Privacy Policy

LiveBoard is an independent project run by one developer, known online as mlziade. Under the LGPD in Brazil and the GDPR for visitors in Europe, that developer is the controller of the data described on this page.

There is no separate data protection officer. Questions, requests and complaints about your data go to [email protected], or through the report form.

What we hold depends on how you use LiveBoard.

• Guest ID. A random identifier your browser creates on your first visit and keeps in local storage. It lets us recognise the same browser as the owner of a room and enforce a kick. It isn't linked to your name.
• Nickname. A random one such as "Bold Striker", which you can change. Everyone in your room can see it.
• Google account data. Only if you sign in: your Google account identifier, email address, name and a link to your profile picture. Name and picture are refreshed each time you sign in. We ask Google for nothing else, so no contacts, calendar, Drive or Gmail.
• Rooms and guesses. The room ID, its display name, the championship, your score guesses, who created the room, and a salted hash of the room password if it has one. We never store a room password in readable form.
• Room history. For signed-in users, a list of the rooms you entered with your first and last join times, used for your room history page.
• Live activity. While you are in a room, your nickname, an assigned colour, the tab you are on, your pointer position and the score field you are editing go to the other people in that room. The home page works the same way for other visitors on the home page: your nickname, colour and pointer are visible to them unless you switch live presence off there. We keep this live data in memory while you are connected and never write it to our database.
• Visit records. When your browser asks our servers for championships, games or rooms, we record your IP address, browser user agent, your guest ID or user ID, the time, and a page-view count. Requests within 15 minutes of each other count as one visit.
• