Privacy notice

This notice explains what personal data Crowdboard collects, why, and what you can do about it. Crowdboard is run by Techstus Software Solutions Limited, a company registered in Kenya under number PVT-27U5JMEZ, which is responsible for this data (the "controller"). For anything about your data, write to support@crowdboard.app.

We keep this short on purpose: Crowdboard collects as little as it can, shows no ads, and sells nothing about anyone.

What we collect

• Hosts' accounts: your email address, the name you give, and the teams you belong to with your role in each. We send a 6-digit code to sign you in; it's stored only as a scrambled (hashed) value and expires after 10 minutes. If you sign in with Google or Microsoft instead, they tell us your name, your email and whether they have confirmed it; we keep which account it was, and no access to it. If your company has set up its own sign-in for Crowdboard, your company's sign-in tells us your name and your work email in the same way; the company's owner gives us the settings for it, and we keep its secret sealed (encrypted).
• Invitations: the email address someone invites, who invited them and the role offered, until the invitation is used or cancelled, or 30 days after it runs out (so the team can send it again).
• What hosts make: games, questions, topics, tournaments and team names.
• Game results: for each game a signed-in host finishes, the game's title, the family names and scores, each round's question and who won it, which host ran it and when. Players' names are not part of a result.
• Players: the display name a player types and the team they pick. Players have no account, and we ask for no email, phone number or location. A room forgets its players within 24 hours of last being used.
• Feedback: if you answer “How did the game go?” at the end of a game, your answer and any comment, with your account and team. We use it to improve Crowdboard, and it’s deleted when your account is closed.
• Survey answers: if a team sends you one of its surveys, what you type in answer, with no name, email or account. Your browser keeps a random number so you can change your answers, or take them back while the survey is open. The answers stay with the team’s survey until the team deletes it.
• Enquiries: if you write to us through “Talk to us”, your name, email, company, how many people will play, what you asked about and your message, with your team if you’re signed in. We use it only to answer you.
• Payments: handled by Paddle (see below). We receive your plan, its status and renewal date, your country and Paddle's customer reference. We never see or store card numbers.
• How people find us: which tagged link or website first brought a browser to the public site, sent when you visit and once when you sign up. We keep it as counts by source and day, plus that one source on a new account. It's never used for ads or shared.
• Technical data: your IP address, browser type and the pages and actions requested, which our hosting provider records in short-lived logs. We use them to keep Crowdboard working and secure, for example to limit repeated sign-in attempts. When the app hits an error, your browser tells us which part of the site it was on, the error's message with any email address or long number taken out, and which of our files it came from; we keep these as counts, so we can fix it.

Why we use it

• To provide Crowdboard: sign you in, run your games, keep your team’s library, and take and manage payments (to perform our contract with you).
• To keep it secure and working: preventing abuse, fixing faults and limiting sign-in attempts (our legitimate interest in a safe, reliable service).
• To learn how people find and use Crowdboard, as counts only, so we can improve it (our legitimate interest in running and growing the service).
• To send the emails the service needs: sign-in codes, invitations, receipts and important changes. We send no marketing email unless you ask for it.
• To help you get started: a welcome when you sign up, a reminder if your team hasn’t run a game a couple of days later, and a note to a team’s owner before its Event pass runs out (our legitimate interest in helping you use what you signed up for). Each has a link to stop them; sign-in codes and invitations still come.
• To answer enquiries you send us through “Talk to us” (our legitimate interest in replying to you).
• To meet legal duties, such as tax and accounting records.

Cookies and your browser's storage

Crowdboard uses cookies only to keep you signed in. They are strictly necessary, so they need no consent banner. The app also saves games and your place in a game in your browser's own storage, so a game survives a reload. The public site also keeps, for 30 days, which tagged link or website first brought your browser here, so a sign-up can be counted by source; clear your browser's site data to remove it. There are no advertising or tracking cookies, and no third-party analytics.

Who else handles it

We share personal data only with the providers that run Crowdboard for us, under contracts that limit them to doing that:

• Cloudflare hosts the app, its database and the game rooms, on its worldwide network.
• Resend sends our emails, such as sign-in codes and invitations.
• Paddle is our merchant of record: it sells plans in its own name, takes payments and handles tax, invoices and refunds. Paddle is a controller of the data you give it at checkout, under its own privacy notice.
• Anthropic drafts a game when a host asks for one from a topic. It receives only the topic the host typed and the number of rounds, nothing about players or accounts.

We may also share data if the law requires it, or with whoever takes over Crowdboard, who must then follow this notice.

Where it's kept

Our providers may handle data outside your country, including in the United States and the European Union. Where the law requires it, these transfers are covered by safeguards such as the European Commission's standard contractual clauses.

How long we keep it

• Account and team data: while the account exists. When you close it, we delete it within 30 days.
• Games and topics: until you or your team delete them, or the team is closed.
• Game results: until the game’s host, an owner or an admin deletes them, or the team is closed. A team keeps its latest 5,000 games.
• Players’ names in a room: up to 24 hours after the room was last used.
• Enquiries sent through “Talk to us”: 12 months, then they’re deleted.
• Sign-in codes: 10 minutes. Server logs: a few days.
• Signed-in sessions, with the IP address and browser they were made from: until you sign out, or 30 days after you last used them.
• Payment records: as long as tax and accounting laws require, usually several years.

Your rights

Depending on where you live, you can ask to see the data we hold about you, correct it, delete it, receive a copy in a common format, or object to or limit how we use it. Write to support@crowdboard.app and we'll answer within 30 days. You can also complain to your local data protection authority; in Kenya, that's the Office of the Data Protection Commissioner.

Children

Host accounts are for people aged 16 and over. Players can be any age, since a game needs only a display name; hosts running games for children should ask them to use a first name or nickname.

Security

All traffic is encrypted, sign-in codes are stored only as hashes, and each team can reach only its own data. If a breach puts your data at risk, we'll tell you and the authorities as the law requires.

Changes

If we change this notice in a way that matters, we'll tell account holders by email or in the app before it applies.