Privacy Policy

The short version

Table Clan is a small, self-hosted companion for board-game groups. Your data lives on one server in the EU, is used only to run the app for your clan, and is never sold. There are no ads, no analytics, no third-party trackers and no data brokers.

Who runs it

Table Clan (tableclan.com) is a free, non-commercial side project operated from Greece (EU). The operator is the data controller and can be reached at dimk.software@gmail.com. This policy covers this site and its pages only, not the sites it links to (for example BoardGameGeek).

Signing in with Google

You can sign in with Google, or with email and password when the operator has enabled it. Signing in with Google shares only:

• your name,
• your email address (used to identify your account and, if the door is closed to strangers, to decide whether you are on the guest list),
• your profile picture URL, kept with your account and shown as your avatar until you upload a different one.

Nothing else. Table Clan requests no access to Gmail, Drive, Calendar, contacts or any other Google product, and never posts anything on your behalf. After sign-in your browser makes no request to Google — the one exception is the Familiar, if Google's Gemini is the configured AI provider (below).

Google API Services User Data Policy. Table Clan's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

What Table Clan stores

Only what the app needs to work:

• Your account: given name and surname (composed into a display name), optional unique username, email address, avatar (Google URL or a photo you upload), which sign-in method you used, and — only if you set one — an email password stored as a salted hash, never in plain text.
• Your profile: an optional short bio, city, time zone (used to show your local time) and up to five favourite games. People who are your friends or share a clan with you can see them, together with your name, username, photo and when you joined. Anyone signed in who looks you up by your exact username sees only your name, username and photo. Your email address is never shown to other people, and profiles are never shown on share links or sent to the Familiar.
• Your collection: the games you own or want, a short note on each, and any game you typed in yourself. The collection, wishlist and notes live with your account. Friends and clanmates can see them while your “Show my collection to friends and clanmates” switch is on; turn it off and they see nothing, not even a count, and you disappear from their “Also owned by” and “Friends have it”. Collections and wishlists are never shown on share links or sent to the Familiar, a stranger who finds you by exact username sees no collection, and a game you typed in yourself is visible only where your own collection is. It is deleted with your account.
• BoardGameGeek data: titles, covers, years, player counts and play times come from BoardGameGeek. They are cached on the server and shown to signed-in people with the “Powered by BGG” credit. They are never sent to the Familiar or used for AI.
• Friends: who you have sent or accepted friend requests with (by username). Friend lists are only visible to you while signed in; they are never exposed on share links.
• Your clans: which clans (groups of friends) you belong to, your role there, pending invites, the clans you asked not to be invited to again, and the invite code that joins new members. Anyone in a clan can invite someone by their exact username; the invitee can decline, and decline for good.
• Tables: each campaign or match your clan plays, who plays at it and which character they play, the game state, every change made to it (including your display name, so the clan can see who did what), undo history, and session recaps written by the Familiar.
• Photos: pictures you attach to a table, stored as WebP files on the server.
• Gatherings and RSVPs: the game nights your clan plans — title, date and time, the creator's time zone, place, a short note, an optional map link, an optional link to one of the clan's tables, and who is going, maybe or can't, with their optional one-line note. A map link opens in a new tab; it is never fetched by us. Every member of the clan can see them, including cancelled gatherings. They are never shown on share links, never sent to the Familiar, and a member who leaves or is removed takes their RSVPs with them.
• Calendar feed links: a separate random link per device that lets your own calendar app read the upcoming gatherings of the clans you are in. The server stores only a hash of its token, plus the name you give it and when it was last read; the full link is shown once and can be revoked in Settings. The feed contains event details (including a map link, if one was added) and your own RSVP only — never another member's name, avatar or answer — and it is re-checked against your current clans on every request, so leaving a clan removes its events.
• Notifications: the bell keeps a short feed for you — someone accepted your friend request, joined your clan, added you to a table, gave you a seat, or created, changed or cancelled a gathering. Each item names the person who did it and the clan, table or gathering it concerns; nothing else is copied. Only you see your feed, clan items disappear if you leave the clan, read items older than 90 days are deleted, and notifications are never shown on share links or sent to the Familiar.
• Familiar chats: the messages you send, the replies, and which model wrote them.
• Share links: the random token behind a read-only link, what it is allowed to show, and who created it.

