For IT teams
Crowdboard on a company network
Crowdboard runs in a web browser, with nothing to install on phones, laptops or TVs. Most networks need no changes. If yours filters web traffic, this is what to let through.
Not sure? Open Check a network on that network. It tests the live link a game uses in about ten seconds.
Send this to your IT team
The list below in plain words, ready for a ticket or an email, with a link back to this page.
What to allow
crowdboard.appThe site, the host deck, the TV board and players’ phones, over HTTPS on port 443.
Always.
wss://crowdboard.appThe live link between the host deck, the TV board and phones: a secure WebSocket, also on port 443.
For a game with phones, or with the board on another screen.
www.crowdboard.appForwards to crowdboard.app.
If people type the www.
challenges.cloudflare.comThe check that a person, not a bot, is signing in.
When hosts sign in.
cdn.paddle.com*.paddle.comCheckout, run by Paddle, our merchant of record.
Only to buy or change a plan.
accounts.google.comlogin.microsoftonline.comGoogle’s and Microsoft’s own sign-in pages.
Only for hosts who sign in with Google or Microsoft.
Nothing else. Fonts, images and scripts all come from crowdboard.app, with no ads, trackers or third-party analytics. Everything runs on port 443: no other ports, no peer-to-peer connections and no plugins.
The live link
The host deck, the TV board and each phone keep one secure WebSocket open to the game’s room for the whole game. Each sends a small heartbeat every 5 seconds, so an idle timeout doesn’t cut it.
If pages load but the host deck says “This network seems to block live games”, something between the network and crowdboard.app stops WebSockets. It’s usually a proxy or firewall that inspects HTTPS. Let WebSocket upgrades to crowdboard.app through, or leave crowdboard.app out of inspection. A VPN that sends traffic through such a proxy has the same effect.
Until it’s fixed, players can switch to mobile data, the host can connect the deck’s computer to another Wi-Fi or a phone hotspot, and the game can run from the host deck without phones.
Emails
- Sign-in codes and team invitations come from
sign-in@crowdboard.app. A code works for 10 minutes, so a filter that holds mail for review can make it run out. - Getting-started notes come from
hello@crowdboard.app, and replies go to support@crowdboard.app. - Mail is signed with DKIM for crowdboard.app, so a rule that trusts the domain covers all of it.
- A sign-in email holds a 6-digit code to type, not a link, so a scanner that opens links in mail can’t use it up.
Phones, laptops and TVs
- Players use their own phone’s web browser, on the office Wi-Fi or mobile data. Guest Wi-Fi works once phones are past its sign-in page.
- Browsers from about 2018 on work: Chrome 69, Safari 12 (iOS 12), Edge 79, Firefox 68 or newer.
- The TV board runs in a smart TV’s browser, or on a laptop connected by HDMI or shared in a video call.
- The app can’t use the camera, microphone or location: its own security headers switch them off.
What players and hosts share
- Players have no account. They type a name and pick a team: no email, phone number or location. A room forgets its players within 24 hours of last being used.
- Hosts sign in with a code sent to their email, with Google or Microsoft, or on Enterprise with your company’s own sign-in.
- Cookies only keep hosts signed in. All traffic is encrypted (HTTPS only), and each team can reach only its own data.
- Cloudflare hosts the app and its data, Resend sends the emails, and Paddle takes payments. The privacy notice has the details.
How sign-in, encryption, backups and deleting data work is on Security and your data, ready for a security questionnaire. Other questions from your IT or security team: write to support@crowdboard.app.