Privacy Policy

Definitions and Key Terms

• Cookie: small amount of data generated by a website and saved by your web browser. It is used to identify your browser, provide analytics, remember information about you such as your language preference or login information.
• Company:when this policy mentions “Company,” “we,” “us,” or “our,” it refers to Fierce Consulting Inc. (Toronto, ON), that is responsible for your information under this Privacy Policy.
• Country: where Boardlytics or the owners/founders of Boardlytics are based, in this case is Canada.
• Device: any internet connected device such as a phone, tablet, computer or any other device that can be used to visit Boardlytics and use the services.
• IP address: Every device connected to the Internet is assigned a number known as an Internet protocol (IP) address. These numbers are usually assigned in geographic blocks. An IP address can often be used to identify the location from which a device is connecting to the Internet.
• Personal Data: any information that directly, indirectly, or in connection with other information — including a personal identification number — allows for the identification or identifiability of a natural person.
• Service: refers to the service provided by Boardlytics as described in the relative terms (if available) and on this platform.
• Website:Boardlytics's site, which can be accessed via this URL: boardlytics.app
• You: a person or entity that is registered with Boardlytics to use the Services.

What Information Do We Collect?

We collect information from you when you visit our website, register for an account, record a session, connect with friends, or purchase a Pro subscription.

• Name / Username
• Email Addresses
• Billing Addresses
• Password
• Session records (games played, scores, dates, participants, and any notes or tags you add)
• Friend connections you establish within the app
• Photos you upload to sessions
• Device and usage data collected automatically when you use the Service

We also collect information from mobile devices for a better user experience, although these features are completely optional:

• Camera (Pictures):Granting camera permission allows you to upload photos to your sessions directly from the app. Camera access is optional — you can also upload photos from your device's library. You may deny camera permission without affecting other features.

Photos and User Content

Photos you upload to Boardlytics are stored securely and are accessible only to:

• You (the uploader), at all times
• The session owner
• Other confirmed participants in the same session

Friends who were not participants in a session cannot access that session's photos. Photos are served via time-limited signed links and are not directly accessible by URL.

You can delete photos you uploaded from the session detail page at any time. If you close your account, all photos associated with your account will be removed from our servers within 30 days.

Session Data and Visibility

When you record a session, you control who can see it:

• Private: visible only to you and participants in that session.
• Friends: visible to you, session participants, and your confirmed friends on Boardlytics.

Regardless of session visibility, photos are always restricted to session participants only.

AI Features and Third-Party Processing

Boardlytics offers AI-powered features including session recaps, achievement generation, and victory trophies. To generate this content, limited session data — such as participant names, scores, game name, and session notes you have written — may be transmitted to Google LLC via the Gemini API.

We do not transmit your email address, billing information, or account credentials to AI providers. AI-generated content is stored on our servers and subject to the same visibility rules as the rest of your session data. No AI processing occurs automatically — it is always triggered by an explicit action you take in the app.

Guest Players

Boardlytics allows registered users to add non-registered participants (“Guest Players”) to their sessions by name. Guest player names and game history within those sessions are stored on our servers as part of the session record.

If you have been added as a guest player and would like your name or participation records removed, please contact us at boardlytics@fierceconsultinginc.com. We will process your request and remove your records within 30 days.

When Does Boardlytics Use End User Information From Third Parties?

Boardlytics will collect End User Data necessary to provide the Boardlytics services to our customers. End users may voluntarily provide us with information they have made available on social media websites. If you provide us with any such information, we may collect publicly available information from the social media websites you have indicated.

Do We Share the Information We Collect With Third Parties?

We do not sell your personal information. We share data only with the service providers necessary to operate Boardlytics:

• Supabase Inc. — database, authentication, and file storage
• Vercel Inc. — website hosting and delivery
• Stripe Inc. — payment processing (we do not store your card details)
• Google LLC (Gemini API) — AI-powered session recaps, achievements, and trophies (limited session data only; see AI Features section above)
• Sentry (Functional Software, Inc.) — error monitoring and diagnostics

These providers are bound by their own privacy policies and data processing agreements. We do not share your data with advertisers or sell it to any third party for marketing purposes.

If we are involved in a merger, acquisition, or asset sale, your information may be transferred to the successor entity, subject to the same privacy commitments described here. We may also disclose information to government or law enforcement authorities where legally required, or to protect the safety of users or the public.

How Do We Use the Information We Collect?

• To personalize your experience (your information helps us to better respond to your individual needs)
• To improve our website (we continually strive to improve our website offerings based on the information and feedback we receive from you)
• To improve customer service (your information helps us to more effectively respond to your customer service requests and support needs)
• To process transactions
• To send periodic emails

How Do We Use Your Email Address?

We use your email address for the following purposes:

• Account emails: verification, password reset, and friend invitations — sent via Supabase authentication infrastructure.
• Weekly digest: a summary of your recent gaming activity. You can opt out at any time from Settings → Account.
• Billing notifications: subscription receipts and payment confirmations, sent by Stripe on our behalf.

We do not send unsolicited marketing emails. To stop receiving digest emails, turn off the digest in Settings → Account.

How Long Do We Keep Your Information?

We retain your personal information for as long as your account is active. When you close your account:

• Session records, AI-generated content, and friend connections are deleted within 30 days.
• Photos are deleted within 30 days (see Photos and User Content above).
• Billing and transaction records are retained for 7 years as required by applicable tax law.

Anonymized, non-identifiable aggregate data (such as aggregate game popularity statistics) may be retained indefinitely for product analytics. When we no longer need to use your information for the purposes described in this policy, we will remove it from our systems or depersonalize it so that we can't identify you.

How Do We Protect Your Information?

