Privacy Policy

Tabled is a board game night companion app operated by an individual developer based in Singapore (we, us, our). This policy covers the Tabled website and the Tabled mobile app.

We are the organisation responsible for your personal data under Singapore’s Personal Data Protection Act 2012 (the PDPA), and act as the data controller for users in the United Kingdom and the European Economic Area.

For anything in this policy — access requests, corrections, complaints or questions — email moosedevapps@gmail.com.

Account information

What we hold depends on how you sign in:

• Sign in with Google — your Google account identifier, name, email address and profile picture URL.
• Sign in with Apple — your Apple user identifier, name and email address, or Apple’s private relay address if you choose to hide your email.
• Email and password — your email address, and your password stored only as a bcrypt hash. We never store your password in a readable form and cannot recover it.

Profile information

Your display name, avatar and an optional bio. You can change or clear these at any time.

Things you create in Tabled

• Your game shelf, wishlist and play history.
• Events you host or join — title, description, date and time, and any location you enter.
• Invitations, game proposals and the votes you cast.
• Messages you send in event chats.
• Scores, rankings and results you record.
• Game ratings from 1 to 10, and any notes you add to them.
• Availability entries — dates, time windows and optional notes.
• Friend requests and connections.
• Names of guests added to an event by a host.

Rulebooks you upload

The PDF file itself, its filename, the text extracted from it, and numerical representations of that text (embeddings) used to search it. These are stored with our backend provider, Convex.

Push notification tokens

If you use the mobile app and allow notifications, we store a device push token so we can deliver notifications through Apple’s and Google’s push services.

Usage and analytics

We use PostHog to understand how Tabled is used. This includes pages viewed, features used, in-app events such as a successful or failed sign-in, your device and browser type, approximate location derived from your IP address, and a persistent analytics identifier. Once you sign in, we associate this activity with your user ID, name and email address.

Technical data

Our servers and infrastructure providers record IP addresses, device and browser information, request paths and timestamps in ordinary access and error logs.

Cookies and local storage

• Essential — a session cookie set by our authentication system to keep you signed in.
• Analytics — PostHog cookies and local storage entries used to recognise a returning browser.
• Functional — local storage and a service worker cache so the app loads quickly and works offline.

We do not use advertising cookies or third-party ad trackers.

Information about other people

• To run the service — accounts, events, invitations, voting, scores and chat.
• To show your profile, shelf and activity to the people you have chosen to share them with.
• To send notifications you have asked for.
• To answer your questions through the AI Rules Assistant.
• To keep Tabled secure — preventing abuse, investigating problems and fixing bugs.
• To understand which features are used, so we can improve them.
• To meet our legal obligations and enforce our Terms of Service.

We do not use your personal data for advertising or for marketing profiling, and we do not sell it.

Under the PDPA we rely on your consent, given when you create an account and use the features described above, together with the exceptions the PDPA allows for purposes such as security and fraud prevention.

If you are in the United Kingdom or the EEA, we rely on:

• Performance of a contract — operating your account and the features you use.
• Legitimate interests — security, abuse prevention, debugging, and improving the product.
• Consent — push notifications, optional profile details, and analytics where consent is required.
• Legal obligation — where the law requires us to keep or disclose data.

You can withdraw consent at any time. Some withdrawals will mean parts of Tabled stop working for you.

We do not sell your personal data. We share it with the service providers that make Tabled work, each of which processes it only on our instructions:

• Convex

  Application database, file storage and backend functions.

  Your account, profile and everything you create in Tabled, including uploaded rulebooks. Stored in the United States.

• Our hosting and content delivery provider

  Serves the Tabled web app and mobile web view.

  IP address, request and error logs, device and browser information.

• Google (Sign in with Google)

  Authentication, if you choose to sign in with Google.

  Your Google account identifier, name, email address and profile picture URL.

• Apple (Sign in with Apple)

  Authentication, if you choose to sign in with Apple.

  Your Apple user identifier, name and email address, or Apple’s private relay address if you choose to hide your email.

• PostHog

  Product analytics — understanding which features are used and where things break.

  Pages viewed, in-app events, device and browser information, IP address, and once you sign in, your user ID, name and email. Stored in the United States.

• AI service provider

  Powers the AI Rules Assistant and builds the search index over uploaded rulebooks. We use an established provider such as OpenAI, Anthropic or Google, and may change provider over time.

