1. Scope
This Privacy Policy applies to the BoardGame Friend mobile application, related in-app WebView pages, notifications, account features, location-based features, support requests and official web pages.
2. Data controller
The data controller for BoardGame Friend is BoardGame Studio, trading as BoardGame Friend.
- Email for privacy requests: [email protected]
- Website: boardgamefriend.app
3. Personal data we may collect
Depending on the features you use and the permissions you grant, BoardGame Friend may process the following categories of personal data:
Identity and profile data
First name, last name, display name, birthday, gender, email address, profile preferences and account identifiers.
Location data
Approximate or precise location, latitude and longitude, geocoded place information and distance-related information when location features are enabled.
Technical data
IP address, device type, operating system, app version, language setting, connectivity status, logs, security events and diagnostic information.
Login data
Authentication information from Google Sign-In or Sign in with Apple, such as an account identifier, email address and basic profile information provided by the sign-in provider.
Notification data
Push notification tokens, notification preferences, delivery status and local notification settings.
Media and files
Photos, camera images, QR codes, PDFs or files you choose to upload, scan, share or attach inside the app.
Usage and preference data
Preferred language, app settings, saved preferences, local storage data, feature usage and interaction data needed to provide the app.
Support and communication data
Messages you send to us, deletion requests, feedback, support emails and related metadata.
4. How we use personal data
We use personal data for the following purposes:
- Creating, securing and managing your account.
- Helping you find board game friends, events, groups or locations near you.
- Showing content in your preferred language and keeping your app settings.
- Sending service notifications, reminders, account messages and security alerts.
- Allowing sign-in through Google or Apple where you choose that option.
- Processing photos, camera input, QR codes, PDFs or selected files when you use those features.
- Maintaining app security, preventing misuse, investigating suspicious activity and protecting users.
- Debugging crashes, improving reliability and maintaining compatibility across devices.
- Responding to support requests, privacy requests and data deletion requests.
- Complying with legal obligations and enforcing our Terms of Use.
5. Legal bases under the GDPR
For users in the the European Economic Area, we rely on one or more of the following GDPR legal bases:
| Legal basis | Examples |
|---|---|
| Contract | Creating your account, providing core app features, saving preferences and responding to support requests related to your account. |
| Consent | Precise location access, camera access, photo library access, push notifications, optional profile information and any future non-essential analytics, advertising or marketing features. |
| Legitimate interests | Security, fraud prevention, abuse prevention, service improvement, diagnostics and maintaining a reliable app experience, balanced against your rights and expectations. |
| Legal obligation | Responding to valid legal requests, keeping records required by law and handling regulatory obligations. |
6. App permissions
The app may ask for device permissions only when a feature needs them. You can change permissions in your device settings at any time.
- Location: used to show nearby players, places or events and to calculate distance-based results.
- Notifications: used for reminders, messages, game meetups, account alerts and service updates.
- Camera: used for profile images, QR code scanning or other camera-based features you actively choose.
- Photos and files: used when you select images, PDFs or files from your device.
- Storage and local data: used to keep preferences, secure tokens and offline app data on your device.
7. Third-party services and processors
We may use trusted service providers to operate the app. Depending on the final app configuration, these may include:
- Firebase Cloud Messaging for push notifications.
- Google Sign-In and Sign in with Apple for authentication when you choose those login methods.
- Map, geocoding and location service providers used to display maps or convert coordinates into places.
- Email, support and incident management tools used to respond to user requests.
- App store platforms and operating system providers, such as Google Play and Apple App Store, where required for distribution and account features.
We require processors to handle personal data only for our instructions, to protect it appropriately and to comply with applicable data protection requirements.
8. International data transfers
Some service providers may process data outside the Netherlands or the European Economic Area. Where this happens, we use appropriate safeguards, such as adequacy decisions, Standard Contractual Clauses or other lawful transfer mechanisms required by the GDPR.
9. Advertising, in-app purchases and payments
BoardGame Friend does not currently include advertising SDKs, personalised advertising, paid subscriptions or in-app purchases.
If advertising, analytics, purchases or subscriptions are added later, we will update this Privacy Policy, update the app store privacy disclosures where required, and request consent where required by law or platform rules.
10. Data retention
We keep personal data only for as long as necessary for the purposes described in this policy. Typical retention periods are:
- Account and profile data: while your account is active, then deleted or anonymised after account deletion unless a legal exception applies.
- Location data: kept only as long as needed for the location-based feature, unless saved by you or required for safety and abuse prevention.
- Support messages: kept for 24 months to handle follow-up questions and protect legal rights.
- Security and technical logs: kept for 180 days, unless longer retention is needed to investigate abuse, fraud or incidents.
- Legal records: kept as long as required by applicable law.
11. Security
We use technical and organisational measures designed to protect personal data, such as secure storage for tokens, encrypted connections, access controls, least-privilege access, logging and regular review of app dependencies. No service can guarantee absolute security, but we work to protect your information against unauthorised access, loss, misuse and alteration.
12. Children and age requirements
BoardGame Friend is not intended for children below the age at which they can lawfully consent to information society services in the Netherlands without parental authorisation. If we learn that we have collected personal data from a child without the required parental authorisation, we will take reasonable steps to delete it.
13. Your privacy rights
Under the GDPR, you may have the right to request access, rectification, erasure, restriction, portability and objection. You can also withdraw consent at any time where processing is based on consent. Withdrawing consent does not affect processing that happened before withdrawal.
To exercise your rights, contact us at [email protected]. We may need to verify your identity before completing the request.
You also have the right to lodge a complaint with the Dutch supervisory authority, the Autoriteit Persoonsgegevens, or with another competent supervisory authority in the EEA.
14. Changes to this policy
We may update this Privacy Policy when the app, legal requirements, service providers or data practices change. The latest version will be available in the app and on our official website. If changes are material, we will provide additional notice where required.
15. Contact
For privacy questions, data requests or complaints, contact:
- Email: [email protected]