Privacy Policy
Last updated 8 September 2026.
Before you rely on this: this document was drafted from the application's actual database schema and code, so it describes what the system really does. It has not been reviewed by a lawyer. Have a solicitor check it against your jurisdiction before you launch publicly, and fill in the operator name and contact address marked below.
1. Who we are
[OPERATOR LEGAL NAME AND ADDRESS — fill this in] operates PlayForgeBDE, a tool for designing, playtesting and publishing tabletop games. For data-protection purposes we are the data controller for the information described below. You can reach us at [CONTACT EMAIL — fill this in].
2. What we store, and why
| What | Why | Kept |
|---|---|---|
| Your email address and password | To create your account and sign you in. Passwords are hashed by our authentication provider; we never see or store the password itself. | Until you delete your account |
| Your public handle and display name | So other designers can see who published a game or left a review. | Until you delete your account |
| Your projects — names, game rules, components, board layouts, concepts and rulebooks | This is the work you came here to do. We store it so it is there on your next visit and on your other devices. | Until you permanently delete it |
| Saved versions of your projects | So you can look back at, and restore, earlier states of your game. | Until you permanently delete the project |
| Images and files you upload | To show your artwork in your game. Draft artwork is private and served only through short-lived signed links. | Until you delete the asset or the project |
| Playtest sessions and the actions taken in them | To run a game, replay it, and show you the results. | Until you delete the project |
| Reviews, comments and follows you post | To show them on the game they belong to. | Until you delete them or your account |
| Your subscription plan and a payment-provider customer ID | To give you the plan you paid for. We never see or store your card details. | As long as required for accounting |
| A record of each AI request: which operation, which model, token counts and an estimated cost | To meter your monthly AI credits fairly and to detect abuse. The content of the request is not stored in this record. | Rolling — used for the current month's allowance |
| Error reports when a page breaks: the error message, the page path, and your browser version | So we can find and fix crashes. These carry no account identifier, no session token, and no part of your game. | In server logs only |
What we do not do
- We do not sell your personal information, and we do not share it with advertisers.
- We do not use advertising or analytics trackers, and we set no third-party cookies.
- We do not use your game designs to train AI models.
- We do not read your private projects. They are protected at the database level so that only your account — and anyone you explicitly publish or share with — can access them.
3. Who processes it for us
We use a small number of service providers, each for one job:
- Supabase — hosts our database, file storage and sign-in. Your account and your projects live here.
- Stripe — handles payments. Card details go directly to Stripe and never reach our servers. We store only the customer and subscription identifiers Stripe gives us.
- Anthropic — provides the AI assistant. When you ask the assistant something, the relevant part of your game and your question are sent to Anthropic to produce a reply. Do not paste anything into the assistant that you would not want processed by a third party.
Depending on where these providers operate, your information may be processed outside your country. Each provider publishes its own security and transfer commitments.
4. Your rights
You can, at any time:
- Get a copy of your work. Settings → Export backup gives you a complete file of your projects.
- Correct anything wrong in your profile or your projects, directly in the app.
- Delete a project. Deleting moves it to Trash, where it stays until you remove it permanently — we do not delete it on a timer.
- Delete your account by writing to us at the address above. This removes your projects, versions, uploaded files, reviews and comments. Published games are withdrawn.
- Object, restrict or complain. If you are in the UK or EU you may complain to your local data-protection authority.
We will respond to a request within 30 days.
5. Security
Every project, version and uploaded file is scoped to its owner by row-level security in the database itself, so the check does not depend on the page you are looking at. Private artwork is stored in a non-public bucket and served only through links that expire within minutes. Payment card details never touch our servers. We use TLS for all traffic.
No system is perfect. If you find a security problem, please tell us at the address above before disclosing it publicly, and we will work with you.
6. Cookies and local storage
We store your sign-in session in your browser so you stay signed in, and we keep a copy of your projects in your browser so the editor is fast and keeps working if your connection drops. That copy is scoped to your account and is cleared when you sign out on that device. We do not use cookies for advertising or tracking.
7. Children
PlayForgeBDE is not intended for children under 13 (or the minimum age in your country, if higher). We do not knowingly collect information from them.
8. Changes
If we change this policy in a way that materially affects you, we will tell you in the app before it takes effect.