Privacy Policy

LAST UPDATED 15 OCTOBER 2026

The house keeps a book. This page says what goes in it, why, who else gets to read it, and how you get your page back out.

1. What we collect

When you talk to Boardman in a chat app

• Telegram: your Telegram user id, username, display name and the chat id we reply to. Telegram does not give us your phone number.
• WhatsApp: your WhatsApp phone number, your WhatsApp profile name, and the user id Meta sends with your messages. We derive a country from the phone number's calling code.
• The messages, button taps and photos you send the bot, the replies we send, and when you last wrote to us (WhatsApp only lets us message you freely for 24 hours after you write).
• Whether you agreed to receive match and wallet notices, and when you sent STOP or START.
• Which chat accounts you linked to one Boardman profile, and the one-time codes used to link them.

Your Boardman profile

• Your Boardman tag, display name and short bio; game ids you add (for example PlayStation or Xbox ids); a backup email if you give one.
• Your record: wins, losses, draws, streaks, reputation and tier. Your tag and record appear on the public leaderboard and on public challenges.
• A transaction password if you set one. We store only a hash of it, never the password itself.

Wallets and money

• Your play wallet. We create a USDC wallet for you through Circle's developer-controlled wallet service. We keep its wallet id and address, and we hold its keys on your behalf, so in substance we look after the funds in it.
• External wallet addresses you sign in with, deposit from, withdraw to, or fund through on Arc, Avalanche or Stellar.
• Your transaction history and our ledger: deposits, top-ups, stakes locked, payouts, refunds, spectator tickets, marketplace purchases, sends, withdrawals, fees, the on-chain transaction hashes, and our audit records of each credit and debit.
• For Naira top-ups: the Paystack reference, amount, status and the email used, or the bank-transfer proof you upload. We never see your card number.

Matches and evidence

• Challenges you create or accept, the game, your opponent, stakes, scores you report and the in-game names you give.
• Screenshots or photos of results, which we read with automated and AI checks. Photos sent on WhatsApp are copied into our private storage with their photo metadata removed; for photos sent on Telegram we keep Telegram's reference to the file.
• Dispute notes and the decisions our reviewers make.

On the website

• Your IP address, read by our hosting edge to work out your country. We use the country to keep Boardman closed in restricted places; our geo-fence logs keep the country, not the IP address.
• Ordinary server logs: time, page or API route, browser type and errors.
• The details Telegram's login button shares when you sign in with it (id, name, username).
• Anything you type into the contact or waitlist form, such as your email and note.

Builders

If you build on the Stack API we keep your API key record, webhook URL, your agents, and the moves and results of every match they play.

What we do not collect

We do not run advertising or third-party analytics trackers, and we do not sell or rent personal data. We do not ask for identity documents today; if we start verifying identity for larger amounts we will update this page first.

2. Cookies and storage on your device

• rematch_session keeps you signed in. It is signed, HttpOnly, lasts 7 days from your last visit, and expires after 30 days at most.
• rematch_wallet_nonce protects wallet sign-in. It lasts 10 minutes.
• Your browser's local storage remembers small things like a dismissed “add to home screen” notice or a spectator ticket you are watching.

These are all strictly necessary for the service. There are no advertising cookies.

3. Why we use it

• To run the table: open your account and wallet, take your stake, settle matches, pay winners, process top-ups and withdrawals, and talk to you in the chat you chose. This is needed to perform our agreement with you.
• To keep games fair and money safe: check results, resolve disputes, stop fraud, collusion and multiple accounts, and secure our systems. This is our legitimate interest, and yours.
• To follow the law: keep Boardman closed in restricted countries, keep financial and anti-money-laundering records, answer lawful requests and meet tax duties.
• To send notices you agreed to: match and wallet updates on WhatsApp or Telegram. Send STOP on WhatsApp, or block the Telegram bot, to turn them off. We do not send marketing messages without separate consent.
• To improve Boardman: fix bugs and understand which features get used, from our own logs.

4. Who else sees it

We share personal data only with the service providers that run Boardman for us, under contracts that limit what they may do with it:

We also share data:

• with your opponent, as far as a match needs it (your tag, the score you reported and, in a dispute, the evidence);
• with the public, through the leaderboard, public challenges and the arena;
• with authorities, courts or advisers when the law requires it or to protect users and the platform;
• with a buyer or successor if the business changes hands, under this policy.

Blockchains are public. Wallet addresses, amounts and transactions on Arc, Avalanche and Stellar are visible to anyone, forever. Telegram and Meta also handle your messages under their own privacy policies.

5. How long we keep it

• Account, profile and chat identities: while your account is open. When you close it or ask us to delete it, we delete them within 30 days.
• Transaction, ledger and audit records: for as long as financial, tax and anti-money-laundering law requires, generally at least five years after the transaction or after your account closes.
• Match evidence: while the match can be disputed or reviewed for fraud, and no longer than 12 months after the match.
• Server logs: up to 90 days, unless we need them for a security investigation.
• Contact and waitlist messages: until we have answered and no longer than 24 months.

See how to delete your data for what a deletion removes and what it cannot.

6. Your rights

Depending on where you live, you can ask us to:

• give you a copy of your personal data, in a portable format where that applies;
• correct data that is wrong;
• delete your data, subject to the records the law makes us keep;
• restrict or object to how we use it, including any profiling for fraud checks;
• withdraw consent you gave, such as for WhatsApp notices, at any time.

Write to boardman@playingsidequest.fun from the email linked to your account, or tell us the Telegram username or WhatsApp number on it so we can confirm it is you in that chat. We answer within 30 days. You can also complain to your data protection authority; in Nigeria that is the Nigeria Data Protection Commission.

7. International transfers

Our providers run servers in several countries, including the United States and the European Union, so your data may be processed outside the country you live in. Where the law requires it, we rely on safeguards such as standard contractual clauses or the provider's own approved transfer mechanisms.

8. Security

Wallet keys sit with Circle under our controlled access, never in chat or on your phone. Sessions are signed and HttpOnly, data travels over encrypted connections, match evidence is never public, and staff access is limited to people who need it. No system is perfectly secure; if a breach puts your data at risk, we will tell you and the authorities as the law requires.

9. Over 18s only

Boardman is for adults: at least 18, or the age of majority where you live if higher. We do not knowingly collect data from children. If you think a child has an account, tell us and we will close it and delete the data.

10. Changes

We will post any change here and update the date at the top. If a change is significant, we will also tell you in the bot or on the site before it applies.

11. Contact

sideQuest (legal entity details available on request). Email boardman@playingsidequest.fun. Postal address available on request.