  The question you ask, the relevant rulebook excerpts and the game it relates to. Not linked to your name or email.

• Expo, Apple Push Notification service and Firebase Cloud Messaging

  Delivering push notifications to the mobile app.

  Your device push token and the contents of the notification.

• BoardGameGeek

  Source of the game catalogue — titles, images, ratings and rankings.

  We request game data from them. We do not send them your personal data.

We may also disclose personal data where we are legally required to, where it is necessary to investigate a breach of our Terms or protect someone’s safety, or if Tabled is transferred to another operator — in which case we will notify you beforehand.

Some information is shared with other people by design. Specifically:

• Your display name, avatar, bio, shelf, wishlist and play history are visible to other Tabled users who can view your profile.
• Within an event, the host and members can see the event details, the member list, game proposals, votes, chat messages and recorded scores. Public events are visible to other users.
• Availability entries have their own visibility setting — public, friends only, or specific people you choose.
• Chat messages, scores and ratings stay visible to the other participants of that event as part of its record, including after you leave.

Please check the visibility setting on an event or availability entry before adding anything you would rather keep private. Once something has been shared with others, we cannot recall it from them.

Tabled is operated from Singapore, but our providers store and process data in other countries, principally the United States.

When we transfer personal data out of Singapore, we take reasonable steps to satisfy ourselves that the recipient is bound to provide a standard of protection comparable to the PDPA, normally through the contractual commitments in that provider’s data processing terms. For users in the United Kingdom and the EEA, transfers rely on Standard Contractual Clauses or an adequacy decision where one applies.

• Account and profile data — for as long as your account exists.
• Content you create — for as long as your account exists, or until you delete it. Chat messages and scores within a shared event may remain part of that event’s record for the other participants.
• Analytics data — in line with our PostHog retention settings, and no longer than we need it to understand product usage.
• Uploaded rulebooks — for as long as the rulebook is available in Tabled. An approved rulebook forms part of the shared game library and may be kept after you delete your account, though it will no longer be associated with your name.
• Logs and backups — typically deleted or overwritten within 30 to 90 days.

When you ask us to delete your account, we delete or anonymise your personal data within 30 days, except where we are required to keep something for legal reasons.

• Passwords are hashed with bcrypt and never stored in a readable form.
• Traffic between your device and our servers is encrypted with HTTPS.
• Data at rest is encrypted by our infrastructure providers.
• Access to production data is limited to the operator of the service.

No online service can be completely secure. Tabled is a small, independently operated app — please use a unique password, and do not store sensitive information in it. If we become aware of a data breach that is likely to result in significant harm, we will notify you and the Personal Data Protection Commission as required by law.

Wherever you live, you can ask us to:

• Access — give you a copy of the personal data we hold about you, and tell you how it has been used or disclosed in the past year.
• Correct — fix anything inaccurate. Most profile fields you can edit yourself in the app.
• Delete — close your account and remove your personal data.
• Withdraw consent — turn off notifications, opt out of analytics, or stop using the service.

If you are in the United Kingdom or the EEA, you also have the right to object to or restrict certain processing, and the right to receive your data in a portable, machine-readable format.

To exercise any of these, email moosedevapps@gmail.com from the address on your account. We will respond within 30 days. We will not charge you or treat you differently for making a request.

Opting out of analytics

Enable “Do Not Track” or Global Privacy Control in your browser, or email us and we will exclude your account from product analytics.

Push notifications

You can turn these off at any time in your device settings.

Complaints

Please raise concerns with us first — we would rather fix it. If you are not satisfied, you can complain to Singapore’s Personal Data Protection Commission at pdpc.gov.sg, or to the data protection authority in your own country.

Tabled is not intended for children under 13, and we do not knowingly collect personal data from them. If you believe a child under 13 has created an account, email moosedevapps@gmail.com and we will delete it. If you are between 13 and the age of digital consent in your country, you should have permission from a parent or guardian before using Tabled.

Game information, images and links come from BoardGameGeek, which operates under its own privacy policy. The same applies to any other site you reach from a link in Tabled. We are not responsible for the privacy practices of sites we do not operate.

We will update this policy as Tabled changes. The effective date at the top shows when it was last updated. If a change materially affects how we handle your personal data, we will give you notice in the app or by email before it takes effect. Continuing to use Tabled after that means you accept the updated policy.

Questions, requests or complaints about this policy or your personal data: moosedevapps@gmail.com.