaded content is kept until removed or the account is deleted, subject to legal exceptions. |
| Support messages and deletion requests | Respond to questions, verify requests and document completion of privacy requests. | Contract, legal obligation and legitimate interests. | 24 months or longer where needed for legal claims or compliance. |
We do not intend to collect special categories of personal data, such as health data, religious beliefs, political opinions or biometric identifiers. Please do not upload or send this type of information unless a feature clearly asks for it and explains why.
Some ordinary personal data, such as location, birthday or profile information, can still be sensitive in context. We treat these categories carefully and limit access to what is necessary.
Personal data may be shared with processors and service providers only where needed to run the app, such as hosting providers, backend providers, Firebase Cloud Messaging, authentication providers, map/geocoding providers, support tools and app store platforms.
We may also disclose information where required by law, to protect users, to enforce our Terms or to respond to lawful requests from competent authorities.
Although our own servers are located within the European Economic Area (EEA), we use certain services provided by Google. Depending on the service and its configuration, personal data may be processed in, accessed from, or transferred to countries outside the EEA, including the United States.
Where such transfers occur, they are protected by an applicable adequacy decision, the EU-U.S. Data Privacy Framework, the European Commission’s Standard Contractual Clauses, or another legally recognised transfer mechanism. Further information about Google’s international data transfer safeguards is available in Google’s privacy and data transfer documentation.
We keep personal data only as long as necessary for the relevant purpose. When you delete your account, we delete or anonymise account-related personal data unless retention is required for legal, tax, security, fraud prevention or dispute-resolution reasons.
You can request deletion through the app or via our Data Deletion page.
Subject to the conditions in the GDPR, you may have the following rights:
To exercise these rights, email [email protected]. We may ask for information needed to verify your identity and locate your account.
We encourage you to contact us first so we can try to resolve your concern. You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or with another competent EEA supervisory authority.
BoardGame Friend does not currently make decisions based solely on automated processing that produce legal effects or similarly significant effects for users. If this changes, we will update this notice and provide the information required by the GDPR.
BoardGame Friend does not currently use advertising SDKs, personalised ads, paid subscriptions or in-app purchases. If these features are introduced later, we will update this notice and ask for consent where required.
Privacy contact: [email protected]