# Privacy Policy

Effective and last updated: October 9, 2026

Your games work without an account and without optional analytics. This policy explains what stays on your device, what reaches our service providers, and how to exercise your choices.

## Who is responsible

YuArts Labs operates BoardShuffle and is responsible for the personal information described in this policy. Contact us at support@yuartslabs.com for privacy questions, requests, or concerns. This policy covers the BoardShuffle website, mobile app, public documentation, and MCP service. Third-party sites and agent services have their own policies.

## Boards and information on your device

Interactive board generation runs on your device. Where supported, BoardShuffle remembers your last setup and stores boards you choose to save, including a board name, setup code, and save time. The web app uses browser local storage; the mobile app uses local app storage. These records are not uploaded to a BoardShuffle account or cloud database. Your operating system or browser may separately back up device data.

Saved boards remain until you remove them, clear site/app data, or uninstall the app, subject to your device’s backup behavior. Removing an individual saved board does not necessarily clear the separately remembered last setup. Clear BoardShuffle site data in your browser or app storage in your device settings to remove all local records. When enabled, Cloudflare Zaraz stores consent choices separately in a first-party cookie.

## Shared links and agent requests

A share link may contain a setup code in its URL. Anyone with that link can read or reproduce the setup. Opening it sends the URL, including its query string, to our hosting provider; links may also appear in browser history and in services you use to share them. Avoid adding personal information or secrets to board names, URLs, or settings. Some setups, such as Codenames key cards, contain information you should reveal only to the appropriate players.

MCP board generation runs on Cloudflare Workers. Your client sends the selected game, settings, player count, and any seed to that service. We process those inputs to generate a response; the generator does not create an account or save the board in a server database. Cloudflare may process request metadata and operational logs. Your agent provider or MCP client may independently retain tool calls and responses. Public documentation and discovery endpoints do not require credentials.

## Hosting, security, and Cloudflare analytics

Cloudflare delivers and protects the website and runs our server endpoints. It processes technical information needed to handle requests, which can include IP address, requested URL, browser and device information, timestamps, response status, and security signals. Cloudflare edge analytics can summarize requests without a browser analytics cookie. This essential service processing occurs when you use the website, even if you reject optional analytics.

We disable automatic Cloudflare Web Analytics browser-beacon injection in our responses. This is separate from Cloudflare’s essential delivery, security processing, and edge request analytics. Cloudflare may use necessary security cookies if a security feature or challenge requires them. See Cloudflare’s Privacy Policy for its processing practices.

## Optional Google Analytics through Cloudflare Zaraz

When optional analytics is enabled, Cloudflare Zaraz manages Google Analytics 4 (measurement ID G-QZ44SRY3MH) and provides its consent interface. Analytics tools must be assigned to the Analytics consent purpose and wait for your opt-in. Rejecting analytics leaves the games available. After you accept analytics, Zaraz forwards your originating IP address to Google for approximate location reporting. Google may also receive cookie or client identifiers, browser/device information, page views, and visit times. Google Analytics 4 states that it does not log or store individual IP addresses, although an IP address is used when a request is processed.

The app does not install separate Google Analytics or Google Tag Manager scripts or a tracking noscript iframe. Cloudflare Zaraz is the intended analytics delivery path when enabled. We use its analytics consent choices and keep Google advertising consent denied. Analytics cookie lifetimes and event-data retention depend on the published Zaraz and Google property settings. Locally saved board names and saved-board collections are not supplied to analytics by the app.

Google Analytics event data is subject to the retention settings of the Google Analytics property and Google’s processing terms. Aggregated reports may have different retention periods. Contact us for the applicable property settings or to request deletion where we can identify the data. The website’s optional Google tags are not installed in the native app.

## Planned advertising

We plan to display Google AdSense ads. No AdSense ad tags are active at present. The Advertising choice is a preparation option and does not currently start advertising or personalized-ad processing. When ads launch, we will update this policy, identify the active advertising practices and providers, and request a new consent decision. Declining optional purposes will leave the game generators available.

## Consent, withdrawal, and browser privacy signals

When optional analytics is enabled, we use an opt-in approach worldwide through Cloudflare Zaraz Consent Management. Ignoring a consent prompt is not consent. The games do not require analytics acceptance. Use Cookie settings in this Privacy Policy to review your choice. Zaraz stores the choice for its configured consent-cookie lifetime; a changed purpose or expired choice may require another decision. Choices apply to the browser and device where they are made.

Withdrawing all optional consent through the Zaraz interface reloads the page to discard running optional code and removes accessible legacy Google analytics cookies belonging to this site. It does not undo earlier processing or automatically delete records already held by providers. Global Privacy Control and a Do Not Track value of 1 prevent the app from loading its optional Zaraz integration. Turn off the browser signal if you later wish to review analytics choices. If the consent service is disabled or cannot load, the app does not substitute direct Google tracking.

## Other information, purposes, and legal bases

If you contact support, we receive the email address, message, and any information you choose to include. We use it to answer requests, troubleshoot issues, and maintain necessary records. We do not request payment information, account passwords, precise location, or sensitive personal information for board generation.

