Privacy policy

Last updated: October 14, 2026

Boardweaver, Inc. ("Boardweaver," "we," "us," or "our") provides a service for creating, hosting, playtesting, and playing digital board games. This policy explains how we handle personal information through our website, Studio, multiplayer games, events, support, and connected AI tools.

For privacy questions or requests, email [email protected] or use our contact form.

1. Information we collect

• Accounts and profiles: your email address, username, profile description, avatar, account identifiers, sign-in credentials, account settings, and plan information. Password-based accounts use a password hash. If you sign in with Discord, we receive the account information Discord supplies for that sign-in, including your Discord identifier, email address, username, and avatar.
• Guest play: a display name, a browser/session identifier, and records of the games and events you join. Playing without creating an account does not make your activity anonymous to Boardweaver.
• Game development: game source code, rules, descriptions, themes, artwork, sounds, uploaded files, version history, checkpoints, membership and invitation information, publication submissions, and test-session information you create or send us.
• Play and feedback: match membership, moves, game state, results, scores, replays, activity measurements, favorites, event and table participation, and playtest feedback. Game errors can include diagnostic information and game state needed to investigate the problem.
• Communications: contact-form messages, support tickets, collaborator invitations, feedback, email delivery records, and notification preferences. Invitations can include an email address someone else gives us to invite you.
• Connected tools: authorization and client information for an AI assistant or other app you connect, tool names, tool inputs and outputs, errors, and execution times. These records can contain game code, content, and other information included in a tool request or response.
• Technical and usage information: IP addresses and request information received by our hosting and logging systems; browser, device, page, referral, interaction, and performance information; and identifiers used for sessions and analytics. If you enable browser push notifications, we store the subscription endpoint and keys needed to send them.

2. How we use information

We use this information to provide accounts and guest access; save and run games; coordinate multiplayer matches and events; display profiles, game pages, and replays; manage collaboration and publication; deliver requested notifications and service emails; answer support requests; maintain security; investigate errors and abuse; and understand and improve the service.

Game creators and their authorized collaborators can receive playtest feedback and match information, including the submitting player's username, answers, results, and activity statistics. We also use aggregated statistics to understand how games and the platform are used.

3. What other people can see

Your username, avatar, and public profile information may be visible to other users. Published games and their public pages, artwork, rules, and descriptions are available to visitors. Game membership, release settings, and event access affect who can edit or play a game. People with a table code or shared link may be able to join where the game's or event's settings allow it.

Other players and spectators can see the match information the game and service show them. Game creators and authorized team members can inspect playtest matches, feedback, replays, and diagnostics. Information described as hidden or private game state is part of a game's rules and presentation; it is not a promise that the information is inaccessible to Boardweaver or an authorized game editor.

Uploaded media may be served through publicly reachable asset URLs. Unpublishing or deleting an item does not retrieve copies other people have already downloaded or remove every cached copy immediately. Avoid putting personal or confidential information in public game content, feedback, or uploaded assets.

4. AI assistants and other connected apps

When you authorize a connection, such as an AI assistant using the Model Context Protocol (MCP), that client can request information and perform actions allowed by your authorization and game access. Depending on the tools it calls, it may read game files, edit content, upload assets, run tests, save versions or checkpoints, or delete a game. The client receives the results of its requests.

We receive the requests and content that the client sends to Boardweaver. A connection does not itself give us blanket access to your conversations with the AI provider. However, a request can include conversation excerpts or other personal information if you or the client include them. Tool inputs and outputs are recorded for troubleshooting and accountability, so avoid including secrets or unrelated personal information.

You can review and revoke connection credentials in MCP Connections. Revoking a credential does not erase information already received by the connected provider, and you may also need to disconnect Boardweaver in that provider's settings. That provider's own terms and privacy policy govern its handling of your conversations and the information it receives.

Our team may also use AI-assisted development tools, including Claude Code and Codex, when building, maintaining, or supporting the platform and games. Material submitted for that work can be processed by those providers. A separate agreement for a game implementation may contain additional restrictions on that use.

5. Cookies, local storage, and analytics

We use browser storage and cookies for sign-in, browser identification, sign-in security, preferences, navigation, and analytics. Clearing or blocking storage can sign you out or prevent features from working.

We use PostHog for product analytics, performance measurements, and session replay. This can include page views, clicks and interactions, device and browser information, referral information, and a recording of visible page activity. For signed-in users, analytics profiles can be associated with your account identifier, email address, username, and account creation date. Guest activity can also be associated with a guest identifier.

