Privacy Policy

Last updated: 2 October 2026

1. Who we are

Tablist ("we", "us", or "the Service") is operated by Diogo Mendinhas Carlos, based in Portugal. You can reach us about privacy matters at digasmc@gmail.com. The Service is available at https://tablist.app.

For the purposes of the EU General Data Protection Regulation (GDPR), Diogo Mendinhas Carlos is the data controller of personal data processed through Tablist.

2. What this policy covers

This Privacy Policy explains what personal data we collect when you use Tablist, why we collect it, how we share it with service providers, and the rights you have. Tablist helps you manage a board game collection, track game-night sessions and scores, connect with friends, and optionally share a public profile.

3. Data we collect

Depending on how you use Tablist, we may process:

Account data: email address; password (stored as a hash by our auth provider, never in plain text by us); Google account identifiers and basic profile fields if you sign in with Google.
Profile data: display name, username, avatar URL (often from Google), optional BoardGameGeek username, and whether your profile is marked public.
Collection and preferences: games you add or import, notes, wishlist flags, and saved filter presets.
Sessions and scores: session titles, dates, locations, notes, scoring mode, players (linked accounts or guest display names), teams, and scores.
Social graph: friend requests and friendships between accounts.
On-device data: when you use Tablist as an installable app or offline, copies of your collection and sessions may be stored in IndexedDB on your device, along with a service worker cache of app assets and BoardGameGeek images.
Technical cookies: essential session cookies used to keep you signed in. We do not use advertising cookies.

We also cache BoardGameGeek game metadata (titles, descriptions, images, ratings, and related community file metadata) in our database so the Service can work reliably. That cache is shared across users and is not treated as your personal profile data.

4. How we obtain data

Directly from you when you register, edit your profile, or log sessions.
From Google when you choose Google Sign-In (subject to Google's policies and the permissions you grant).
From the BoardGameGeek APIs when you search, view games, or import a public BGG collection using a BGG username you provide.
Automatically as essential cookies and on-device offline storage when you use the Service.

5. Why we process data (legal bases)

We process personal data to:

Provide and operate the Service (performance of a contract): authentication, collections, sessions, friends, and sync.
Secure the Service and prevent abuse (legitimate interests).
Comply with legal obligations when they apply.

Where we rely on consent (for example, making a profile public), you can withdraw it in your profile settings.

6. Visibility and sharing with other users

Signed-in users may see basic profile identity (username, display name, avatar) for discoverability (for example, adding friends or players).
If you turn on a public profile, other signed-in users can also see your collection and play statistics on your profile page.
Friend search may match against username, display name, or email address on our servers. Search results do not return email addresses.
Session hosts and participants linked to a session can see that session's roster and scores. Guest players are stored as display names you enter.

We do not sell your personal data. We do not show ads and we do not process payments.

7. Service providers (processors)

We use trusted providers to run Tablist:

Supabase — authentication and database hosting.
Vercel — application hosting and delivery.
Google — optional OAuth sign-in and (when provided) avatar hosting.
BoardGameGeek — game metadata and related CDN images/files you choose to access through the Service.

These providers process data on our instructions and under their own privacy terms. We do not currently use third-party advertising or product-analytics SDKs.

8. Cookies and similar technologies

Tablist uses essential cookies (and similar browser storage) to maintain your authenticated session. Offline and PWA features may store data locally on your device. You can clear site data in your browser or uninstall the app to remove local caches; that does not by itself delete your server-side account.

9. Retention

We keep your account and related data while your account remains open. If you delete your account, we remove your authentication record and associated profile data from our database, subject to technical cascade rules (for example, sessions you hosted are removed; your player link on someone else's session may be unlinked while a guest display name you left may remain). Shared BoardGameGeek game cache entries are retained for the Service.

Backups and logs held by our providers may persist for a limited period before automatic expiry.

10. Your rights

If you are in the European Economic Area (including Portugal), you may have the right to access, rectify, erase, restrict, or object to certain processing, and to data portability, subject to legal limits. You can update much of your profile in the app, and you can delete your account from Profile settings.

To exercise rights or ask questions, email digasmc@gmail.com. You may also lodge a complaint with the Portuguese data protection authority (CNPD) or another competent supervisory authority.

11. Children

Tablist is not directed at children under 13. If you believe a child under 13 has created an account, contact us and we will delete it.

12. International transfers

Our providers may process data in the EU and other countries. Where transfers outside the EEA occur, they rely on appropriate safeguards offered by those providers (such as Standard Contractual Clauses), where required.

13. Changes

We may update this policy from time to time. We will revise the "Last updated" date above. Continued use of Tablist after changes means you accept the updated policy. Material changes may also be highlighted in the Service when practical.