Privacy Policy

Last updated: May 9, 2026

This Privacy Policy describes how Boardbash ("we", "our", or "the app") handles information collected when you use the app on the web or on mobile devices.

1. Information We Collect

To provide the online multiplayer experience, we collect a limited amount of information:

• Account data. A user-chosen nickname and a unique backend identifier. We do not require real names, email addresses, or phone numbers for account creation.
• Gameplay data. Win/loss records, move history, and current Elo rating used to facilitate fair matchmaking.
• Social data. A friends list that you build manually inside the app.
• Technical data. Standard request information such as IP address and approximate session timestamps used transiently to operate the multiplayer service and protect it from abuse.

2. How We Use Your Data

The data we collect is used strictly for the following purposes:

• Matchmaking. Using your Elo rating to find opponents of similar skill.
• Leaderboards and profiles. Displaying your nickname and game history to other players.
• Service functionality. Allowing you to log in across different devices and maintain your progress.
• Service integrity. Detecting and preventing abuse, cheating, or technical errors.

We do not sell your data and we do not use it for advertising.

3. Data Retention and Deletion

We believe in user autonomy over your digital footprint:

• In-app account deletion. Because an account is identified solely by an on-device identifier with no recovery path, the “Delete Account” control on the Account and Settings screens permanently deletes the account — it is not a local-only sign out. It deletes your nickname, backend identifier, Elo rating, friends list and tournament participations, removes you from other players’ friends lists, and ends any active session. This is irreversible and the account cannot be recovered.
• Self-service deletion. The same permanent deletion is also available through the one-click flow at nocap.gg/boardbash/delete-account.html, which triggers the identical backend flow as the in-app control. Your match history is anonymised in place (your side becomes “(deleted user)”) so opponents’ records remain intact.
• Email fallback. If you can’t use the self-service flow — for example because you’ve lost access to the device that holds your account — email us at the address in the Contact section below and we’ll process the deletion manually within 30 days.

4. Third-Party Services

The app is operated on infrastructure provided by Amazon Web Services (AWS), which processes data on our behalf to host the website, the multiplayer backend, and the database. The Android version of the app is distributed through Google Play; Google may collect information related to app installation and crashes in accordance with its own privacy policy.

We do not embed third-party advertising, analytics, or social-network SDKs in the app.

5. Children

The app is not directed at children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child has provided us with personal information, please contact us so we can remove it.

6. Security

We implement industry-standard security measures to protect your nickname and game history, including encrypted transport (HTTPS / WSS) and access controls on our backend. However, no method of transmission over the internet or method of electronic storage is 100% secure, and we cannot guarantee absolute security.

7. Changes to This Policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top of this page reflects the date of the most recent change. Material changes will be communicated within the app or on this page.

8. Contact Us

If you have questions about this Privacy Policy or wish to request deletion of your data, please contact us at tomcore.app@gmail.com.