Where data-protection law requires a legal basis, we rely on consent for optional analytics; our legitimate interests in delivering a reliable, secure service and responding to support for operational processing; and compliance with legal obligations where required. Processing to fulfill a requested service may also be necessary for that service. You may object to processing based on legitimate interests, subject to applicable exceptions.

## Recipients and international processing

Information may be processed by Cloudflare, Google when you opt in, and the email provider used to handle your support request. We may disclose information where required by law, to address abuse or protect rights and security, or as part of a business transfer with appropriate safeguards and notice where required. We do not sell personal information or use it for cross-context behavioral advertising.

Providers operate internationally, including in the United States, and data may be processed outside your country. Where legally required, international transfers must use an appropriate legal mechanism, such as an applicable adequacy decision or standard contractual clauses. Contact us for information about safeguards applicable to a specific transfer. Provider privacy policies describe their processing and international-transfer arrangements.

## Retention and security

Local board storage is controlled by you as described above. We keep support correspondence only as long as needed to resolve the request, maintain relevant service records, and meet legal obligations. Hosting and security records are subject to Cloudflare’s applicable service retention; analytics records are subject to Google’s applicable property and service retention. We do not maintain a separate server database of saved boards. Contact us for details about a particular record or provider retention period.

We use HTTPS and reasonable technical and organizational measures to protect information. No service or device storage is completely secure. Avoid sharing sensitive information in public board links or support messages.

## Your rights

Depending on your location and applicable law, you may request access to, correction of, deletion of, or a copy of your personal information; restrict or object to processing; withdraw consent; and complain to your local data-protection authority. Some laws also provide rights to opt out of sale, sharing, targeted advertising, or certain profiling, and to appeal a refused request. We do not sell data, run targeted advertising, or make decisions about you with legal or similarly significant effects.

Email support@yuartslabs.com to make a request or appeal. Tell us which service and data your request concerns; please do not send identity documents unless we explain why they are necessary. We may need proportionate verification and will respond within the time required by applicable law. Authorized representatives may contact us with evidence of their authority. We will not penalize you for exercising privacy rights. Local-only boards can be deleted directly on your device; we cannot retrieve them remotely.

## Children and policy updates

BoardShuffle is a general-audience board-game companion. We do not knowingly collect personal information from children under 13, or under a higher age where applicable law requires parental consent, through optional analytics. Children should use the service with a parent or guardian and leave optional analytics off unless valid consent is available. Contact us if you believe a child’s personal information has been provided so we can investigate and address it.

We may update this policy as the service changes. The date above identifies this version. Material changes will be communicated through the service where appropriate, and a change in optional tracking purposes will require a new consent choice. Questions or complaints can always be sent to support@yuartslabs.com.

## Necessary storage

When Cloudflare Zaraz Consent Management is enabled, its first-party consent cookie (normally cf_consent; its name can be configured) records granted and refused purposes. Its lifetime is set by the consent provider configuration. This record is used to honor your choice. The app does not migrate an older custom-banner acceptance into Zaraz consent.

Saved-board storage uses bs:saved:<game> and bs:last:<game> through the app’s storage library (the web implementation may prefix these keys). It remembers setups as part of the service you request and persists until you remove it or your device clears it. Rejecting analytics does not delete your saved games. Cloudflare may also set necessary security cookies when a protection or challenge is used, such as cf_clearance or __cf_bm if the corresponding feature is enabled. Their presence and lifetime depend on that security feature.

## Optional analytics cookies

When enabled and accepted, Google Analytics through Zaraz may use first-party analytics cookies or storage identifiers to distinguish visits and maintain session information. Their exact names and lifetimes depend on the tool configuration. Older direct Google tags may have set _ga and _ga_QZ44SRY3MH; the app removes accessible legacy Google cookies when analytics is disabled or fully withdrawn. Cookie lifetime is separate from Google’s server-side data retention.

The app does not load a separate Google tag, Google Tag Manager container, or tracking noscript iframe. Zaraz is the intended consent and analytics provider when enabled. Automatic Cloudflare Web Analytics browser injection is disabled. Cloudflare still handles network requests and essential edge analytics as described in our Privacy Policy.

## Changing your choice

Use the Cloudflare Zaraz consent interface to accept or reject the Analytics purpose when available. You can reopen it with Cookie settings in this Privacy Policy. If optional analytics is disabled, blocked by your browser’s privacy signal, or cannot load, Cookie settings explains that status. You can still use the games. Withdrawing all optional consent reloads the page to discard running optional code; previously collected records are not erased automatically. Contact support@yuartslabs.com about privacy rights.

Global Privacy Control or a Do Not Track value of 1 prevents the app from loading its optional Zaraz integration. Consent applies to this browser, not every device you use. Zaraz determines when to request renewed consent based on its published configuration. With JavaScript disabled, the app’s optional analytics integration does not load.

You can also manage cookies and local storage in your browser’s site-data settings. Clearing all BoardShuffle site data removes local saved boards and resets consent. The native mobile app does not install these Google web tags; its saved boards use device storage.

- [Cloudflare Privacy Policy](https://www.cloudflare.com/privacypolicy/)
- [Google Privacy Policy](https://policies.google.com/privacy)
- [How Google uses information from partner sites](https://policies.google.com/technologies/partner-sites)
- [Google Analytics data retention](https://support.google.com/analytics/answer/7667196)

Contact: support@yuartslabs.com