Do players need to install an app?

No — every player checks in via a QR code or share link on their own phone. There's no app to install; the companion view runs in any modern mobile browser.

Can I run a tournament with 60 players?

Yes. The pairing engine handles 2–200+ players across any table size from 2 to 6 per table. Swiss and Adjacent Swiss scale particularly well because they group by standings rather than searching for perfect pairings.

Can I export results to CSV?

Yes. Standings and full match history (every table, every round, every placement) can be exported as CSV at any time. Great for league records and end-of-season reports.

Yes — the Free tier supports up to 11 players with all pairing formats, dual-score verification, and live standings. Paid tiers unlock larger events, judge dispatch, CSV export, and event templates.

Do players need an account?

No. Players open a share link in their browser, enter their name, and they're in. Organizers can also add players manually from the dashboard if they don't have a phone.

How does scoring work?

Every table score is submitted by one player and must be confirmed by a second player at the same table before it is locked. This catches typos, misclicks, and bad-faith submissions at the source. Judges can also edit disputed scores after the fact.

Changelog

New features, security improvements, and bug fixes for TableTop Prime.

August 2026

August 20, 2026

Feature

Player Statistics page

Dedicated /stats page showing global tournament statistics: total events, wins, average placement, and win rate donut chart. Stats grouped by board game. Removed the inline stats from the Account page for a cleaner, dedicated experience.

Feature

Event filters on My Events

Filter events by role (Organizer, Judge, Player) and status (Active, Draft, Finished). Client-side filtering with toggle button groups.

Feature

BGG search improvements

Search results increased from 20 to 50. Results now sorted by relevance (exact match first, then starts-with, then by year). Selecting a game now auto-fills the min/max players per table.

Fix

Companion table selection fix

The Player Companion now correctly shows the player's assigned table instead of defaulting to table 1. When the organizer regenerates a round or reassigns a player, the companion automatically switches to the new table.

Fix

BGG search switched to local dataset

Replaced the live BGG XML API (which was returning 502 errors due to rate-limiting) with a local JSON dataset of 47,844 games. Search is now instant (< 5ms) with no external dependencies.

Fix

Standardized share buttons

Share dropdown now consistently shows: Share link, Show QR code, Copy standings text, Copy pairings text — in the same order everywhere.

Feature

Google AdSense integrated

Google AdSense auto-ads are now live. The script loads only after the user accepts "all cookies" in the consent banner — no ad cookies before consent. Privacy Policy, Terms of Service, and Cookie Policy updated with advertising sections including opt-out links.

Feature

BoardGameGeek integration

Organizers can now search the BoardGameGeek database directly from the event creation and edit dialogs. A "Search BGG" button opens a dialog where you type a game name, search, and select from results. The selected game name auto-fills the form. Uses a server-side proxy with 24h caching to avoid BGG rate limits.

Feature

Cookie consent banner

Added a GDPR/LGPD-compliant cookie consent banner. Users can choose "Accept all" (enables analytics + future advertising) or "Essential only" (auth + theme only). Vercel Analytics is now gated behind consent — no tracking cookies before the user agrees. A consent manager on the /cookies page lets users change their choice at any time.

Security

Critical security fixes

Fixed role-escalation vulnerability where any user could set themselves as ORGANIZER. Removed cross-event IDOR on player and judge-call routes — all updates now scoped by (id, eventId). Added status whitelist and numeric range checks on PATCH event.

Security

Strengthened event codes

Event codes now use crypto.getRandomValues() with an 8-char suffix (~40 bits of entropy, ~1 trillion combinations) instead of the previous 3-char Math.random() suffix (~20 bits).

Security

CSV formula injection prevention

CSV export now neutralizes cells starting with =, +, -, @ by prepending a single quote — prevents spreadsheet formula execution from player names.

Security

Security headers + error boundaries

Added HSTS, X-Content-Type-Options, X-Frame-Options, Referrer-Policy, and Permissions-Policy headers. Added error.tsx, global-error.tsx, and not-found.tsx so uncaught errors show a recovery UI instead of a white screen.

Feature

Procedural event banners

Every event now has a unique, procedurally generated SVG banner derived from (eventId + seedOffset). 12 curated palettes × 6 pattern families (mesh, topographic, bokeh, geometric, waves, stipple). Organizers can reroll with one click.

Feature

Event description + multi-date schedule

Organizers can add a plain-text description and multi-date schedule to each event. Displayed on the dashboard, My Events cards, and the public share page.

Feature

Bonus round improvements

Bonus rounds now use the 1001+ numbering range (no collision with regular rounds). Added parentRound association, delete capability, and organizer UI for creating bonus rounds tied to a specific regular round.

Feature

Full internationalization (en + es)

All ~700 user-visible strings internationalized. Browser language auto-detection on first visit. Dynamic <html lang> attribute. CSV headers translated. 705 keys in each language, verified by i18n-check script.

Feature

OG image + PWA manifest + JSON-LD

Social share cards now show an OG image. Per-event generateMetadata on share pages. manifest.json for Add to Home Screen. Organization + WebSite structured data for Google rich results.

Fix

Dropped/re-added player bug

Fixed bug where players dropped from a previous round and re-added would be dropped again on the next round. The previouslyDropped computation now checks only the latest round instead of unioning all rounds.

Fix

Score permission model

Players can now only score their own table. Self-confirm is blocked — another player or organizer must confirm. Organizers can lock scores directly via Quick Score.

Fix

Ready for Next Round implemented

The Ready toggle now persists server-side via PATCH /api/events/[eventId]/players/[playerId] with { ready: boolean }. Previously was a local-only no-op.

Fix

Share page table redesign

Share page tables now show players as a vertical list. Locked tables get a faint green background + placement badges (gold/silver/bronze).

Design

Warm color scheme

Replaced pure white backgrounds with warm off-white (oklch 0.985 0.002 75). Darkened muted-foreground for WCAG AA contrast. Fixed amber-600 text to amber-700 on light backgrounds.

Design

Mobile overflow + WCAG fixes

Fixed tiebreaker row overflow on 375px screens. Bumped icon-only buttons to 36px minimum touch targets. Added aria-labels to all icon-only buttons. Fixed password show/hide toggle accessibility.

July 2026

July 23, 2026

Feature

Initial production release

TableTop Prime launched with tournament management, dual-score verification, judge dispatch, CSV export, event templates, Supabase Auth (Google OAuth + email/password), and real-time judge call queue.