Privacy

What information we collect and how it is used. We do not collect an email address from anyone who only joins a party.

Security

Information we collect

Icon images

We receive only the image cropped and resized to 256px on your device. We do not receive the original photo or information such as where it was taken. Images are displayed only to people in the same Party and on your own screen; we review them if reported. We delete them immediately when replaced, deleted, or when you close your account, and 30 days after you cancel paid membership.

Required technical diagnostics

To reproduce and fix problems, we record online game settings, actions, state (including hands, the deck and random seeds) and release versions on the server. Reports and detected client errors also include browser type, viewport size, connection status and move number. Diagnostics cannot be disabled. Other players continue to receive only information allowed by the rules of the game.

Information excluded from diagnostics

Diagnostic game state and action data exclude names, account IDs, authentication tokens, passwords, payment information, avatars and chat content. Players are represented by seat IDs within a match. Written reports, reproduction steps and optional contact details are stored separately from game state. Do not include secrets or personal information in report text.

Diagnostic and report retention

Ordinary diagnostic records become unavailable 7 days after creation. Records linked to a report or detected problem become unavailable at most 30 days after each record was created. Report text and contact details are retained for 30 days from receipt. An email address left as a contact is deleted once we have sent the one fix notice. Expired data is deleted by a job running every 15 minutes, or after recovery if that job is interrupted. Recovery backups follow the infrastructure provider’s retention period; expired records must be deleted before using restored data. These periods are separate from the retention of match rankings and similar records.

Turn-based resume data

We retain the board state, seats, display names, hashed seat tokens and settings needed to resume a Party. After 45 days without a game action (from creation or a mode change before play starts), the Party ends automatically and its resume data is deleted. Connections and chat do not extend this deadline. This is separate from the 7-day / 30-day diagnostic retention; diagnostic use does not extend resume-data retention. Chat is retained for at most 30 days. Seat tokens and a list of saved Parties are stored in the browser you joined with.

Invitation event data

We retain event titles, descriptions, times, participant display names, attendance, tables, tournament results and hashed participant tokens until 30 days after the scheduled end. People with the invitation link can view the description, participant names and results. Do not put email addresses or contact details in descriptions. Participant tokens and your event list are stored in the browser you used to join; clearing browser data removes access to your seat. Match and diagnostic record retention periods are separate.

AI-assisted investigation and fixes

Authorized operators may use AI to help reproduce, fix and verify problems from diagnostic records. Data provided to an external AI service is limited to necessary game state and actions, with names, account information and contact details removed. Only services whose applicable terms exclude model training on that data may be used. Automatic transmission to external AI services will begin only after we disclose the provider, processing terms and retention here and complete any required legal steps.

Diagnostic storage and access

We use Cloudflare infrastructure to store and process diagnostics and reports. Access is limited to operators authorized to investigate problems and processes under their control. Diagnostic records are not made public or reused for personalized advertising or disclosure to rights holders.

How we use it

We use it to run matches, show your results, prevent cheating and abuse, investigate outages, and improve the Service. We do not use it for personalized advertising.

What we share with third parties

Payment is handled by Stripe. We give rights holders aggregate data — play counts, player counts, time played, win rates, and similar — with names and personal information removed. Match records (such as move history) are shared, also with names removed, only for players who have opted in. Processing of technical diagnostics is described in the diagnostic sections of this page. Information sent to Google for analytics is described in the analytics section below. Otherwise, we do not share your information elsewhere except where required by law.

Retention

Game state and actions used to replay a match are automatically deleted 13 months after the match ends. Match statistics (game, ranking and rating) and participant records are used to display results and compile statistics in the administration interface; they are not automatically deleted after a fixed period. Aggregate statistics are also retained. Access-log retention depends on the infrastructure provider’s settings.

Party chat

Our team may review Party chat to address abusive behavior and improve the service. We retain messages for 30 days from when they are sent, then delete them. We store them without linking them to device or account information.

Party quotes

Quotes saved in a Party are deleted when the party ends. If someone reports them, we keep them together with the chat for 30 days so that we can review them. Quote images are made on your device and are never stored by BoardGameJoin.

Recommendations

A recommendation posted on a game page is public: anyone can read its text, the nickname of the member who wrote it, and how many people marked it helpful. If the writer chooses to show them, the number of games played and total time for that title appear as well (either can be turned off). We do not store the nickname with the post; we show the member’s current name each time. Reports and who sent them are never published. Posts, votes and reports are deleted when the writer deletes them and when the account is closed.

If you close your account

We delete information that identifies you personally, and keep match records in anonymized form. Past-season leaderboards remain, anonymized. Recommendations, helpful votes and reports are deleted.

Analytics (Google Analytics / GA4)

We use Google Analytics (GA4) to understand usage and improve the Service. We send Google the URLs and titles of pages viewed, referrers, browser and device information, cookie-based identifiers, and events such as the game played, player and CPU counts, match starts and ends, error types, registration methods and entry points, purchases, shop interactions, and wording experiments. GA4 uses cookies to distinguish browsers and measure usage. On rights-holder application pages, we adjust the page URL so that the invitation token is not sent. For visitors from the EU, EEA, United Kingdom, and Switzerland, we use GA4 only with consent, which can be changed at any time through “Cookie settings” in the footer.

Cookies and browser storage

Cookies keep you logged in and remember which login method you used last. Google Analytics (GA4) also uses cookies for analytics. Browser storage holds your seat information, settings and a device ID. You can decline cookies in your browser settings (you will not be able to stay logged in or return to a Party).

External services we use

We use Cloudflare for hosting, storage and bot protection (Turnstile); Google Analytics (GA4) for analytics; Google and Apple for sign-in (only if you choose them; we receive your email address and an identifier); and Stripe for payments (Stripe handles card details; we do not store them). Where Cloudflare Web Analytics is enabled, we also use its cookie-free analytics.

Access, correction, and deletion

Contact us at contact@qdan.co.jp. We will act on your request after confirming your identity.

Business operator

Qdan, Inc. (address and representative are listed on the Specified Commercial Transactions Act disclosure)

2026-10-29 / Qdan, Inc. / contact@qdan.co.jp

Last updated 2026-10-29 · Run by Qdan, Inc.