Privacy & Cookies

Last updated: 20 August 2026

deshelved is a free, independent project. There are no advertisers, no data brokers, and no third-party tracking networks. This policy explains exactly what we collect, why, and how you can have it removed.

1. Who we are

deshelved is operated by Devrin Cakali. For data enquiries, contact us via the support page.

2. What we collect and why

Account information

When you register, we store:

Your display name
Your email address — used only for sign-in; never shared or used for marketing
Your password, hashed with bcrypt — the original is never stored and cannot be recovered

BoardGameGeek data

If you provide a BGG username, we sync your publicly visible owned games and logged play history from BoardGameGeek. By default your BGG password isn't stored — it's used once for the sync and discarded. You can optionally choose to save it, in which case it is stored encrypted so we can re-authenticate when your BGG session expires; you can remove it any time in Settings.

Event and voting data

We store the events you create or join, the games on each shortlist, your vote choices (Want / OK / Pass), and the dates you mark as available. This data is needed to run the service.

Push notifications

If you enable push notifications in Settings, we store a device token (a random identifier issued by your browser or by Google Firebase for the Android app). This token is used solely to deliver notifications — voting updates, event activity, and support replies — and is never shared or used for any other purpose. You can disable notifications at any time in Settings, which removes the token from our servers.

Support tickets

Messages you send via the support page are stored so we can respond. They are not used for any other purpose.

What we never collect

Your BGG password in plain text (it's only saved if you opt in, and then encrypted)
Payment information of any kind
Your physical location beyond any address you voluntarily enter as an event venue
Data from any source other than what you provide directly

3. Cookies and local storage

Strictly necessary

Name	Type	Purpose	Expires
`session`	HTTP-only cookie	Identifies your guest session so you can return to an event from the same device without signing in	30 days
`quorum_token`	localStorage	JWT token that authenticates registered account API requests. Removed on sign-out.	Session

Functional (preference)

Name	Type	Purpose	Expires
`quorum_theme`	localStorage	Remembers your theme preference (system, light, or dark)	Persistent
`pwa_install_dismissed`	localStorage	Remembers that you dismissed the "Install as app" banner	Persistent
`cookie_notice_dismissed`	localStorage	Remembers that you have acknowledged this cookie notice	Persistent

Analytics (third-party)

Name	Type	Purpose	Expires
`_cfuvid`, `cf_clearance`	Cookie (Cloudflare)	Set by Cloudflare, our CDN and DDoS protection provider. Used to distinguish legitimate visitors from bots and to measure aggregate traffic. See Cloudflare's privacy policy.	Session / 1 year

Cloudflare processes requests on our behalf and may log IP addresses as part of its network protection service. We do not receive individual-level analytics — only aggregate traffic data (page views, error rates).

4. Third-party services

BoardGameGeek

We query the public BGG API to fetch collection and game data. Your BGG username is sent to BGG as part of this request. No other personal data is shared. BGG's own privacy policy applies to their service.

Google Sign-In

If you choose to sign in with Google, we receive your name and email address from Google's OAuth service to create or link your account. We do not receive your Google password or any other Google account data. Google's privacy policy governs that interaction.

Firebase (push notifications)

The Android app uses Google Firebase Cloud Messaging to deliver push notifications. Firebase may process your device's push token as part of this service. See Google's Firebase privacy information.

OpenAI

When you attach a rulebook PDF to a game, the text content of that PDF is sent to OpenAI's API to generate a cheat sheet and to answer rules questions. No personal data (name, email, account details) is included in these requests. OpenAI's privacy policy governs how they handle API data.

Cloudflare

All traffic passes through Cloudflare for performance and security. Cloudflare acts as a data processor on our behalf. See Cloudflare's privacy policy.

5. Your rights (UK GDPR)

You have the right to:

Access — request a copy of the data we hold about you
Rectification — ask us to correct inaccurate data
Erasure — ask us to delete your account and your data (see section 6 for the two things that are anonymised rather than deleted)
Portability — receive your data in a structured, machine-readable format
Object — object to processing where our legitimate interests are the legal basis

To exercise any of these rights, contact us via the support page. We will respond within 30 days.

6. Data retention

We retain your data for as long as your account is active. You can close your account yourself at any time in Settings; it takes effect immediately. Your sign-in details, your collection, your own play log, your votes and your support messages are deleted at that point, and your email address is freed so you can sign up again later if you want to.

Your name and BoardGameGeek username are kept where they form part of someone else's record: your entry in a crew member's list, and your place in game nights and plays other people logged. They entered those details to record who they play with, so that is their data and they keep it. Your account becomes a plain crew entry — it cannot be signed into, and it holds nothing else about you.

Game nights you hosted are kept for the guests who took part, and are closed. Your own play log, your collection and your votes are deleted outright.

Anonymised aggregate data (e.g. total event counts) may be retained for service improvement.

7. Security

Passwords are hashed with bcrypt. All traffic is encrypted in transit via TLS. Guest session cookies are HTTP-only (inaccessible to JavaScript). JWT tokens are short-lived and removed on sign-out.

8. Changes to this policy

If we make material changes, we will update the date at the top of this page. Continued use of the service after changes constitutes acceptance.

9. Contact

For any privacy-related queries, use the support page and we will respond promptly.