Our replay configuration masks typed inputs and blocks the code editor and designated sensitive areas. Other visible content can appear in a replay; these measures are not a guarantee that every piece of personal information on a page is excluded. We also send service-side usage events to PostHog.

We do not currently offer a separate in-app analytics opt-out control, and our analytics configuration does not respond to browser Do Not Track signals. You can manage cookies and site storage through your browser or use blocking tools. Blocking browser analytics does not stop operational records or usage events generated by our servers. Contact us about any privacy choices or rights available under applicable law.

We do not sell personal information or use it for cross-context behavioral advertising.

6. Service providers and other disclosures

We share information as needed with providers that help operate Boardweaver. These include DigitalOcean and Amazon Web Services for hosting and storage, PostHog for analytics and replay, Better Stack for logging, email delivery providers, and browser push-notification services. Google receives connection information when your browser loads Google Fonts. Discord processes a sign-in when you choose to use it. Our team also uses file-storage, collaboration, and AI development services for the work described above.

A connected app, an external application form, a community service such as Discord, or a website you follow a link to has its own privacy practices. We share information with other users and game teams as described in this policy, and with a connected provider when you authorize its requests.

We may also disclose information when reasonably necessary to comply with law or valid legal process; protect people's safety, rights, and the service; investigate fraud or abuse; or complete a merger, acquisition, financing, or transfer of our business, subject to applicable privacy obligations.

7. Retention and deletion

Saved account information, game content and versions, match histories, feedback, and connector audit records are retained to operate the service and preserve its shared records. We do not currently apply one automatic deletion deadline to all of these categories. Logging, analytics, email, and backup systems may have different retention settings. Contact us for information about a particular record or to request deletion.

Temporary AI playtest sessions expire after about 30 minutes without a state update. A checkpoint saved from a session is a separate saved record and does not expire with the session. Rendered screenshot download links expire after five minutes and a successful download requests deletion of the stored image; undownloaded render images are subject to a one-day storage cleanup rule. Anyone with an unexpired screenshot link can download that image. These temporary limits do not delete the associated tool audit records, saved game files, or versions.

Deleting a game through the interface or a connected tool hides it from normal access but is not an immediate purge of its stored content or history. Guest sign-in expiry also does not erase the guest's match records. Removing access, revoking a token, and clearing browser storage are different from deleting saved information.

For account or content deletion requests, contact us. We may retain information needed for legal obligations, security, resolving disputes, preventing abuse, or records shared with other participants. Backups, version history, and providers' retained copies may persist after removal from active use. We will handle requests as required by applicable law and explain relevant limitations.

8. Your choices and privacy rights

You can edit available profile settings, manage game collaborators and publication settings, review connected tools, and change notification settings in your account. Optional notification emails include unsubscribe controls. Essential messages, such as security and password-reset emails, may still be sent. You can turn off push notifications in notification settings or in your browser.

Depending on where you live and the law that applies, you may have rights to access, correct, obtain a copy of, delete, or restrict the use of personal information, or to object to processing or withdraw consent. Send requests to [email protected] or through the contact form. We may need to verify your identity and authority before acting. You can also contact the privacy regulator responsible for your location. We will not discriminate against you for exercising an applicable privacy right.

If we decline a privacy request, you can appeal by writing to the same email address and identifying your original request. We will respond within the time required by applicable law. Delaware residents can also find complaint information through the Delaware Department of Justice privacy portal.

9. International processing and security

Boardweaver uses providers and systems that may process information in the United States and other countries with different privacy laws. Where applicable law requires safeguards for an international transfer, those requirements continue to apply.

We use access controls and other technical measures to protect information, but no service can guarantee complete security. Keep your credentials and connector tokens private, and contact us if you suspect unauthorized access.

10. Children

Boardweaver is intended for people aged 13 and older, subject to any higher minimum age required where they live. We do not knowingly collect personal information from children under 13. If you believe a child under 13 has provided personal information, contact us so we can investigate and take appropriate action. Younger users who cannot agree to binding terms themselves need a parent or guardian's permission as described in our Terms of service.

11. Changes and contact

We will post changes to this policy here and update the date above. For a material change, we will provide additional notice where required by law. This policy does not authorize a use of previously collected information that requires additional consent without obtaining that consent.

Contact Boardweaver, Inc. at [email protected] or through the contact form.