Privacy Policy

Last updated May 16, 2026

ISO (“ISO,” “we,” “our”) is a board game collection tracker and personalized recommendation engine. This policy explains what data we collect, how we use it, who we share it with, and the choices you have. Using ISO means you agree to the practices described below.

Information we collect

We collect only the information needed to run the app:

Account data. Your email address and a password handled by our authentication provider (Supabase). We never see or store your password in plaintext.
Game library. Games you mark as owned, wishlisted, previously owned, or played, plus any notes or ratings you add.
Play logs. Sessions you record — date, players, scores, and any notes you choose to include.
Taste profile. Preferences captured during onboarding (preferred mechanics, complexity range, typical player counts) plus signals derived from your play history.
Device storage.A copy of your library and pending changes is cached in your browser’s IndexedDB so the app works offline; this syncs back when you reconnect.
Basic technical data. Standard server logs (IP address, user agent, request paths, timestamps) generated by our hosting provider, used to operate and secure the service.

How we use your information

To authenticate you and keep your account secure.
To compute personalized recommendations from your profile and play history.
To sync your library across devices and support offline use.
To operate, debug, and improve the service.
To contact you about your account or material changes to this policy.

We do not sell your personal information, and we do not use your data to train third-party AI models.

Third-party services

We rely on a small number of vendors to run the app:

Supabase — authentication and database hosting.
Vercel — application hosting and edge delivery.
BoardGameGeek (BGG) — public game catalog data. BGG requests are made server-side; BGG does not receive your account identity.
Amazon Associates and Miniature Market— affiliate programs. When you click a “Buy” link, you leave ISO and that retailer’s own privacy policy applies. We may earn a commission on qualifying purchases. Every affiliate link is direct (no cloaking) and the affiliate tag is visible in the URL.
PostHog— product analytics (US region). We capture anonymised usage events; no tracking cookies are used. See the “Analytics and product telemetry” section below for the full list of events captured and how to request deletion.

Analytics and product telemetry

To understand how ISO is used and improve recommendations, we collect a small set of usage events using PostHog (posthog.com), a product analytics service hosted in the United States.

What we capture:

rec_click — when you tap a recommendation card.
rec_refresh — when you refresh your “For you” feed.
affiliate_click — when you tap a “Where to buy” link.
share_click — when you share a play log.
install_prompt_shown — when the “Install ISO” entry is opened.
install_prompt_accepted — when you accept or dismiss the install prompt.

Each event includes your account identifier (user ID), the app version, and platform (web or installed PWA). Anonymous visitors receive a temporary in-memory identifier that is discarded when you close the tab. We do not record session replays, heatmaps, or page interactions beyond the events listed above.

No cookies are used for analytics. Events are sent over HTTPS to PostHog’s US-region servers. PostHog’s privacy policy is available at posthog.com/privacy.

To request deletion of your analytics data, email jamiesmith413@gmail.com with the subject “Analytics data deletion”. We will relay the request to PostHog within 30 days.

Cookies and local storage

We use first-party cookies to keep you signed in and a small amount of browser local storage and IndexedDB to cache your library for offline use. We do not use third-party advertising or tracking cookies, and our analytics (PostHog) operates in cookieless mode.

Data retention and deletion

We keep your account data for as long as your account is active. You can delete individual play logs and collection entries at any time from inside the app. To delete your entire account and associated data, email jamiesmith413@gmail.com from the address on your account. We will action verified requests within 30 days. Backups may retain data for a short additional period before they roll over.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete the personal data we hold about you, and to object to or restrict certain processing. Contact us at jamiesmith413@gmail.com to exercise any of these rights.

Security

Data in transit is encrypted with TLS. Account data at rest is stored by Supabase with their standard encryption and access controls. No system is perfectly secure; you are responsible for keeping your password and devices safe.

Children

ISO is not directed to children under 13, and we do not knowingly collect personal information from anyone under 13. If you believe a child has provided us information, contact us and we will delete it.

Changes to this policy

We may update this policy as the app evolves. The “Last updated” date at the top reflects the current version. Material changes will be highlighted in the app or by email.

Contact

Questions or requests? Email jamiesmith413@gmail.com.