Privacy Policy

TableTop Prime (“we”, “us”, or “the app”) is a tournament and league management platform for board game associations, conventions, and local gaming communities. This Privacy Policy explains what data we collect, why we collect it, how it is stored, and the choices you have over your information.

By creating an account or using any TableTop Prime feature, you agree to the practices described in this policy. If you do not agree, do not create an account.

1. Data we collect

Data you provide directly

• Email address — used as your unique account identifier and for event invitations, password reset, and account-deletion confirmations.
• Display name — shown to other participants in events you join (organizers, judges, and fellow players).
• Tournament data — events you organize or participate in, players you add, pairings generated, scores you submit or confirm, and judge calls you make. This data is visible to other participants in the same event.

Data received from Google OAuth

When you sign in with Google, we request access to the following scopes:

• openid — verifies your Google identity during login.
• email — your Google email address, used as your account identifier.
• profile — your Google display name, used to pre-fill your TableTop Prime profile.

We do not request access to your Google Drive, Gmail, Contacts, Calendar, YouTube, or any other Google service. We do not read your emails, post on your behalf, or share your Google data with third parties.

Data collected automatically

• Authentication cookies — a Supabase session JWT (sb-<project-ref>-auth-token) keeps you signed in. Refreshed automatically on each request.
• Theme preference — a cookie storing your light/dark/system theme choice.
• Anonymous page-view analytics — collected by Vercel Analytics. Includes page URL, referrer, country (derived from IP), and browser/OS. No user IDs, no cross-site tracking, no advertising identifiers.
• Server logs — standard request logs (IP, timestamp, user agent) retained by Vercel and Supabase for security and abuse prevention. Automatically purged per their respective retention policies.

2. How we store and protect data

• Database: Supabase (PostgreSQL) hosted in Canada (ca-central-1). Data is encrypted at rest and in transit (TLS 1.2+).
• Authentication: Supabase Auth handles password hashing, OAuth token exchange, and session JWTs. We never see or store your Google password — Google authenticates you on its own servers and sends us only the email and name listed above.
• Real-time features: Judge calls use Supabase Realtime (WebSocket). The WebSocket carries only the judge-call data you submit — no additional personal data.
• Hosting: Vercel (Next.js). Vercel has access to request logs and analytics data only; it does not have access to your database.
• Row-Level Security (RLS): Every database table has RLS policies that prevent any user from reading or writing another user's data outside of events they participate in.

3. How we use your data

• To create and maintain your TableTop Prime account.
• To identify you to other participants in events you join (display name and organizer's email only — never your password or auth tokens).
• To generate pairings, compute standings, and display real-time results.
• To send you transactional emails: event invitations, password resets, and account-deletion confirmations.
• To produce anonymized aggregate statistics (e.g., “total events run on the platform”) for product improvement. These statistics never include personally identifiable information.
• To export tournament results as CSV files when an organizer requests them.

We do not use your data for behavioral advertising, sell it to third parties, or share it with data brokers.

4. Third-party processors

We rely on the following services to operate TableTop Prime. Each is a sub-processor with access to the data listed:

• Supabase Inc. — database hosting, authentication, real-time WebSocket infrastructure. Access: email, hashed password (if you set one), display name, and all tournament data. Regions: Canada (ca-central-1).
• Vercel Inc. — web hosting, edge CDN, and analytics. Access: request logs (IP, user agent, timestamps) and anonymous page-view analytics.
• Google LLC — OAuth identity provider. Access: only the email and profile name Google sends us during sign-in. Google's use of your data is governed by Google's Privacy Policy.

5. When we share your data

We share your data only in these specific situations:

• Within events you join: your display name is visible to other participants in the same event (organizers, judges, players). Your email is visible only to the event organizer.
• Public share pages: when an organizer publishes an event, a public page at /share/<eventCode> shows player names, colors, and scores. No emails, no user IDs are ever shown on public pages.
• Legal compliance: if required by law, court order, or to protect the rights, property, or safety of TableTop Prime, our users, or the public.
• Business transfer: in the event of a merger, acquisition, or asset sale, user data may be transferred. We will notify you by email before any such transfer.

6. Data retention

• Active accounts: your data is retained while your account is active.
• Account deletion requests: when you request deletion from your Account page, your email is anonymized, your password is cleared, your auth.users entry is locked, and your EventParticipant rows are removed within 30 days. Historical tournament results (player names, scores, pairings) are preserved for archival integrity — the Player rows have their userId nulled so they are no longer linked to your account.
• Event data: pairings, scores, and placements are retained indefinitely as archival records of past tournaments, even after the organizer leaves or the event is deleted.
• Server logs: Vercel and Supabase retain request logs according to their own policies (typically 30–90 days).

7. Your rights (GDPR / CCPA / LGPD)

Depending on your jurisdiction, you may have the following rights over your personal data:

• Access — request a copy of the data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your account and personal data (the “Right to be Forgotten”, GDPR Article 17).
• Restriction — ask us to limit how we use your data while a complaint is resolved.
• Portability — receive your data in a machine-readable format.
• Objection — object to processing based on legitimate interests.

To exercise any of these rights, email us or visit your Account page and click “Request deletion”. We respond to all verifiable requests within 30 days.

8. Cookies

We use only essential cookies. There are no advertising or tracking cookies:

• sb-<project-ref>-auth-token — Supabase session JWT. Required for authentication. HttpOnly, Secure, SameSite=Lax.
• theme — stores your light/dark/system preference.
• _vercel_jwt — Vercel Analytics cookie for anonymous page views.

9. Children's privacy

TableTop Prime is not directed at children under 13 (or the equivalent minimum age in your jurisdiction). We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.

10. Changes to this policy

We may update this Privacy Policy from time to time. When we do, we will revise the “Last updated” date at the top of this page. For material changes that affect how we use your data, we will notify you by email and require renewed consent before applying the changes.