Privacy Policy

Last updated: August 27, 2026 · Effective: May 8, 2026

1. Who we are

"Game Nite" (also referred to as "we", "us", "our") is an independent board game tracking service operated from California, United States. This Privacy Policy explains how we collect, use, share, and protect personal information when you use our websites, mobile apps, and related services (the "Service"), available at gamenite.ai. The legal entity operating Game Nite, and a postal address for legal service, is available on request to legal@gamenite.ai.

This policy is published in compliance with the California Online Privacy Protection Act (CalOPPA) and incorporates disclosures required by the California Consumer Privacy Act, as amended by the California Privacy Rights Act (collectively, "CCPA/CPRA").

2. What information we collect

We collect personal information in the categories below. The CCPA category in brackets is provided for California residents.

Information you provide directly

• Account information [Identifiers]: username, display name, email address, hashed password, date of birth (collected once at signup as our age gate; never displayed), optional bio and avatar.
• Profile preferences [Customer records]: favorite game, preferred player count, experience level.
• Gameplay data [Customer records / Internet activity]: games you log, scores, players, leagues, league memberships, friend connections, completed coaching recommendations.
• Billing information [Commercial information]: subscription tier, plan history, and a Stripe customer ID. Card numbers and full payment details are collected and stored by Stripe — we never see or store your card number.
• Support and feedback [Customer records]: messages, screenshots, and metadata you submit through our feedback widget or via email to support@gamenite.ai.
• Optional discovery information [Geolocation — coarse]: ZIP code if you opt in to player discovery (currently disabled by default and gated behind a feature flag).

Information collected automatically

• Device and connection data [Internet activity / Identifiers]: IP address, browser type, operating system, device type, language, and approximate location derived from IP.
• Usage data [Internet activity]: pages visited, features used, errors encountered, timestamps, referring/exit pages.
• Cookies and similar technologies: see Section 6.

Information we do NOT collect

• We do not collect government-issued ID numbers (the optional Persona identity verification feature is currently disabled in production).
• We do not collect biometric information.
• We do not collect precise GPS location.
• We do not knowingly collect information from anyone under 13 (see Section 11).

3. How we use information

We use the information we collect to:

• Operate the Service: create your account, save your games, calculate analytics, run leagues, deliver coaching insights, and process subscriptions.
• Communicate with you about your account, security, billing, support requests, and (if you opt in) weekly recap emails.
• Improve and secure the Service: diagnose issues, prevent fraud and abuse, and develop new features.
• Comply with legal obligations and enforce our Terms of Service.

We do not sell your personal information for money. We do not use your gameplay data to build advertising profiles, and we never share your gameplay data (scores, games, leagues) with advertisers. We do run small paid ad tests (currently a Reddit Ads campaign) and, only after you accept our cookie banner, share a bare-bones "this ad led to a signup" signal with that ad platform so we know which ads are working — see Section 5 and Section 6.

4. Legal bases (and why we process data)

If you are in a jurisdiction that requires a legal basis (such as the EU/UK), we rely on:

• Contract: to provide the Service you signed up for.
• Legitimate interests: to keep the Service secure, prevent abuse, and improve product reliability.
• Consent: for non-essential cookies, marketing emails, and any optional features that require explicit opt-in (such as player discovery).
• Legal obligation: to comply with tax, accounting, and law-enforcement requests.

5. How we share information & subprocessors

We share personal information only with the service providers below, who process it on our behalf under contractual obligations. We do not sell or rent your personal information.

We may also share information when required by law (subpoenas, court orders), to protect rights and safety, or in connection with a sale or restructuring of the business (in which case we will notify you and any successor will be bound by this policy or one materially similar).

6. Cookies, analytics & Do Not Track

We use cookies and similar technologies (such as localStorage) for three purposes:

• Essential: keep you signed in, remember your selected league, and protect against cross-site request forgery. These cannot be disabled without breaking the Service.
• Functional: remember UI preferences such as which dashboard tab you last used or whether you dismissed a banner.
• Analytics (PostHog): on by default so we can understand product usage; click "Reject non-essential" in the cookie banner (or Settings → Privacy & Data) at any time to opt out.
• Advertising (Reddit Ads pixel): loads automatically only if you arrive via one of our ads (e.g. a Reddit click), and only used to measure our own paid ad campaigns; opts out the same way as analytics. See Section 5.

Do Not Track: Game Nite respects the browser-level "Do Not Track" (DNT) signal. If your browser sends DNT, we do not initialize PostHog, the Reddit Ads pixel, or capture any analytics/advertising events from your session, even if cookies are otherwise allowed.

Global Privacy Control (GPC): If your browser sends a GPC signal, we treat it as an opt-out and act on it automatically — no login or extra steps needed. In practice this means we will not load PostHog or the Reddit Ads pixel for your session.

