Privacy Policy

What we collect

The first time you open any page, we create a guest profile on our server: a random ID, a random name and an avatar. That is what lets you play without an account. The matches you play, their results and the achievements you earn are saved to that profile, and anything you write in a playroom chat is saved with your name. If you create an account, we also store your email address, your username and a hashed password. If you sign in with Google, we store the email address and account ID Google sends us instead of a password. Guest profiles that go unused for seven days are deleted.

Analytics

PostHog, hosted in the EU, shows us how the site is used: page views, clicks, errors and session recordings. Recordings hide what you type into fields and the chat messages players send. If you are signed in, it links these to your account ID, never to your email address. In the EU, the EEA and the UK, and wherever we can't tell where you are, we ask first. Until you answer, PostHog only counts page views and errors and keeps nothing in your browser. If you accept, it runs in full; if you decline, it stops. Everywhere else it runs in full unless you decline.

Cloudflare, which delivers the site, also runs its Web Analytics on every page, whatever you choose. It counts page views and measures how fast pages load, without cookies and without storing anything in your browser.

Cookies and storage

This is what Playboard keeps in your browser, grouped by what it is for. Our own keys all start with "playboard:" or "pb".

Your identity (always)

Your guest token and ID (playboard:guestToken and playboard:guestId, with backup copies in playboard:lastGuestToken and playboard:lastGuestId) and your guest name (playboard:guestUsername), in local and session storage. The token is valid for 30 days. A copy of it is kept for 30 days in the pb_guest cookie, which scripts can't read and which is only sent to our sign-in pages, so your guest games move to your account when you sign in. Signing in sets the pb_session cookie, which keeps you signed in for 30 days, and pb_oauth_state and pb_oauth_return, which last ten minutes during a Google sign-in (the second remembers which page to bring you back to). pb:consent remembers your answer to the cookie banner, and playboard:chunk-reload-build lets an open page reload itself once after we release an update.

Game progress and preferences

The playroom you are in and the match you are playing, so that a reload or a second tab takes you back to the table; the achievements you have already been shown; your Minesweeper difficulty; and what you entered in our tools: the chess clock, the score keepers, the solvers and the bracket and nonogram generators. They are only used on this device.

Analytics (PostHog)

Once PostHog runs in full (see Analytics above), it keeps an anonymous ID and your current session in local and session storage, under keys that start with ph_. Before that it keeps nothing. If you decline, it deletes those keys and keeps only a note of your answer, under a key that starts with __ph_opt_in_out.

Cloudflare Web Analytics

Nothing. It sets no cookies and uses no browser storage.

Your rights

You can change your answer at any time with the "Cookie preferences" link in the page footer. Clearing this site's data in your browser removes everything listed above from your device; if you play as a guest, your guest profile is then deleted after seven days. For GDPR-style data requests (access, deletion, or correction), please reach out via the channels listed on our site and we will respond within 30 days.