We implement a variety of security measures to maintain the safety of your personal information when you place an order or enter, submit, or access your personal information. We offer the use of a secure server. All supplied sensitive/credit information is transmitted via Secure Socket Layer (SSL) technology and then encrypted into our Payment gateway providers database only to be accessible by those authorized with special access rights to such systems. After a transaction, your private information (credit cards, financials, etc.) is never kept on file.

In the event of a data breach that poses a real risk of significant harm to users, we will notify affected individuals and, where required, the relevant supervisory authority — including the Office of the Privacy Commissioner of Canada under PIPEDA — as promptly as practicable and in accordance with applicable law.

Could My Information Be Transferred to Other Countries?

Boardlytics is incorporated in Canada. Information collected via our website, through direct interactions with you, or from use of our help services may be transferred from time to time to our offices or personnel, or to third parties, located throughout the world, and may be viewed and hosted anywhere in the world, including countries that may not have laws of general applicability regulating the use and transfer of such data. To the fullest extent allowed by applicable law, by using any of the above, you voluntarily consent to the trans-border transfer and hosting of such information.

Can I Update or Correct My Information?

You can update your display name, avatar, and profile preferences directly from Settings. To permanently delete your account and all associated data — including sessions, photos, and AI-generated content — go to Settings → Account → Delete Account. Deletion is immediate and irreversible.

To request access to, correction of, or deletion of your data by email, contact us at boardlytics@fierceconsultinginc.com. We will respond within 30 days.

Sale of Business

We reserve the right to transfer information to a third party in the event of a sale, merger or other transfer of all or substantially all of the assets of Boardlytics, or in the event that we discontinue our business or file a petition or have filed against us a petition in bankruptcy, reorganization or similar proceeding, provided that the third party agrees to adhere to the terms of this Privacy Policy.

Governing Law

This Privacy Policy is governed by the laws of Canada without regard to its conflict of laws provision. You consent to the exclusive jurisdiction of the courts in connection with any action or dispute arising between the parties under or in connection with this Privacy Policy. The laws of Canada, excluding its conflicts of law rules, shall govern this Agreement and your use of the website.

Cookies and Local Storage

Boardlytics uses only strictly necessary cookies to maintain your authenticated session. These cookies are set by Supabase and are required for login to work — disabling them will prevent you from accessing the app. We do not use advertising, analytics, or tracking cookies. No cookie consent banner is required because no non-essential cookies are set.

The app also uses your browser's local storage for two functional purposes: remembering whether you have dismissed the app install prompt, and preserving a draft session indicator between page loads. Neither use stores personally identifiable information.

Kids' Privacy

We do not knowingly collect information from children under the age of 13. If you are a parent or guardian and you are aware that your child has provided us with Personal Data without your permission, please contact us. If we become aware that we have collected Personal Data from anyone under the age of 13 without verification of parental consent, we take steps to remove that information from our servers.

Changes To Our Privacy Policy

We may change our Service and policies, and we may need to make changes to this Privacy Policy so that they accurately reflect our Service and policies. Unless otherwise required by law, we will notify you (for example, through our Service) before we make changes to this Privacy Policy and give you an opportunity to review them before they go into effect.

Information About GDPR

We may be collecting and using information from you if you are from the European Economic Area (EEA). People covered by the GDPR have the right to access their own personal data. They can also request a copy of their data, and that their data be updated, deleted, restricted, or moved to another organization. They have the right to receive their personal data in a portable, machine-readable format (data portability). To exercise any of these rights, contact us at boardlytics@fierceconsultinginc.com.

Under GDPR, we are required to identify a lawful basis for each category of personal data we process:

• Contract performance (Article 6(1)(b)): account information, session records, scores, game history, friend connections, and photos — processed to deliver the Boardlytics service you signed up for.
• Legitimate interest (Article 6(1)(f)): error monitoring data collected by Sentry to maintain a functioning and secure service. Our legitimate interest is operating a reliable product; this does not override your rights.
• Legal obligation (Article 6(1)(c)): billing and transaction records retained for 7 years as required by applicable tax law.
• Consent (Article 6(1)(a)): AI-generated content (session recaps, trophies, achievements) — you trigger these explicitly and no AI processing occurs automatically; weekly digest emails — you may withdraw consent at any time via Settings → Account.

Personal data collected must be processed in a fair, legal, and transparent way and should only be used in a way that a person would reasonably expect. Personal data should be held no longer than necessary to fulfil its purpose.

Canadian Residents (PIPEDA)

Boardlytics is incorporated in Ontario, Canada and is subject to the Personal Information Protection and Electronic Documents Act (PIPEDA). Under PIPEDA, you have the right to:

• Know what personal information we hold about you and how it is used.
• Request access to your personal information and correct any inaccuracies.
• Withdraw consent for the collection, use, or disclosure of your personal information, subject to legal or contractual restrictions.
• File a complaint with the Office of the Privacy Commissioner of Canada if you believe your privacy rights have been violated.

Our designated privacy officer oversees compliance with this policy and PIPEDA. You can reach our privacy officer at boardlytics@fierceconsultinginc.com.

We will respond to access or correction requests within 30 days. Where we are unable to fulfil a request, we will explain why in writing.

California Residents (CCPA / CalOPPA)

You may exercise the following rights:

• Right to Know and Access. You may submit a verifiable request for information regarding the categories of Personal Information we collect, use, or share.
• Right to Equal Service. We will not discriminate against you if you exercise your privacy rights.
• Right to Delete. You may submit a verifiable request to close your account and we will delete Personal Information about you that we have collected.

We do not sell the Personal Information of our users. If you make a request, we have one month to respond to you.

Contact Us

Don't hesitate to contact us if you have any questions. boardlytics@fierceconsultinginc.com