Security

BoardGameJoin starts with a simple principle: do not collect information we do not need. We aim to keep what we hold limited, retain it briefly, and protect it with multiple layers of safeguards.

Information we do not collect

• Passwords: We do not collect them. You log in with a link or code sent by email, or with your Google or Apple account.
• Credit card numbers: We do not collect them. If a payment is required, our payment processor, Stripe, handles card entry and storage. Card numbers do not reach BoardGameJoin’s servers.
• Real names, addresses and phone numbers: We do not ask for these to play (we ask rights holders who publish games for the contact details needed for their contracts).
• You can play without registering. We do not ask for an email address to play without registration.

Information we retain and for how long

• Members’ email addresses and nicknames, for login and display.
• Diagnostic match records used to investigate bugs. These are automatically deleted after 7 days in ordinary cases, or at most 30 days for matches where a problem occurred.
• See our Privacy Policy for details.

How we protect information

• All connections are encrypted using HTTPS.
• Your login session is held in a cookie that page scripts cannot read. On the server, it is stored as a hash that cannot be reversed to recover the original value.
• We verify who holds each seat at a table using a secret issued by the server.
• Pages can load only scripts permitted by BoardGameJoin.
• We automatically block excessive actions and login attempts within a short period.
• Only authorized staff accounts can access the administration interface.
• Before release, automated checks look for common patterns of weaknesses, such as how database commands are constructed and how text is inserted into pages. Changes that fail these checks are not released.

Keeping software updated

• We automatically check for new software versions every week and prioritize updates that include security fixes. If the release process detects a critical vulnerability in production dependencies, it stops the release.
• Our operating procedure is to review data breaches at other services and published vulnerabilities once a month, and check for similar weaknesses in our service.

If you notice a problem

If you discover a vulnerability or another security issue, please let us know through Report a bug. We will investigate and address it.

Last updated 2026-10-06 · Run by Qdan, Inc.