Skip to content
Meeple Guild

Privacy policy

Meeple Guild helps a group decide what to play: it holds your board-game collection, the nights you plan, and the plays you log. It collects what those features need and nothing else. There are no ads. Your data is never sold, and it is never used to build a profile of you for anyone else's benefit.

19 October 2026 · applies to the Meeple Guild app, its venue admin site, and meepleguild.app

Who this is about

Meeple Guild is an independent app made by Tyler Miller. For anything in this policy, write to [email protected]. That address is a shared support line for every product Tyler Software Developer makes, read only by Tyler, so mention Meeple Guild in your message.

What we collect, and why

Your account

An email address and a password (stored only as a salted hash; we never see it), the display name you choose, and a public handle generated from it so friends can find you. You can also set an optional home area (see "Your area" below) and an optional "looking to play" note that nearby players see while you are discoverable.

If you sign in with Apple or Google instead of a password, Apple or Google confirms who you are and gives us your email address and, if you share it, your name; we never see your Apple or Google password. For Sign in with Apple we also keep the token Apple issues, so that when you delete your account we can tell Apple to revoke Meeple Guild's access. If you use Sign in with Google, Google's sign-in software inside the app may also collect information of its own, such as your phone number, device identifiers and approximate location, under Google's privacy policy. We do not receive that information, and Meeple Guild never asks for or stores a phone number.

If you add a profile photo, it is stored with Cloudflare R2 and shown with your name in the app. It is deleted along with your account.

Your area (optional)

Meeple Guild has an optional "Near You" feature that shows other players near you and lets you set a home area. If you turn it on and allow location access, the app takes one approximate reading and immediately reduces it on your phone to a roughly 3-mile area before anything leaves the device. Your exact position is never sent to us and never stored. You can set the same area by typing a place name instead, like "Fort Worth, TX", with no location reading at all. To turn that area into a place name, or a typed name into an area, the app asks your phone's built-in geocoder, which is Apple's on an iPhone and Google's on Android, and the Near You map is drawn from Apple's or Google's map tiles the same way. Either way the area is used only to show nearby players and mark your home area; it is never sold and never used for advertising or tracking. Being discoverable to nearby players is off until you turn it on, and Near You works even with no area set.

What you put in the app

  • The games in your collection, however you added them
  • Your sleeve records: sleeve size, brand, count, and any note you write
  • The plays you log: game, date, who played, scores and who won
  • Game nights you organize or are invited to, and RSVPs
  • Groups you create and who is in them
  • People you add who don't have accounts: a name you give them, so they can be counted at a table or in a play
  • Friend connections, friend requests, and anyone you block

Rules questions

If you ask the rules assistant a question, we keep the question, the games you asked about, the answer it gave, which rulebook passages it used and, when the assistant searched the rulebook itself, the searches it wrote, and whether you marked that answer unhelpful. That record is how your questions are counted against the monthly limit and how we find where the assistant gets a rule wrong. It is kept until you delete your account, and goes with it.

The question is sent to OpenRouter, which passes it to the AI model that writes the answer, together with the passages of the rulebook that Voyage AI finds for it. To find those passages, Voyage AI is sent searches: the question itself, or searches the assistant writes to answer it, which can draw on earlier messages in the conversation. Neither is sent your name, your email, or your account id: only the question, the searches made for it, and the games it is about. If you ask a follow-up in the same conversation, the earlier questions and answers in that conversation are sent to OpenRouter again with the new question, so the model knows what was already said.

When you contact us

If you write to us, we receive what you wrote and the email address you gave us so we can reply. "Report a problem" in the app and the support form on this website both send your message to PostHog, where it lands next to your recent error reports and, if there is one, the recording of the session you sent it from, so we can see the problem instead of asking you to describe it twice. From the app it also carries the app version and a reference to the last request that went wrong, and your email address only if you add one for a reply. Wherever PostHog cannot take the message, it still reaches us by email: the website's form then sends it through Resend to the shared support inbox described above. Messages about other products arrive in the same inbox, and nothing you send is shared with those products' customers.

