Privacy Policy

1. Who we are

This website is operated by Kieran Smith, creator of Boardsmith, based in the United Kingdom. If you have any questions about this policy, you can contact us at kieransmith993@gmail.com.

2. What data we collect

If you create an account, we collect and store:

• Your name.
• Your email address.
• A securely hashed version of your password. We never store your password in a readable form.

We use this information to let you sign in, keep your progress and streaks associated with your account, and send you essential account emails such as password resets. Our lawful basis for this processing is the performance of a contract, namely providing the account and its features to you.

We do not use your account data for advertising, profiling, or marketing, and we do not share it with third parties except as described in the "Third-party services" section below.

3. Cookies

This site uses a small number of essential cookies that are required for it to function:

• A session cookie, which keeps you signed in as you move between pages.
• A security (CSRF) token cookie, which protects forms such as the login form from misuse.

These cookies are strictly necessary for the operation of the site, are not used to track you across other websites, and do not require a consent banner under UK law. We do not use cookies for advertising, analytics, or profiling.

4. Analytics

We use Umami, a privacy-first analytics tool, to understand broadly how many people visit the site, which pages are viewed, where traffic comes from at a high level, and general country-level usage patterns.

This tool is designed to operate without cookies and without tracking people across sites or sessions. We do not use it to identify individual visitors.

Our lawful basis for this processing is legitimate interests, namely understanding and improving the performance and usefulness of the website while processing as little data as possible. If you object to this processing, you can contact us at kieransmith993@gmail.com.

5. Local storage

The games on this site save certain information directly in your browser using local storage. This includes game progress, puzzle state, settings, audio preferences, and whether you have seen a tutorial.

This information stays on your device and is under your control. You can remove it at any time by clearing your browser's site data for this website.

6. Emails we send

We only send emails that are needed to operate your account, such as password reset emails. These are delivered through an email service provider acting on our behalf. We do not send marketing emails.

7. Third-party services

We use an email service provider to deliver essential account emails, as described above.

We use a privacy-first analytics tool to understand in aggregate how this site is used.

Other than the tools described above, this site does not load third-party advertising scripts, tracking pixels, embedded videos, externally hosted fonts, or similar third-party services that monitor your behaviour.

8. Data protection rights

Under UK data protection law, you have rights in relation to your personal data. These include:

• The right to be informed.
• The right of access.
• The right to rectification.
• The right to erasure.
• The right to restrict processing.
• The right to data portability.
• The right to object.
• Rights related to automated decision-making and profiling.

You also have the right to complain to the Information Commissioner's Office (ICO) if you believe your data has been handled unlawfully.

If you wish to exercise any of your rights, including having your account and its data deleted, please contact us at kieransmith993@gmail.com.

9. Retention

We keep as little data as possible. Account data is retained for as long as your account exists. If you ask us to delete your account, the associated personal data will be removed from our systems.

Information saved in your browser's local storage remains on your device until you clear it.

10. Data transfers

Our email service provider and analytics provider may process limited data on servers located outside the United Kingdom. Where this involves personal data, it is protected by safeguards recognised under UK data protection law.

11. Children

This site is intended for a general audience and is not directed at children. We do not knowingly collect personal data from children.

12. Changes to this policy

If this site changes in a way that affects the data it processes, this policy will be updated and the "last updated" date at the top will be changed accordingly.