Privacy Policy

Effective date: August 31, 2026

1. What Data We Collect

Board Duel is a board game battle site that follows a privacy-first principle, collecting as little data as possible:

• Game Stats: When you participate in game matches, we record match type, win/loss, duration, and win streaks for leaderboard and stats.
• Account Identifier: Locally generated anonymous UUID stored in Cookie (pid) to identify the same user on the leaderboard.
• Anonymous Statistics: May use privacy-friendly analytics tools (like Plausible) to collect aggregate traffic without personal identity information.

2. Data We Do Not Collect

• We do not collect personal identity information such as name, email, phone number (unless you proactively contact us via email).
• We do not read contacts or address books.
• We do not use third-party ads or behavioral tracking.

3. Cookie Usage

We only use one Cookie (pid) to store anonymous account identifiers for leaderboard identity. You can clear browser cookies anytime; after clearing, leaderboard identity will reset to a new account.

4. Data Storage and Retention

Game stats and account data are stored in Cloudflare's edge storage (KV/D1) to provide leaderboard and stats features. Aggregated leaderboard data is regularly cleaned.

5. Data Disclosure

We will not sell, rent, or provide your data to any third party, except as required by law.

6. Children's Privacy

This site is for all ages. Since we do not collect personal identity information, it does not involve collection of children's personal data.

6a. COPPA 2025 Update (US users)

Effective September 30, 2026. This section supplements the policy above to satisfy the U.S. Children's Online Privacy Protection Act (COPPA) Final Amendments published 2025-01-16, with compliance deadline 2026-04-22.

• Persistent identifier disclosure — when cloud ELO sync is enabled, the browser auto-generates a UUID via crypto.randomUUID(). This UUID is stored in Cloudflare KV with a 90-day TTL and is used solely for cross-lesson ELO tracking. No IP address, device fingerprint, or Advertising ID is collected.
• Categories of third parties — Cloudflare, Inc. (Workers Paid, KV, D1, R2, Durable Objects); GitHub, Inc. (source code); Agent Mail (智邮) for the contact email alias. No advertising networks, data brokers, social platforms, or analytics beyond Cloudflare Workers Logs.
• Purpose limitation — UUID and game data are used solely for: (1) cross-lesson ELO tracking, (2) anti-cheat, (3) engine improvement, (4) session replay. Never for behavioral profiling, advertising, re-marketing, or cross-site identification.
• Biometric identifiers — we do not collect facial recognition, voiceprints, fingerprints, retina scans, or any biometric data. The 2025 amendment's expanded definition does not apply to our service.
• DSAR contact — [email protected] (also the COPPA § 312.6 designated contact). Requests are processed within 48 hours.

Full written policies: Written Data Retention Policy · Written Information Security Program

6b. 中文摘要 (COPPA 2025 补充)

我们遵守美国《儿童在线隐私保护法》（COPPA）2025 年 1 月 16 日最终修正案（含 2026-04-22 合规截止日）。由于我们不收集儿童个人身份信息（仅收集浏览器自动生成的匿名 UUID 与游戏结果数据），COPPA 大部分要求不适用。例外要求（书面留存政策、书面信息安全计划、持久标识符披露）已通过本文档及上方链接的 compliance/ 文档满足。如需删除数据或行使权利，请联系 [email protected]。

7. Policy Changes

We may update this policy from time to time. Significant changes will be prominently announced. Continuing to use means you agree to the updated policy.

8. Contact Us

To delete data or inquire about privacy matters, contact [email protected].