"Send feedback" in the app opens your own email app with a message to us already addressed, with the app version and your phone's operating system filled in under a line you can delete.

Settings

Who may see your collection, whether you are discoverable to nearby players (off unless you turn it on), your notification preferences, and the BoardGameGeek username you last imported from.

Your devices

If you allow notifications, we store a push token for that device, along with the device's platform and time zone, so we can send the reminders you asked for and hold an overdue-loan reminder until your quiet hours are over. The token is removed when you sign out and when you delete your account. If you sign out while offline we cannot reach the server to remove it, so it stays with your account until a different account registers it, at least 30 days after your account last did; only then is it released. A token only ever belongs to one account at a time. Switching an individual notification category off, or turning notifications off in your device settings, stops the delivery but leaves the token in place until you sign out.

A record of what we sent you

Every push we attempt is logged against your account: the category, the title and the short line it carried, where in the app it pointed, the device token it targeted, and whether it was sent, failed, or had no device to reach. It is how we can tell you why a reminder never arrived. It is kept until you delete your account, and goes with it.

What we never collect

  • Precise location. Location access is optional and always approximate: a reading is reduced to a roughly 3-mile area on your phone before it leaves the device (see "Your area" above), so your exact coordinates, street, or address are never collected, sent, or stored.
  • Your BoardGameGeek password. Importing a BGG collection needs only a public username, read through BoardGameGeek's public API. We never ask for, receive, or store BGG credentials.
  • Your contacts. See below: matching happens on hashes, and the addresses themselves never leave your phone.
  • Payment details. The optional Pro upgrade, a monthly or annual subscription, is billed by the App Store or Google Play. Your card details go to Apple or Google and never to us. RevenueCat processes the purchase record so the app knows Pro is active (see the processor list below); it never sees your payment method either.
  • Advertising identifiers. No ad networks, and no advertising id. Nothing in Meeple Guild follows you across other apps or websites, and no data about you is ever sold. The one outside service that sees how you use the app is our own product analytics, described below.

Finding friends from your contacts

If you choose to look for friends in your contacts, the app asks for contacts permission, then hashes each email address on your device (SHA-256) and sends only those hashes. The server compares them against hashes of its own accounts and returns the matches. Raw addresses never leave the phone, the hashes are used for that one comparison and not stored, and the feature does nothing until you ask for it.

Who can see your collection

By default your shelf is shared with the people invited to the game nights you join, including anyone with an account who joined a night through its invite link; a guest who RSVPs by name alone, without an account, never sees it. That is what makes "what can we all play" work, and nobody else sees it. You can change it whenever you like in Settings: friends, only people at the same game night, or nobody at all. Suggestions for a night are built from the collections of the people who confirmed they are coming, within whatever each of them allows.

Notifications

Push notifications (game-night reminders, invitations, friend requests) are delivered through Expo's push service, which relays the message to Apple's or Google's notification service. A notification carries only what you would see on the lock screen: a title, a short line, and where in the app to open.

Product analytics

To understand which features are used and which need work, the Meeple Guild app and this website both send usage events to PostHog. From the app that is: the screens you open, things like "a collection import finished" or "a game night was created", how long a session lasts, and which app version, device model, operating system, language, time zone and screen size you are running, all tied to your account. A screen is recorded by its place in the app, never by what is on it: opening a game records "a game screen", not which game. From this website it is pages, presses, and how quickly they load, described under "This website" below. The venue admin site, where venues manage their page, records which of its pages a signed-in venue owner or staff member opens.

These events, and the error reports, recordings and logs below, are used only to improve Meeple Guild: no advertising, no profiling for anyone else's benefit, and nothing is shared beyond the processors listed below.

PostHog also decides which features are switched on for you, so that a new feature can reach some people before everyone, or be tried in two versions to see which works better. That decision uses the same account id as the events and nothing more.

Error reports

When the app, the venue admin site, or this website crashes or hits an error it cannot recover from, it sends PostHog an error report: the error's message, where in Meeple Guild's own code it happened, and the same version, device and operating system details the events above carry, tied to your account like they are once you are signed in. Meeple Guild's servers report their own errors the same way, tied to the account whose request failed. A report describes what broke, not what you were doing: we never add what you typed, a game's title, or anyone's name to one, and email addresses and invitation links are removed from it before it is sent.

