Privacy Policy

Effective 2026-07-16 · Last updated 2026-08-07 · FullBoard (fullboard.gg)

FullBoard (“FullBoard,” “we,” “us”) operates fullboard.gg, a web app that helps tabletop trading card game players find and join games at local game stores. This policy explains what we collect, why, and how you can control it.

1. Information we collect

Account information. When you sign up, we collect your email address and a password. Passwords are stored as salted hashes — we never see or store them in plain text.

Profile information you provide. Display name, bio, games you play, availability text, home store, and an optional profile photo. Your display name, bio, and profile photo are public; some fields are visible to friends only (Section 3).

Profile photo. If you upload a profile photo, it’s resized and stored in a public file bucket — anyone can view it by direct link, the same way it appears in the app. You can remove it at any time from your profile settings, and our admin can remove a photo that violates our content rules.

Content you create. Tables you post, comments, direct messages to friends, community posts, event RSVPs, post-game highlights, and props you give other players. Direct messages are visible only to you and the recipient.

Check-in / presence data. If you check in at a store, we read your location once — through your browser on the web app, or through your device’s location permission on the Android app (foreground-only; we never request background location). We compare it to the store’s coordinates on our server to confirm you’re nearby, then discard the raw coordinates — we do not store your GPS location. We store only which store, which games, and when; other users only ever see anonymous headcounts.

Push notification data. If you enable push, your device registers a subscription so we can deliver alerts — an endpoint URL and encryption keys on the web app, or a push token on the Android app (Section 4).

Social graph. Who you’re friends with, which stores you follow, and who you’ve blocked. Blocking is private: the person you block is never told.

Infrastructure data. Our hosting providers generate standard server logs (IP address, timestamps, errors) as a normal part of operating a website. We also use two privacy-preserving measurement tools from our host, Vercel: Speed Insights (how quickly pages load and respond) and Web Analytics (which pages are visited, and roughly how many people visit them). Neither sets cookies, neither builds a profile of you, and neither follows you to other websites. We run no advertising scripts and no cross-site tracking of any kind.

What we don’t collect. Phone numbers, home addresses, payment information, or government ID.

2. How we use your information

• To operate the service: your account, the board, joining tables, notifications, store check-ins.
• To keep the community safe: content filters, report review, Terms enforcement.
• To communicate with you: confirmation emails, password resets, and push notifications you enable.

We do not sell your information, share it with advertisers, or use it to build advertising profiles.

3. Who can see what

Visibility is enforced at the database level, not just hidden in the app:

• Display name, bio, games played, tables, comments — everyone, including signed-out visitors.
• Table membership — everyone.
• Home store, availability, upcoming tables, “looking to play tonight” — friends only.
• Direct messages — you and the recipient only.
• Your check-ins — you only (public headcounts are anonymous numbers).
• Who you’ve blocked — you only.
• Email and password — never shown to other users.

A single owner-administrator can access moderation tools (reports, deleted content, account bans) as part of running the platform.

4. Third parties we work with

We use a small number of service providers to run FullBoard; none may use your data for their own purposes: Supabase (database, authentication, and file storage for profile photos), Vercel (application hosting, plus the page-performance and visit measurement described in Section 1), Resend (transactional email), Sentry (error monitoring, configured to never collect your IP address, cookies, or screen recordings — it sees only technical error details), your browser’s push service (Google, Apple, or Mozilla) if you enable notifications on the web app, and Expo’s push notification service (which relays to Google Firebase Cloud Messaging) if you enable notifications on the Android app. Your account data is stored on Supabase’s servers in the United States (Oregon).

5. Cookies

We use two cookies, both necessary for the app to function: a session cookie that keeps you signed in, and (during the private beta) a beta-access cookie storing a scrambled version of your invite code. There are no advertising or analytics cookies.

6. Data retention

We keep your account and content for as long as your account is active. Deleted posts and comments are hidden from public view immediately but retained so our admin can review reports and enforce our Terms. You can permanently delete your account at any time from your profile settings, on the web app or the Android app — this immediately and irreversibly erases your account, profile photo, tables, comments, messages, and other content. If you’d rather we handle it for you, email privacy@fullboard.gg.

When you remove a direct message for everyone, its text is erased from the conversation straight away and a marker showing a message was removed stays in its place. We keep a copy of the original text for up to 30 days so our admin can act on a report about it, and longer if it has actually been reported. Removing a message from your own view doesn’t change the other person’s copy. A push notification already delivered to a device can’t be recalled, so it may still show the original text.

7. Your choices

• Edit your profile, change or remove your profile photo, and delete your own comments at any time.
• Delete your account entirely from profile settings — this is permanent and cannot be undone. You can also remove an individual direct message from your own view, and messages you sent can be removed for both people; deleting your account permanently erases every conversation you were part of (Section 6).
• Turn push notifications off from your device settings or your FullBoard profile settings.
• Control whether friends can see you checked in with the “share my presence” setting.
• Unfriend, unfollow, or block from any player’s profile.

8. Children’s privacy

FullBoard is not directed at children, and we do not knowingly collect information from anyone under 13. If you believe a child under 13 has created an account, contact us at privacy@fullboard.gg and we will remove it.

9. Security

We use industry-standard practices to protect your data, including database-level access controls (Row Level Security) so that even a bug in our application code cannot expose another user’s private data, encrypted connections (HTTPS) everywhere, and hashed password storage. No system is perfectly secure, and we can’t guarantee absolute security.

10. Changes to this policy

If we make material changes, we’ll update the date above and, for significant changes, notify active users in-app.

11. Contact

Questions about this policy or your data: privacy@fullboard.gg