Who is responsible
TryBoardGames runs TryBoardGames and is responsible for the personal data described here.
Questions about this policy, and requests about your data, go to:
hello@
Playing without an account
Every solo game can be played without an account, and nothing about you is written to the site's database while you do.
Your browser keeps your settings on your own device: the table colour, sound, card pack, each game's options, your best scores in Bingo and Flags, the money in a Klondike Vegas game, and the last few games you opened. They are never sent to the server, and clearing the site's data in your browser removes them. While you play Bingo at an online table, it also keeps the numbers you marked until you close the tab. The browser also keeps a copy of the offline page, so the site can say so when you have no connection.
When you log in, register or ask for a password reset, the server counts attempts from your IP address for a few minutes, in memory only, to slow down password guessing and abuse. The count is never stored.
With an account
You do not have to give the site any personal data to play. To create an account you must give a username, an email address and a password. Without them the site cannot create one, and every solo game still works without it.
When you register, the site keeps your username, your email address and your password. The password is stored only as a one-way hash, which cannot be turned back into the password.
It also keeps the date and time the account was made.
It keeps a record of the boards you play once one has been open for 20 seconds: which game and variant, when you started and finished, whether you won, and for a win the number of moves and the time taken. Your totals, your streak and your achievements are worked out from that record.
If you turn on two-factor authentication, the key for your authenticator app and your recovery codes are kept with your account.
Your email address is used to sign you in, if you type it instead of your username, and to send a password reset link when you ask for one. The link works for one hour. The site sends no newsletters and no other mail.
Your username is public. It appears on the leaderboards beside your wins unless you turn that off in your account settings, and other players see it at online tables.
An administrator can take a win that was not really played off your record and the leaderboards, keep an account off the leaderboards, or lock it.
Online tables
At an online table the other players see your username and your avatar's initial and colour, never your email address. There is no chat: emotes are a fixed set of eight, so nothing you type reaches another player.
While a game is being played, the table is kept on the server so it survives a restart. It is removed when the game ends, and a table left unfinished is closed after a day without play.
When a game ends, its result is kept with who sat in each seat, because it is part of every player's record.
Cookies
The site sets these cookies without asking, because it cannot work without them:
- A sign-in cookie that keeps you logged in. It ends when you close the browser, or, if you tick Keep me signed in, after 14 days without a visit.
- While you log in with two-factor authentication, a short-lived cookie remembers that your password was accepted. If you choose to trust a device, a cookie on it skips the code there for 30 days.
- A security cookie that stops other sites from sending forms in your name, and one that carries a message from one page to the next, such as a note that a change was saved.
Google Analytics sets two more cookies, _ga and one starting with _ga_, but only after you choose Accept on the cookie banner. They tell one visit from the next so the site can count visitors and see which games are played, and they last 13 months. Your answer is kept for six months in one more cookie, cc_cookie, then the banner asks again. Cookie settings at the bottom of every page changes it, and choosing Reject there removes the cookies.
There are no advertising cookies.
Who else handles it
Cloudflare carries every request to the site, to deliver it quickly and protect it from attacks, so it sees your IP address and the pages you ask for. Cloudflare is a US company and may handle requests outside the EU, under the standard contractual clauses in its data processing terms.
Password reset emails are sent through Resend, Inc. in the United States, which receives your email address and the message. Resend is certified under the EU-US Data Privacy Framework. The server the site runs on holds the database.
The forms for creating an account, logging in, resetting a password and entering a two-factor code show a Cloudflare Turnstile check, to keep out automated sign-ups and password guessing. Turnstile reads technical details from your browser, such as its user agent, and the site sends Cloudflare your IP address with each check. Cloudflare also uses these details to improve its bot detection, for which it is responsible itself. The check rests on the site's legitimate interest in protecting accounts (Article 6(1)(f) GDPR).
If you accept analytics, Google receives the address of each page you open, without the part after any question mark, the identifier in its cookies, and your IP address, which it uses to work out your country, region and city and does not store. Google deletes the visit data linked to your browser after two months, and after that keeps only totals that identify no one. It may handle the data in the US, under the EU-US Data Privacy Framework.
Nothing is sold, and nothing is shared for advertising.
Why the data is used
Keeping your account and your game record, and sending a password reset link, are needed to provide the service you signed up for (Article 6(1)(b) GDPR).
Google Analytics runs only with your consent (Article 6(1)(a) GDPR), which you can withdraw at any time from Cookie settings.
Counting attempts to slow down password guessing, checking your sign-in, and routing requests through Cloudflare protect the site and the people who play on it, which is a legitimate interest (Article 6(1)(f) GDPR). Showing your username on the leaderboards rests on the same ground, and you can object at any time by turning it off.
How long it is kept
Your account and your record are kept until you delete the account. Deleting it removes your username, email address, password, record, streak and achievements straight away.
The results of online games you played stay in the other players' records, no longer linked to a name. A password reset link stops working after an hour, and attempt counts are forgotten within minutes.
Your rights
Under the GDPR you can ask to see, correct, download or delete the personal data kept about you, to limit how it is used, and to object to its use. Most of it you can do yourself:
- Download your data
- Change your username or email
- Hide your name from the leaderboards
- Delete your account
For anything else, write to the address above. If you think your data has been handled wrongly, you can complain to the data protection authority in the EU country where you live or work.
The site makes no decisions about you by automated means that have legal or similarly significant effects.
Changes to this policy
When this policy changes, the date at the top of the page changes with it.