Passwords & security

Password storage

Passwords are hashed using bcrypt before storage. The original password is never saved and cannot be recovered — only verified.

Session types

Guest session — a random token stored in a secure, HTTP-only cookie. It never touches JavaScript and can't be read by browser extensions or injected scripts.
Registered account — a short-lived JWT token stored in your browser's local storage, used to authenticate API requests. Signing out removes it immediately.

Signing out everywhere

If you've signed in on a device you no longer have — or just want to be safe — use Sign out of all other devices in Settings. It invalidates every other session immediately while keeping the device you're on signed in. Changing your password does this automatically, so a lost or stolen session can't outlive a password reset (you'll be asked to sign in again with the new password).

What deshelved stores

Your display name, email address, and hashed password.
Your BGG username (if provided).
Your game collection data synced from BGG.
Your votes, availability selections, and event participation.

What deshelved never stores

Your BGG password in plain text — the username is always saved; the password only if you opt in, and then encrypted (you can forget it any time in Settings).
Payment information of any kind.
Your exact position. Location autofill (in Settings, off by default) keeps only a rounded position, matched against places you have logged before, and turning it off deletes what it stored.

Email

Your email address is used only for account login. It is not shared with third parties, not used for marketing, and not visible to other users or hosts.

Other help articles: Why sign up? · Mobile apps · Your collection · BoardGameGeek sync · Your crew · Hosting an event · Joining as a guest · Voting & results · Availability & dates · Play log · Sharing a shelf with your family · FAQ