Privacy Policy

1. Information We Collect

When you create an account, we collect your email address and password (securely hashed). Game scores and session data are stored locally on your device using localStorage. If you sign in, your sessions, game nights and custom games are also synced to your account. If you subscribe to our newsletter, we store your email address, chosen language, and an anonymized IP address for fraud prevention.

2. How We Use Your Data

• Account authentication and session management
• Storing and displaying your game scores and statistics
• Displaying your comments on blog posts (your display name and comment content are publicly visible)
• Providing admin functionality for authorized users
• Improving the service based on usage patterns
• Sending newsletter emails (only if you've subscribed and confirmed via double opt-in)

3. Data Storage

We use Supabase as our backend service, which stores data in secure PostgreSQL databases. Score tracker data is primarily stored in your browser's localStorage. Authentication tokens are managed through secure HTTP-only cookies.

4. Cookies

We use essential cookies for authentication and session management, plus localStorage for your theme preference, game data and your cookie choice. Beyond those, MeepleShelf loads two Google services site-wide: Google Analytics 4 (traffic measurement) and Google AdSense (ads). Google Analytics also counts score tracker games: which built-in game, how many players and which scoring mode. Player names, scores and the names of games you create are never sent. Both services run under Google Consent Mode v2 and stay denied until you accept them in the cookie banner — analytics_storage, ad_storage, ad_user_data and ad_personalization all default to "denied". If you reject, no analytics or advertising cookies are set and any ads you see are non-personalized. You can change your decision at any time with the "Cookie preferences" link in the site footer. Your choice is stored only in your own browser.

Client-Side Tools (No Server Round-Trip)

Several MeepleShelf tools run entirely in your browser and never transmit data to our servers: the Hidden Role Assigner (party-game role distribution), the Color Blindness Simulator (image filters via the canvas API), the Setup Helper (component checklists), the Backup & Restore page (local JSON export/import), the Power Ranking / ELO leaderboard (computed from your local game history), the Dice Probability and Deck Odds calculators, the Action Economy analyzer, and the Card Generator and Print Sheet PDF tools (CSV data and uploaded card images stay in your browser; PDFs are built locally via pdf-lib). Prototype mode metadata for your custom games (version, designer notes, PnP source URL) is stored on your device the same way regular custom games are. Roles, uploaded images, custom templates, prototype changelogs and ELO ratings stay on your device — they are never uploaded, logged or shared. The Playtest Feedback survey is the one designer feature that does send data to our servers (it's a public feedback inbox by design): we collect ratings, an open-text comment and an anonymous device tag plus a daily-rotated SHA-256 hash of the submitter's IP for spam protection. We never store the raw IP. The prototype owner is the only person who can read the responses; the survey link itself is public, so don't share private info there.

5. Third-Party Services

• Supabase — authentication and database hosting
• Google Analytics 4 & Google AdSense — traffic measurement and advertising, active only after you accept cookies
• YouTube — embedded videos in blog posts
• Resend — transactional and newsletter email delivery

6. Newsletter

Our newsletter uses double opt-in: after you submit your email, we send a confirmation link that you must click to activate the subscription. Every newsletter email contains a one-click unsubscribe link, and unsubscribing is processed immediately. We do not share your email address with any third party. You can also request deletion of your subscription record by contacting us.

7. Your Rights

You can delete your account and all associated data (profile, comments, avatar) at any time from your Profile page. Local game data can be cleared by clearing your browser storage. Newsletter subscriptions can be cancelled via the unsubscribe link in any newsletter email. For additional data deletion requests, contact us at the email below.

Campaigns created in the Campaign Tracker are cloud-synced to your account and are visible only to you; the Campaign Tracker has no sharing or invite feature. A campaign stores its name, scenario progress, spoiler setting and the characters you add to it. Deleting a campaign immediately removes its scenario progress and character sheets — there is no soft delete and no recovery. Score Tracker sessions linked to the campaign are kept but lose the link. If you delete your account, all your campaigns are deleted.

8. Contact

For privacy-related questions, reach out to us at privacy@meepleshelf.com.