Privacy Policy

1. Who operates it

The operator is the owner of the squad-game-board repository, acting as a private individual. The app is hosted on Vercel; the database is Neon (PostgreSQL).

2. What data is processed

• GitHub: the account identifier and name, used for sign-in and membership checks; the name and avatar are also shown to members on the board.
• Steam: the linked account identifier and publicly available game library data, used to verify ownership and find shared games.
• Telegram: the account identifier, group chat messages available to the bot, and votes on play sessions.
• Google: email, account identifier (sub), an encrypted refresh token, the granted scopes (openid, userinfo.email, and calendar.events), connection status, and internal update timestamps.
• Waitlist: the email, group size, and traffic source left on the public waitlist form (section 9).
• Visit statistics for the public pages: anonymous page views and interactions (section 10).
• The board stores games, comments, member preferences, notifications, and play sessions. For a created event, its identifier, the organizer link, and an internal Google Calendar reference are stored.

3. How Google data is used

The sole purpose of the integration is to create play-session events on the organizing member's primary calendar and invite the other connected members to that event.

The app does not read unrelated events or other calendars, and does not modify or delete events it did not create. On a retry or error recovery, it checks for its own event by a predetermined identifier to avoid duplicates.

The Google email is used to display the connected account in the profile and to address invitations. The app does not post it or the event link in chat, and does not pass them to the language model. Member addresses are passed to Google to send invitations.

The refresh token is stored encrypted in the database (AES-256-GCM). The key is only available to the server. The token is decrypted when calling the Google API to obtain a short-lived access token.

Google data is not sold, used for advertising or model training, and is not shared with third parties for their own purposes. Processing by infrastructure and sending invitations is described below.

Use and transfer of information received through the Google API complies with the Google API Services User Data Policy, including the Limited Use requirements.

4. Third-party sharing

• Vercel — hosting and running server-side code.
• Neon — storing app data and encrypted tokens.
• Google — connection authorization and the Calendar API, creating events and invitations.
• Telegram — bot operation, chat messages, and voting.
• Mistral AI — the assistant receives chat message text and the board context it needs, but the integration does not pass it Google account data.
• GitHub and Steam — sign-in and account linking, respectively.

Google processes invitee addresses and event details; members receive invitations through Google Calendar.

5. Storage and deletion

The Google token is kept until Google is disconnected in the profile or the record is deleted by the owner. Access expiring or being revoked may flag the connection as needing re-consent, but does not by itself delete the record.

Google connections, play sessions, and their votes are not included in the daily board backups saved to the backups branch. This applies to the app's export.

A member can revoke access at any time on the Google permissions page. After revocation, the app loses the ability to access their calendar. Disconnecting the integration does not delete events already created.

6. Security

The hosted app uses HTTPS. Google tokens are encrypted at rest; the encryption key and other secrets are set as server environment variables. Access to board data is limited to approved members and is checked on the server.

7. Member rights

Connected accounts can be viewed in the profile. Google and Steam can be disconnected there. To remove other connections or data, contact the owner.

8. Policy changes

The current version of this policy is always available on this page.

9. Waitlist (Squad: Game Board)

The public page at /join collects sign-ups for early access to Squad: Game Board. Anyone can leave their details there without an account.

• What is stored: your email, how many people are in your group (2–6), the traffic source the link carried (for example, the utm_source of an ad), and the time you signed up. Pressing «Join the waitlist» is your agreement to be emailed about access; the form says so next to the button.
• Why: only to contact you about access to the product. The group size and source help plan who to invite first and which channels work. The email is not sold, not used for third-party advertising, and not shared with anyone except the hosting and database providers listed in section 4.
• Where: in the same Neon database as the board. Waitlist entries are included in the daily board backups.
• How long: until access is offered and no longer needed, or until you ask for deletion. To have your entry removed, contact the owner from the address you signed up with, and the entry is deleted from the database. Backup snapshots taken before the deletion are not rewritten.
• Your sign-up is linked to the visit it was sent from, so the owner can see which pages and channels lead to sign-ups. How visits are counted is described in section 10.

10. Visit statistics on public pages

The pages /join and this policy count visits with the app's own code. No third-party analytics service is involved, and nothing is shared with advertisers.

• What is recorded for each page view: the page, the referring site and utm_source, country, region and city derived from the IP address by the hosting provider, device type, browser, operating system, screen size, browser language, how long the page was open in the foreground, and how far it was scrolled.
• What is recorded about interactions: which sections came into view, clicks on marked links and FAQ questions, votes on the demo board, choosing a group size, focusing the email field and starting to type in it, submitting the form, and whether the submission succeeded. What you type is never recorded until you submit the form, and then only as described in section 9.
• No cookies and no browser storage are used for this. The IP address is not stored: to tell visits from one browser apart, the server keeps a hash of the IP address and browser signature mixed with a random value that is replaced every day and then deleted, so visits cannot be linked across days.
• Automated traffic (search crawlers, link previews, headless browsers) is flagged and excluded from the statistics.
• Where and how long: in the same Neon database, only the owner can view it, it is not included in backups, and records are deleted after 180 days.