Privacy policy
Effective September 14, 2026
Tabletop Pal is operated by Tayden Flitcroft. This policy covers the mobile app and website. No account is required, and you can use a nickname instead of your real name.
On your device
The app saves your default player name and color, joined games, game-access credentials, scorecard copies, drafts, last-played dates, preferences, and game-tool history on your device or in this browser. Changing your default profile does not change existing games. Game tools run locally; their inputs and results are not sent to the game server. The mobile app uses OS-protected storage for game-access credentials; the website uses browser storage. Clearing browser data or resetting the app removes local access to your games.
Shared games
When you create or join a game, the server receives your chosen player name and color, game and player identifiers, and game-access credentials. It stores table names, players, team assignments, host roles, scores, rounds, timestamps, join requests, and game events so participants can share a scorecard in real time. Other participants can see game information, including your in-game name, color, and scores. Hosts can manage players and edit scores. Anyone with an invitation can request access, so share invitations only with people you intend to invite.
Camera and photo scanning
Camera access is optional. QR codes are read on your device. When you choose to scan game pieces, the app sends the photo or cropped images to the Tabletop Pal server and its privately hosted Ollama vision model to recognize values. We do not use scan images to train models, sell them, or send them to a public generative-AI service. The game API processes images in memory and does not save them to the game database or a photo library. Temporary app image files are cleared when you retake or close the scanner; files left by an interrupted session may remain in the device cache until cleared. Only the scores and game details you save become shared game records. Avoid including people, documents, or other private information in scan photos. You can enter scores manually instead.
Notifications
If you enable notifications, we register an Expo push token associated with your game membership. Expo and Apple or Google process the token and notification content to deliver game alerts, which may include player names and score or join-request details. Notifications can appear on your lock screen according to your device settings. You can revoke camera or notification permission in the device settings at any time.
Service providers
Supabase hosts the game database. Expo and the platform push services deliver notifications. Flagsmith supplies server-side feature settings; the app does not send player identities to Flagsmith, and flag analytics are disabled. Hosting and network providers process connections needed to deliver the service, including IP addresses and request metadata, and may maintain operational or security logs. These providers process information to operate, secure, and deliver the service. We require providers handling personal information on our behalf to protect it consistently with this policy. Links to game rules open external websites, whose own privacy policies apply.
Advertising and tracking
Tabletop Pal does not sell personal information, show targeted advertising, or use advertising identifiers or cross-app tracking. The current app does not include behavioral analytics. We use information to provide game features, maintain security, prevent abuse, and respond to support or privacy requests.
Retention
Shared games expire 90 days after creation by default. The period can be configured for new games; the retention notice in each game shows its applicable period. Expired games become inaccessible and are removed by scheduled cleanup, along with related membership, invitation, and notification-registration records. Ending or leaving a game does not by itself delete its shared scorecard. Pending notification-delivery jobs are removed after delivery or within 24 hours by cleanup. Local copies remain until you leave the game, clear browser storage, or reset the app. Infrastructure logs and backups, if enabled, may outlast the live record and are removed according to the hosting systems’ rotation schedules rather than immediately.
Your choices and deletion
Use Settings to edit your default profile or reset this device’s app data. Tap your player name in a game to edit your name or color for that game. Leaving removes your access but can leave your scores visible to the other participants. A host can remove a player and choose to delete their score entries. Resetting the app clears local data and attempts to unregister push notifications, but does not delete shared server records. For access, correction, or deletion of server-side information, contact us before resetting when possible and identify the table and your player name. Do not send game-access tokens or private invitation links by email. Because there are no accounts, we may need additional information to verify that a request relates to your data. Depending on where you live, you may also have rights to object to processing, restrict processing, or complain to a privacy regulator.
Security
The public service uses HTTPS. Access to games is controlled by membership credentials, and host actions are checked on the server. No system can guarantee absolute security. Information may be processed in countries where our hosting and service providers operate.
Children
Tabletop Pal is a general-audience game utility. We do not knowingly collect personal information from children under 13. If you believe a child has provided personal information, contact us to request its removal.
Policy changes
We will update this page and its effective date when our privacy practices change. Material changes that require new permission will be presented before the relevant processing begins.
Contact
For privacy questions or requests, contact Tayden Flitcroft: contact@taydenflitcroft.com