Privacy Policy

1. Data Controller

Worldboard LLC ("we," "us," or "our") operates Worldboard. We are the data controller responsible for your personal data. For privacy inquiries, contact us at privacy@worldboard.games.

2. Data We Collect

We collect the following categories of personal data:

• Account data: email address, display name, and hashed password when you register. Your display name is not private — see Data Sharing below for where it is shown.
• Authentication provider data: if you sign in via Google or Facebook, we receive your name and email from the provider.
• Game session data: game configurations, in-game actions, scores, and session history.
• Technical data: browser type, device information, and IP address collected automatically when you use the service.
• Mobile app data: if you use the Worldboard app, a record of each phone you sign in on: a sign-in token (stored hashed), a device label such as "Worldboard (android 0.1.0)", and when it was created and last used. If you allow notifications, we also store that phone's push notification token.
• Usage analytics data: aggregated, anonymized page-visit data (pages viewed, referrer, browser, operating system and device type, and approximate location — country, region, and city — derived from your IP address) collected via a cookieless analytics service (Vercel Web Analytics). Visitors are identified only by a hash that rotates daily; no cookie or other identifier is stored on your device.

3. How We Use Your Data

• To create and manage your account.
• To provide, operate, and improve the Worldboard game experience.
• To enable real-time multiplayer gameplay via WebSocket.
• To send notifications from the mobile app when a game needs you, if you allow them.
• To communicate with you about your account, including password resets and verification emails.
• To enforce our Terms of Service and prevent abuse.
• To understand aggregate site usage and improve the service, using anonymized page-visit analytics.

4. Legal Basis for Processing (EU/EEA Users)

We process your personal data under the following legal bases:

• Contract: processing necessary to provide the service you signed up for.
• Legitimate interest: service improvement, security, and fraud prevention.
• Consent: where you have given specific consent, such as for cookies.

5. Data Sharing

We do not sell your personal data. We may share data with the following categories of recipients:

• Other players and public visitors: your display name is shown to the other players in any game you join. If you enter a tournament or a league round, it also appears on that event's board — and, in the league, on its round rosters and its season tables — where every other entrant can see it. A tournament we list publicly carries your name further still: onto the index of past tournaments, and into The Worldboard Weekly's recap, which anyone can read with no Worldboard account. A league round's results stay on the league's own pages. Any player in a game can also publish that game's replay as a public link, which names everyone who played. The "Display my name publicly" setting in your profile governs how your contributions are credited and whether The Worldboard Weekly lists your results under your name; it does not remove your name from a game or event board.
• Infrastructure providers: hosting, database, deployment, and analytics services that process data on our behalf.
• Authentication providers: Google and Facebook for social login functionality.
• Google: maps and Street View imagery in our games, and the delivery of the mobile app's notifications (Firebase Cloud Messaging), whose content passes through Google's servers.
• Legal obligations: when required by law, regulation, or legal process.

6. Data Retention

We retain your account data for as long as your account is active. Game session data is retained to provide game history and statistics. If you delete your account, we will remove your personal data within 30 days, except where retention is required by law. A phone's sign-in record and push notification token are deleted once you log out of the mobile app on that phone, or once the sign-in expires, 180 days after it was made.

7. Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

• Access: request a copy of your personal data.
• Rectification: correct inaccurate data.
• Erasure: request deletion of your data.
• Portability: receive your data in a machine-readable format.
• Objection: object to certain processing activities.
• Withdraw consent: withdraw consent at any time where processing is based on consent.

To exercise any of these rights, contact us at privacy@worldboard.games.

Deleting your account: email privacy@worldboard.games from your account's email address and ask us to delete your Worldboard account. We delete the account and its personal data within 30 days, except where the law requires us to keep it.

8. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including encryption in transit (TLS), hashed passwords, and access controls. However, no method of transmission over the internet is 100% secure.

9. International Transfers

Your data may be processed in countries outside your jurisdiction, including the United States. Where we transfer data internationally, we ensure appropriate safeguards are in place in accordance with applicable data protection laws.

10. Children's Privacy

Worldboard is not intended for children under 13 years of age. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us so we can delete it.

11. Cookies

For details about the cookies we use and how to manage them, please see our Cookie Policy.

12. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on this page with a revised "Last updated" date.