Passwords & security

Password storage

Passwords are hashed using bcrypt before storage. The original password is never saved and cannot be recovered — only verified.

Session types

Guest session — a random token stored in a secure, HTTP-only cookie. It never touches JavaScript and can't be read by browser extensions or injected scripts.
Registered account — a short-lived JWT token stored in your browser's local storage, used to authenticate API requests. Signing out removes it immediately.

What deshelved stores

Your display name, email address, and hashed password.
Your BGG username (if provided).
Your game collection data synced from BGG.
Your votes, availability selections, and event participation.

What deshelved never stores

Your BGG password in plain text — the username is always saved; the password only if you opt in, and then encrypted (you can forget it any time in Settings).
Payment information of any kind.
Location data beyond what you enter as an event location.

Email

Your email address is used only for account login. It is not shared with third parties, not used for marketing, and not visible to other users or hosts.

Other help articles: Hosting an event · Joining as a guest · Why sign up? · Voting & results · Availability & dates · BoardGameGeek sync · Your collection · Play log · FAQ · Mobile apps