Everything in a clan is shared with its members. The other members of your clan can see its tables, their history, the photos, the Familiar chats, the gatherings and who answered what, together with your name. A share link is different: anyone who has the URL can open it without an account, so treat it as public — you can revoke it at any time. A calendar feed link is also a secret, but it is stricter than the clan page: it carries event details and your own answer only, not who else is coming.

Cookies and browser storage

Table Clan sets one session cookie to keep you signed in, and one small preference cookie remembering which of your clans you last opened. The browser also keeps a little local storage for interface choices such as your board layout. Fonts are served from our own server, not from Google.

There is no analytics, no advertising, no tracking pixel and no third-party JavaScript. Nothing here needs a consent banner because nothing that is not strictly necessary is set.

The Familiar (AI)

When you ask the Familiar something, your message and the relevant game context are sent to the AI provider the operator has configured — one of Anthropic (Claude), Google (Gemini), OpenAI or DeepSeek, called through their APIs with the operator's own credentials. The reply is stored in the table's chat so everyone in the clan can read it.

We do not use your messages to train models, do not sell them and do not put them in ads. Each provider processes them under its own API terms as a data processor. Box art and other BoardGameGeek data are never sent to the Familiar.

The Familiar is optional: admins can turn it off for everyone or for a single player. Admins see usage counts in the admin area, not the contents of chats.

Who we share it with

Only the services needed to run the app:

• Google — to sign you in, and for Gemini if that is the configured AI provider.
• Anthropic, OpenAI or DeepSeek — only for the AI provider the operator has configured.
• OVH — the VPS in the EU where the app, the database and the photos run.
• GitHub — hosting the container image (no personal data) and storing the nightly backups in a private repository artifact store.

Nobody else. No sale, no ad networks, no data brokers, no government access beyond what the law requires.

Where it lives, and for how long

Everything sits in a Postgres database and a photo folder on one OVH server in the EU, reached over TLS. Nightly backups keep a copy on that server for 14 days and a private copy on GitHub for up to 14 days (7 for photos); after that they age out automatically. Your account data stays while your account exists.

Deleting your data

There is no delete button yet, so email dimk.software@gmail.com from the address on your account and ask. We will delete your account, its sessions and memberships, and the photos and chat messages you added; they disappear from backups within about two weeks. If you would rather leave your plays and photos behind for the rest of the clan, say so and we will drop only the account.

One deliberate exception: the play history keeps the display name of whoever made each change. That record is what makes undo and the group's log trustworthy, so it survives account deletion — but ask and we will replace it with a neutral name instead.

Your rights

Under the GDPR you can ask to see, correct, export, delete or stop us using your personal data, and you can withdraw any consent you gave. Write to dimk.software@gmail.com; we answer within 30 days. If you are not satisfied, you can complain to the Greek data protection authority, the Hellenic Data Protection Authority.

Children

Table Clan is not intended for children under 16, and we do not knowingly collect their data. If a child has signed up, write to us and we will remove the account.

Security

Traffic is encrypted with TLS, passwords are stored as salted hashes, and only the operator can reach the server and database. The app runs no third-party scripts that could read your session. No system is perfectly secure, but this one is small on purpose.

It is a one-person project, so the operator holds the keys: your plays and chats are technically visible to them, though nobody reads them as part of running the app.

Changes to this policy

If the app starts doing something new with your data, this page changes and the date above moves. Material changes are also announced in the app.

Questions? dimk.software@gmail.com — or head back to the shelf.