Last Updated: July 24, 2026
TableTopTourney ("we", "our", or "the app") respects your privacy and is committed to protecting your personal data. This privacy policy explains how we collect, use, and safeguard your information when you use our board game tournament tracking application.
When you create an account, we collect:
When you use the app, we store:
If you choose to use the BoardGameGeek (BGG) play import feature, we collect additional data. This feature is entirely optional and only activated when a tournament organiser explicitly enters a BGG username and clicks "Fetch Plays". No data is retrieved from BGG automatically.
When you use the BGG import, we retrieve and store:
This data originates from BoardGameGeek's public XML API. By using the import feature, you acknowledge that the plays you import are publicly visible on BoardGameGeek.
We use your information to:
Our legal basis for processing BGG import data is consent: you actively initiate the import by providing a username and clicking the import button. You are not required to use this feature.
By using this feature, you are also subject to BoardGameGeek's Privacy Policy. TableTopTourney uses BGG's public XML API in accordance with their API Terms of Use.
Retention: Imported play data is retained for as long as your tournament exists. You can delete individual plays at any time from the tournament dashboard, or request full deletion via our contact form.
International data transfer: BoardGameGeek is operated from the United States. When you trigger an import, a request is made to BGG's servers in the US to retrieve your public play data. We do not store any data on BGG's behalf — data is fetched transiently and then stored in our own EU/UK-accessible infrastructure.
Automated ranking: Imported play data is used to calculate tournament standings, statistics, and achievements. This processing is disclosed here as a matter of transparency.
AI and machine learning: We do not use any data imported from BoardGameGeek — or any other data you provide — to train artificial intelligence or large language models. This is strictly prohibited by BGG's API Terms of Use and our own policy.
Attribution: Game data (titles, images, complexity ratings) is sourced from and powered by BoardGameGeek.
Your data is stored securely using industry-standard encryption. We use PostgreSQL for tournament, contestant, and game data, Google Firebase for authentication, and Postscale for transactional email delivery. We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction.
We use Google Firebase Authentication to create and verify your account. Firebase stores your email address, a unique account identifier, and sign-in metadata (such as sign-in timestamps, used for account security).
Lawful basis: Processing this data is necessary to provide the service you've signed up for — you cannot use TableTopTourney without an authenticated account. This falls under "contractual necessity" (GDPR Art. 6(1)(b)), not consent, so no separate opt-in is required for authentication itself.
Retention: Your Firebase account record is retained for as long as your account exists. It is deleted when you request account deletion (see "Your Rights" below).
International data transfer: Firebase Authentication is operated by Google, and your account data may be processed on Google's infrastructure in the United States. This transfer is covered by Google's certification under the EU-US Data Privacy Framework and by Standard Contractual Clauses, which provide a recognized legal basis for transferring personal data from the EU/UK to the US.
We use Postscale, an EU-based transactional email provider, to send tournament invitations, notifications, and other account-related emails on our behalf. Postscale processes your email address and the content of the email being sent. Because Postscale's infrastructure is EU-hosted, no international transfer outside the EU/UK is involved in sending these emails.
We do not sell, trade, or rent your personal information to third parties. Your data may be shared only:
You may be added to a tournament without taking any action if an organizer enters your email address and it matches your registered account. You can leave a tournament at any time from the tournament's Contestants tab.
You have the right to:
We use essential cookies for authentication and session management. These are necessary for the app to function properly and cannot be disabled.
TableTopTourney accounts may not be created by children under 13, and we do not knowingly collect account data (email address, sign-in credentials) directly from children under 13.
Tabletop games are played by people of all ages, so a tournament organizer — who must be an adult with their own account — may enter the name or nickname of a minor as a contestant, for example a family member joining a game night. This is data entered about a child by their parent or guardian, not data collected from the child by us.
We may update this privacy policy from time to time. Any changes will be reflected with an updated "Last Updated" date at the top of this page.
If you have questions about this privacy policy or your data, please contact us through the app's support channels or create an issue on our GitHub repository.