Session recordings

So that when something goes wrong (or you tell us it did) we can see what happened instead of guessing, the app, the venue admin site and this website may record a session: a reconstruction of Meeple Guild's own screens as you move through them and, on the two websites, what you click, which we can play back. It is not a video of your device: nothing outside Meeple Guild is captured, and never the camera, the microphone, or sound.

Everything you type is masked before it leaves your device: a recording shows that a field was filled in, never what you put in it. In the app, every image and photo is masked too. On the venue admin site, the names and handles of the people who come to a venue are masked as well. A recording never includes the contents of the requests your device sends us or the sign-in details they carry. Other text on the screen, like a game's title, the names at your table in the app, or the details of a game night on an invitation page, can appear as you saw it.

A recording is tied to your account like the events above, is processed only by PostHog, and is deleted after 30 days.

Server logs

Meeple Guild's servers keep a log of the requests they handle: which part of Meeple Guild was asked for, when, how long it took, and whether it worked. Those logs, and the timings of each request, are sent to PostHog as well, tagged with your account id and the session you were in, so that a problem you report can be followed from the screen you saw to the request that failed. Email addresses and sign-in tokens are removed from a log line before it is sent, and so is the secret part of an invitation link.

Rules assistant answers

To check that the rules assistant answers from the rulebook and cites it, a copy of each question it answers is sent to PostHog, together with the games the question is about and the answer it wrote. The copy also shows how the assistant got there, and that can happen in one of two ways. Either the assistant is given rulebook passages found for the question, and the copy includes those passages. Or the assistant searches the rulebook itself, as many times as it needs, and the copy then includes each search it wrote, the passages each search returned, and every round of its exchange with the AI model, not just the last passages and the answer. When the question is a follow-up, the copy also includes the earlier questions and answers in the same conversation, because the model was shown them too.

There, the answers are graded. An automatic check looks for a page citation. AI models judge whether the answer sticks to the rulebook, whether it answers every part of the question, whether it says so when a rule applies only to one faction, character or expansion, and, when you push back on an answer, whether it keeps a correct answer or corrects a wrong one. Some of these checks run on a sample of questions rather than on every one, and some read the whole conversation, its searches and passages included. The judging model is Anthropic's Claude, which PostHog reaches through OpenRouter. OpenRouter already handles each question when the assistant answers it (see "Who else handles your data"), and the grading sends that text through it a second time.

That copy is not stored under your account id, your name or your email: PostHog gives each one its own random id. It does carry two references we could use to match it to you if we went looking. One is a technical reference that also appears in our servers' log of that request, and that log is tagged with your account id (see "Server logs"). The other is the id of the conversation, which PostHog uses to keep its questions together; it is also the id of the first question in that conversation as we keep it with your account (see "Rules questions"). PostHog keeps the text of the questions, searches, passages and answers in two places, its AI analytics and its trace store, and deletes it from both within 30 days. The grades, and each AI model's short written reason for one, are kept for up to seven years; a reason can quote any of that text.

The identifiers involved

Two random identifiers appear in all of this, and neither is your name or your email. One is the id your account is known by internally, which is what ties these events to you once you are signed in. The other belongs to the app's installation on your device, and it is what events recorded before you sign in are attached to; it is not an advertising id, it is not shared with anyone, and it cannot be read by any other app. Reinstalling the app replaces it.

When you delete your account, we also ask PostHog to erase everything it holds under your account id: the events, error reports and session recordings. If that request ever fails, the account id is already destroyed, so what is left points to nobody and cannot be traced back to you, and if you write to [email protected] we will erase it by hand. Server logs, messages you sent us, and the rules-assistant copies are not part of that request; write to us if you want something of yours removed from them.

