Privacy Policy

This policy explains what personal data we process when you use Ludoya, why, on what legal basis, for how long, who else handles it, and the rights you have over it.

Who Is Responsible

Ludoya is run by Tenkai Workshop S.L., NIF B56364086, Spain, which is responsible for the personal data described here. Write to app@ludoya.com about anything in this policy. We have not appointed a data protection officer.

When a club or organiser runs its members and events on Ludoya, it is responsible for its members' and guests' data (its join forms, roster, event forms, attendance and dues), and we process that data on its behalf.

Information We Collect

We collect the following personal information:

• Username and Display Name
• Email Address
• IP Address
• Location (optional)
• Optional profile details you choose to add: date of birth, gender, phone number, and your avatar
• The gaming content you create: your collection, plays, reviews, posts, photos and messages
• Billing details, if you subscribe or buy a ticket — handled by our payment provider, never stored on our servers
• Only if you accept analytics: how you use the app, including recordings of your sessions with everything you type hidden

Why We Use It, and On What Basis

• To give you the service: your account and profile, your collection and plays, the events, clubs and messages you take part in, and the emails that go with them. The basis is our contract with you (GDPR article 6(1)(b)).
• Payments and invoices: our contract with you, and our legal obligation to keep invoices (article 6(1)(c)).
• Security and keeping Ludoya running: server logs with IP addresses, and preventing abuse and fraud. The basis is our legitimate interest in a safe, working service (article 6(1)(f)).
• Product analytics: only if you accept it (article 6(1)(a)). You can withdraw at any time in Settings, Privacy.
• Anonymous statistics: our legitimate interest in understanding how games are played (article 6(1)(f)), described below.
• The AI game assistant: when you use it, your question and any photo you attach are sent to OpenAI so it can answer; that is part of our contract with you. Don't attach anything you wouldn't want processed by a third party.

Data Use

We use your information to run Ludoya as a social network for board gamers: showing your display name and username, and the collection, plays and posts you choose to share according to your privacy settings.

We do not sell your data, and we never share your own collection, plays, ratings or gaming habits with advertisers, data brokers or anyone else. Your taste in games is yours.

We may compile anonymous statistics from activity on people's own accounts, such as how often a game is played in a region, and use them in our own reports or with partners such as publishers. They never include a figure based on fewer than five people, so no person or small group can be identified, and they never use the data clubs manage through Ludoya.

People Without a Ludoya Account

You can go to an event without registering. When someone saves you a seat, or you sign up at an event with just your name and email, we keep what was given: your name, your email address and your answers to the event's form. The organizer needs them to run the event, and you need them to confirm your seat.

If you don't finish creating an account, we delete your email address and form answers 30 days after your last event. When we have your email address, we send you one notice about 10 days after the event with the exact date. Your name stays on the event's attendee list and on the plays and results you took part in. Sign up with the same email address before that date and your seats and plays move to your account.

The club or organizer running the event decides what its form asks and is responsible for the answers; Ludoya stores and processes them on its behalf. Club members stay on the club's roster for as long as they are members.

How Long We Keep It

• Your account and content: until you delete your account. Plays only you took part in are deleted with it; plays you shared with other people stay on their profiles, with your name no longer linked to your account.
• Accounts never finished: the details are deleted 30 days after the last event, as described above.
• Notifications and records of emails sent: 30 days.
• Server logs: 60 days.
• Backups: deleted data disappears from our backups within six weeks.
• Invoices: for as long as tax and commercial law requires.

Services That Process Data For Us

Running Ludoya relies on a few specialist services. They act on our instructions and only for the purpose listed, and none of them receives your data to use for their own marketing. Some are outside the EU; the last column says on what legal basis.

• OVH (OVH SAS): Our servers, database, uploaded images and backups. France (Roubaix; images and backups in Paris). None: the data stays in the EU.
• SMTP2GO: Sending every email Ludoya sends. EU (Amsterdam). None: the data stays in the EU.
• Stripe: Payments for Ludoya subscriptions. Tickets and dues go through each club's own Stripe account, where Stripe acts for the club. United States. EU–US Data Privacy Framework.
• Google: Sign-in with Google, maps, places and address lookup, and push notifications on Android. United States. EU–US Data Privacy Framework.
• Apple: Push notifications on iPhone and iPad. United States. Standard contractual clauses.
• OpenAI (OpenAI Ireland Ltd): AI features: the game assistant, matching and describing games, and the chat bot a club can add to its Telegram or Discord group. The bot is sent the club's events and games, never people's names. United States. Standard contractual clauses.
• Cloudflare: Domain names and the network in front of our servers. Worldwide network: each visitor is served from the location nearest to them. EU–US Data Privacy Framework and standard contractual clauses.
• PostHog: Product analytics, only for people who accept it: which features are used and where people get stuck, including session recordings with everything typed hidden. EU (Frankfurt). None: the data stays in the EU.

Data Security

Passwords are stored hashed, never in readable form, every connection to Ludoya is encrypted, and access to our servers is limited. If a breach is likely to put your rights and freedoms at high risk, we will tell you, as the law requires.

Third-Party Links

Ludoya's games link to BoardGameGeek's ones. Please refer to BoardGameGeek's Privacy Policy to understand their privacy practices, as they might differ from ours.

If you export your data to BoardGameGeek the system will request your BGG password in order to perform the data export, and keep it securely stored and encrypted in our database. We will never share this information with third parties.

User Rights

You can ask us for access to your personal data, to correct it, to delete it, to restrict or object to its use, and to receive it in a portable format, and you can withdraw any consent you gave. Write to app@ludoya.com; we answer within a month. If you think we have not handled your data properly, you can complain to the Spanish Data Protection Agency (www.aepd.es).

Cookies

We use essential cookies to keep you signed in, plus Google's cookies if you use Google sign-in. Product analytics with PostHog, including session recordings with everything you type hidden, runs only if you accept it, and you can withdraw at any time in Settings, Privacy. We do not run advertising cookies or third-party ad trackers.

Children

You need to be at least 14 to create an account, the age of digital consent in Spain, or to have your parent's or legal guardian's consent.

Changes to this Privacy Policy

We may update this Privacy Policy from time to time, so it is our recommendation to review this page periodically for any changes. We will notify you of any changes by posting the new Privacy Policy on this page. These changes are effective immediately after they are posted on this page.

Contact Us

For any questions or concerns regarding this Privacy Policy, please contact us at app@ludoya.com.

Last Updated: 29 September 2026