Privacy policy

Who is responsible

WolfLab BV, Onze-Lieve-Vrouwestraat 91 bus 1, 2800 Mechelen, Belgium, company and VAT number BE 1029.309.461 runs AlphaMeeple Zero and is responsible for your personal data. Questions and requests go to wolf@wolflab.be.

What is stored

The service keeps:

• your email address, and your name and picture if you sign in with Google;
• your display name, and your name on the old server if you linked it;
• your profile: the picture you upload and the country you choose, both shown to other players;
• when you were last on the site, which only your friends see;
• your friends, the friend requests you send and receive, and the players you block;
• the communities you belong to or run, and your requests and invitations to them;
• the tournaments you organise or play in, your registrations and invitations, and your results;
• your games, move by move, with when each move was played and how long it took;
• the analyses you ask for and the positions you look up on the analysis board;
• during your ranked and tournament games, what other software, such as a browser extension, adds to the game page: the kind of element and the text it shows;
• the names you use on Board Game Arena, and the games you upload from there, which include the names of both players;
• your chat messages, including your private messages to friends;
• the reports you make about other players, and reports made about you;
• the feedback you send, with the page you sent it from, and, if you agree to be contacted on WhatsApp about it, your phone number, which is only used for that;
• your settings;
• which pages and features of the site you use, counted per day;
• if you buy a plan: which plan, how it renews and its state, and your customer number at Stripe;
• for each sign-in session, the IP address and the browser it came from;
• the server logs, with the IP address and the page asked for.

Why

It uses them:

• to give you an account and sign you in;
• to run your games and analyses, and show games and rankings on the site;
• to let other sites we give access to the API, such as a club's website, show the leaderboard, ratings, tournaments and live games;
• to keep the service fair and safe, for example to find cheating, abuse or misuse;
• to see which parts of the site are used, so we know what to improve;
• to improve the AI and to do research on it. Games may be used in published research, under a pseudonym unless you ask to be named.

The legal grounds are the contract with you (the terms of service) and, for fairness, safety, research and the API, a legitimate interest.

Who else handles it

A few companies process data on our behalf, only for these purposes:

• Google, if you sign in with Google;
• Resend, which sends the sign-in emails;
• Google Cloud, which hosts the site and its database in the EU (Belgium, europe-west1).

If you buy a plan, Stripe sells it to you as Link, its merchant of record: your name, email address, billing address and payment details go to Stripe, under Stripe's and Link's own privacy policies. We never see your card.

Google, Resend and Stripe are companies from the United States, so your email address, and your Google account details if you sign in with Google, can go there. Such transfers are covered by the safeguards the GDPR requires: the EU-US Data Privacy Framework or the European Commission's standard contractual clauses.

Sites we give an API key can read the leaderboard, player ratings, tournaments and live games, with the display names and countries in them. They get nothing else: no email addresses, messages, analyses or when you were last on the site.

Your data is never sold, and is not used for advertising.

Private messages

Private messages are seen by you and the friend you write to. An admin sees one only when it is reported, and then only that message.

Cookies

The site uses cookies only to keep you signed in. A few settings, such as the board view, are kept in your browser. There are no analytics or advertising cookies.

How long

Your data is kept as long as you have an account. To delete your account, email us (see below); your personal data is then removed. Games you played against other people may stay in their history without your name, and games already used in published research stay in it, under a pseudonym.

Server logs are deleted after about a month. Payment records are kept as long as Belgian accounting law requires.

Your rights

Under the GDPR you can ask to see your data, get a copy of it (export), correct it, delete it, limit its use, or object to its use.

To do any of this, email wolf@wolflab.be from the address of your account. We answer within a month.

You can also complain to the Belgian Data Protection Authority (dataprotectionauthority.be).

Changes

If this policy changes in a way that matters, you will be told on the site.