BSB Labs
boardly

boardly privacy policy

Last updated: 19 October 2026

1. Who is responsible for your data

The controller of your personal data is BSB Labs: Dawid Badora, Łukasz Bojarczuk, Jakub Szczegielniak (“we”, “boardly”).

Contact for personal data matters: bsblabs.contact@gmail.com.

2. What data we collect

2.1. Account

  • email address and password; the sign-in provider stores the password only as an encrypted hash – we never know it,
  • when you sign in with Google, Facebook or Discord: your account ID with that provider and the data the provider shares with us – email address, name or username, and profile picture URL. We use them to sign you in and to suggest details when you set up your profile. We do not collect your friends, posts or photos from these services.

2.2. Profile (what you enter in the app)

  • username, first name, last name, nickname, profile picture, bio,
  • optionally: date of birth, gender, country, city, favourite game genres,
  • visibility settings for your date of birth, age and gender (by default visible only to you).

2.3. Using the app

  • game collection, wishlist, favourites,
  • logged plays: game, date, duration, participants, results and scores, notes,
  • offline players added to plays (name and optionally a photo),
  • game ratings, reviews, comments, likes,
  • friends, people you follow, clans and their content,
  • private messages,
  • notifications,
  • time of last activity (rounded to 5 minutes).

2.4. Finding players and meetups (adults only)

  • date of birth, which we use to check that you are an adult, and the date you accepted the rules for finding players,
  • listings: game, date and time, city, type of venue and approximate location. We do not store your exact position – before saving, we round it to a grid of about 2 km, and other people only see an area with a radius of about 1.5 km,
  • meetups: invitations, confirmations, attendance, ratings after the meetup (given and received).

Your phone's current location (if you allow it) is only used to show listings nearby: it is sent to the server with the search and is not stored.

2.5. Safety

  • players you have blocked,
  • reports of violations (made by you and about you), together with a copy of the reported content,
  • moderator decisions (e.g. account suspension),
  • counters that limit how many actions can be taken in a short time (protection against bots and spam) and IP addresses in server logs.

2.6. App usage statistics

We record which actions are taken (e.g. “play logged”, “game added to collection”) and when – without the content of messages, comments or reviews. We use this to calculate statistics (e.g. how many players are active). This data is pseudonymised: instead of your account, we store a random identifier. We do not use ads, advertising tools or cross-app tracking.

2.7. Photos

Photos you add in the app (profile, offline players, clans, game covers submitted to the catalogue) are resized on your phone before upload, and their metadata (EXIF) is removed, e.g. where and when the photo was taken or the phone model. Photos are publicly accessible at their web address.

3. Why we use your data and on what legal basis

  • Providing the service – account, profile, plays, collection, friends, chat, clans, finding players (Art. 6(1)(b) GDPR – contract).
  • User safety and protection against abuse – checking that you are an adult when finding players, blocking, reports, moderation, action limits (Art. 6(1)(f) GDPR – our legitimate interest; for reports also Art. 6(1)(c) – obligations under the Digital Services Act, DSA).
  • Statistics and developing the app (Art. 6(1)(f) GDPR).
  • Account emails – registration confirmation, password reset (Art. 6(1)(b) GDPR).

4. Who can see your data

4.1. Anyone on the internet, including people without an account

Every profile has a public page (…/u/<username>) that can be shared via a link: username, name or nickname in the form you choose, profile picture, number of followers, and number of game ratings and reviews.

4.2. All boardly users

  • profile: username, name or nickname, picture, bio,
  • collection, wishlist and favourite games,
  • game ratings and reviews,
  • a summary of your play statistics (e.g. number of plays and wins) and the date of your last play,
  • followers and people you follow,
  • date of birth, age and gender – only if you set them as visible to everyone.

4.3. Friends

  • city and country,
  • play history (without your notes), activity and full statistics,
  • date of birth, age and gender – if you set them as visible to friends.

4.4. Other people in specific situations

  • play participants: the data of that play, and notes – only if they played in it,
  • people looking for players (adults): your listings with an approximate area and your average meetup rating. A single rating becomes visible once both people have rated each other or 14 days after the meetup – so nobody rates in retaliation,
  • people you chat with: your messages to them.

4.5. boardly moderators

When handling a report, a moderator sees the reported content (the copy saved with the report). We do not read conversations unless they are reported.

4.6. Service providers (processors)

  • Supabase Inc. – database, sign-in and file storage; we store data in the EU region (Frankfurt, Germany),
  • Render.com – hosting of the app server; we process data in the EU region (Frankfurt, Germany),
  • Resend – sending confirmation and password reset emails,
  • Google, Meta (Facebook) and Discord – only when you sign in with them,
  • OpenFreeMap – the map in “Find players”: your phone downloads map tiles from their server (the server sees your IP address).

Some of these companies are based in the USA. Data is transferred outside the European Economic Area on the basis of the European Commission's standard contractual clauses or the EU–US Data Privacy Framework.

We do not sell your data.

5. How long we keep data

  • Account and profile data – until the account is deleted.
  • Messages – as long as the author's account exists.
  • Conversations started from listings with people who are not your friends – 12 months after the last message.
  • Notifications – read: 90 days, unread: 180 days, about meetups: up to 30 days after the meetup.
  • Listings – 90 days after they end.
  • Meetups without ratings – 2 years.
  • Detailed statistics events – 13 months; after that only anonymised daily summaries.
  • Reports and moderator decisions – 2 years after the case is closed.
  • Database backups – up to 30 days.

6. Deleting your account

You can delete your account in the app: Profile → Edit profile → Delete account. Without the app: write to bsblabs.contact@gmail.com or see the instructions at https://bsb-labs.com/boardly/account-deletion. Deletion is immediate and cannot be undone. What we delete and what remains without any link to you is described on the “boardly account deletion” page.

7. Your rights

You have the right to:

  • access your data and receive a copy of it,
  • rectify your data (you can correct most of it in the app),
  • have your data erased,
  • restrict processing,
  • data portability,
  • object to processing based on our legitimate interest (e.g. statistics),
  • lodge a complaint with the President of the Personal Data Protection Office (UODO), ul. Stawki 2, 00-193 Warsaw, Poland, uodo.gov.pl.

To exercise your rights, write to bsblabs.contact@gmail.com. We will reply within one month.

8. Age

The app is intended for people aged 16 and over. Finding players and meetups are available only to adults – age is based on the date of birth in your profile. Once your age has been confirmed, only a moderator can change your date of birth.

9. Security

Connections to the app are encrypted (HTTPS), and the database and backups are encrypted at rest. The app has no direct access to the database: our server reads and writes the data, and the app connects to Supabase directly only to sign in and to upload photos. Only the people who need it have administrative access. We use action limits, blocking and report moderation.

10. Cookies

The mobile app does not use cookies. The boardly web pages (public profile, account deletion instructions) do not use cookies or tracking tools.

11. Changes

We will inform you in the app about significant changes to this policy. The current version is always available at https://bsb-labs.com/boardly/privacy-policy.