For more detail and a list of cookies we set, see our Cookie Policy.

7. How long we keep your information

• Account and gameplay data: kept while your account is active. If you delete your account from Settings → Privacy & Data, your account is removed within 30 days. Solo game records (where you were the only player) are deleted. Games you played with others are preserved for the benefit of those co-players: your row in those games becomes a guest entry under your existing display name (or, if you opt to fully anonymize at deletion time, replaced with a generic label). Your account ID is unlinked from those rows in either case.
• Backups: encrypted backups may retain residual copies for up to 60 days for disaster recovery, after which they are overwritten.
• Billing records: Stripe retains transaction records for up to 7 years to satisfy financial-record retention requirements; we retain a minimal record of subscription history (tier changes, dates) for the same period.
• Server logs: technical logs (IP, request path, status code) are retained for 30 days for security monitoring.
• Support correspondence: kept for 2 years from your last interaction so we have context for follow-up requests.

8. Security

We use industry-standard safeguards including TLS in transit, encryption at rest for our database, bcrypt password hashing, JWT-based authentication, role-based access control to production systems, rate limiting on authentication endpoints, and structured logging for security-relevant events. No system is 100% secure; if we discover a breach affecting your personal information we will notify you in accordance with applicable law.

9. Your privacy rights

Depending on where you live, you may have the right to:

• Access: request a copy of the personal information we hold about you.
• Correct: request correction of inaccurate or incomplete information.
• Delete: request deletion of your personal information.
• Portability: receive your data in a machine-readable format (we provide JSON export).
• Opt out of analytics: decline non-essential cookies in our cookie banner at any time.
• Withdraw consent: where we rely on consent, you can withdraw it without affecting prior processing.
• Lodge a complaint: with a supervisory authority in your jurisdiction.

How to exercise these rights:

• Self-service: visit Settings → Privacy & Data to download all your data as JSON or to delete your account.
• Email: write to privacy@gamenite.ai from the address on your account. We respond within 45 days (extendable to 90 days for complex requests, with notice).

We will not discriminate against you for exercising any of these rights.

10. California (CCPA/CPRA) disclosures

This section applies to California residents. The CCPA categories of personal information we have collected in the past 12 months are listed in Section 2. The business and commercial purposes for which we collect each category are described in Section 3. The categories of third parties we share with are listed in Section 5.

Do we "sell" or "share" personal information?

We don't sell personal information for money. We do run a small paid ad campaign (currently on Reddit) and, only with your consent, share a simple ad-click/signup signal with that platform so we know which ads are working — never your gameplay data, scores, or account details.

If your browser sends a Global Privacy Control or Do Not Track signal, we treat it as an automatic opt-out of that sharing — no login or extra steps needed. That's also why we don't display a separate "Do Not Sell or Share My Personal Information" link: turning on GPC/DNT (or simply rejecting our cookie banner) already does the same thing.

Sensitive personal information

We do not collect or process "sensitive personal information" as defined by CPRA § 1798.140(ae) for any purpose that would trigger an opt-out right. Specifically, we do not collect government IDs, financial account credentials (Stripe handles those directly), precise geolocation, biometric data, contents of mail/email/messages, or genetic/health data.

Your California rights

You have the right to know, delete, correct, and limit, as described in Section 9. You may designate an authorized agent to make a request on your behalf by sending us written authorization signed by you. We will verify your identity using the email address associated with your account before fulfilling a request.

Notice of financial incentive

We do not offer financial incentives in exchange for personal information.

11. Children's privacy

Game Nite is not directed to children under 13. We require all new accounts to confirm their date of birth at signup and reject accounts whose stated age is under 13 (an "age gate" to satisfy the U.S. Children's Online Privacy Protection Act / COPPA). We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact privacy@gamenite.ai and we will delete it promptly. If you are between 13 and 16 and located in California, you have the additional right to opt in (rather than out) of any sale or sharing of your personal information — though as noted above, we do not engage in either.

12. International users

Game Nite is operated from the United States and our primary infrastructure is located in the United States. If you access the Service from outside the U.S., your information will be transferred to and processed in the U.S., which may have different data protection laws than your jurisdiction. By using the Service you consent to this transfer.

13. Changes to this policy

We may update this Privacy Policy from time to time. The "Last updated" date at the top will reflect the most recent revision. For material changes, we will provide additional notice (such as an in-app banner or email to your account address) at least 14 days before they take effect.

14. How to contact us

For privacy questions, requests, or to exercise your rights:

• Email: privacy@gamenite.ai
• General support: support@gamenite.ai
• Legal & postal address: legal@gamenite.ai (we'll provide a mailing address for service of legal process on request)

This policy describes our actual data practices as of the date above. If anything in this policy is unclear, please email us — we'd rather answer a question than have you guess.