Who else handles your data

Meeple Guild is small, and so is this list. Data is processed by Railway, which hosts the API and its PostgreSQL database in the United States (US East, Virginia); Cloudflare, which provides DNS and the secure tunnel that all traffic to the app and this website passes through (the API and website are not directly reachable except through it) and, through Cloudflare R2, stores profile photos; Expo's push service for notifications; PostHog for the product analytics, error reports, session recordings, server logs, support messages and rules-assistant quality checks described above, from the app, the venue admin site, this website and our servers; Voyage AI and OpenRouter, with the AI model OpenRouter passes a question to, for answering rules questions, and OpenRouter again for grading the answers; RevenueCat for Pro purchase records; Stripe for venue subscriptions bought through the venue admin site; and Resend for email: the website's support form when PostHog cannot take a message, password-reset codes, sign-in codes for the venue admin site, the one launch email promised to people who joined the waitlist on this website, and the operational alerts we send ourselves. None of them are permitted to use your data for their own purposes. Apple and Google also provide Sign in with Apple and Google and the geocoding and map tiles behind Near You; we share with each only what it needs to provide that service, under its own terms. Wherever you use Meeple Guild from, our servers and database store and process your data in the United States; the services above may handle what they receive wherever they operate.

BoardGameGeek is not a processor: when you import, we read a public collection from their API. That is a request we make on your behalf, and nothing of yours is sent to them. Game cover art, though, loads in the app straight from BoardGameGeek's image servers (cf.geekdo-images.com), so those servers see your device's IP address, as any site you load an image from does.

How long we keep it

As long as your account exists. There is no scheduled purge, because a play you logged five years ago is exactly the history the app exists to keep. Session recordings are one exception: they are deleted after 30 days. The text of the rules-assistant copies PostHog grades is another: it is deleted within 30 days (see "Rules assistant answers").

Deleting your account

You can delete your account from Settings › Account inside the app, or ask us to do it (see Delete your account). Deletion is immediate and permanent: there is no hold period and no restore.

What is yours is erased: profile, credentials, settings, collection, sleeve records, plays and nights you created, your groups, your friend connections, the people you manage, and your RSVPs to nights that haven't happened yet.

What lives inside someone else's record is not erased, because it is their history: a play they logged, or a past night they hosted, where you were at the table. In those rows the link to your account is removed and your name becomes "Deleted player". Nothing in the row points back to you.

Getting a copy of your data

Settings › Your data exports your collection and play history as CSV, and your nights, RSVPs, groups, friends and other records as one JSON file, any time, without asking us. Do it before deleting your account: afterwards there is nothing left to export.

This website

PostHog is the only analytics this website loads, and it collects the same kind of usage events the app does: which pages you view, which links and buttons you press, and roughly how long you stay. To tell one visit apart from the next, it stores a random identifier in your browser, in a cookie and in local storage. That identifier is not your name or your email, and it is matched to them only if you write to us through the support form: the message carries the name and email you typed, alongside that identifier and your session. Until then, nothing here knows who you are. PostHog also uses the IP address to work out roughly where in the world a visit came from, at about the level of a city. The app does not do this; only the website does. This website can also send error reports and record sessions, as described above.

PostHog also times the page itself: how soon the main content appears, how much the layout shifts while it loads, and how quickly the page answers the first time you press anything. Those are stopwatch readings of the site's own speed, not new information about you, and they are how we can tell a page is slow on a real phone rather than on a fast laptop.

None of this is used for advertising: no ad network is involved, nothing follows you to any other website, no profile of you is built for anyone else's benefit, and none of it is sold. You can remove the identifier any time by clearing this site's cookies and site data in your browser.

Children

Meeple Guild is not directed at children under 13, and accounts are not knowingly created for them. If you believe a child has an account, write to us and we will remove it.

Your rights

Wherever you live, you can access, correct, export, and permanently delete your data, not by writing to us and waiting, but directly in the app: edit your profile, export your data from Settings, delete your account. These work for everyone, regardless of jurisdiction, because they are how the app is built rather than a legal accommodation. For anything they don't cover, write to [email protected].

Changes

If this policy changes in a way that affects what we collect or who sees it, the app will say so before the change takes effect. The date at the top always reflects the current version.