Pre-release privacy notice

Privacy at TableTopFit

TableTopFit uses the information you provide to maintain your game library, personalize fit recommendations, and support the people and groups you choose to connect with.

Information stored

• Account identity, profile visibility, recommendation preferences, and optional beta-contact choices.
• Collection, shelf, import, Cart Check, friendship, group, Game Night, and feedback-board records.
• Optional quick beta responses containing only the feature name and whether it helped; pasted carts, collections, and event details are not included in these responses.
• For signed-in members, feature-page visits, approximate device class, and recent activity timestamps used to understand feature adoption and provide operational support. TableTopFit does not store page contents, pasted text, URL parameters, or raw browser identifiers with these visits.
• Basic operational logs needed to secure, diagnose, and monitor the service.

Storage and service providers

Signed-in application data is stored in Supabase. Vercel hosts the application, Resend delivers account email, Cloudflare protects sign-in, and Sentry receives privacy-scrubbed error diagnostics. Catalog requests may use BoardGameGeek identifiers and public game data. TableTopFit does not sell personal information.

Your choices

• Choose whether your profile is private, friend-visible, or discoverable.
• Choose whether TableTopFit may contact you for beta research or focused testing requests.
• Preview external collection changes before anything is written.
• Download a JSON copy of your saved data from Account settings.
• Permanently delete your account and account-owned records from Account settings.
• Unsigned demo data stays only in that browser's local storage and can be reset locally.

Security and retention

Row-level security limits private records to authorized accounts and shared-room participants. Account-owned records remain until you remove them or delete the account. Page-activity records are associated with your account, included in your data export, removed when your account is deleted, and intended for a rolling 90-day operational window. Other operational records are retained only as needed for security, troubleshooting, and legal obligations.

This pre-release notice still requires final legal-entity, contact, jurisdiction, and retention details before general public launch.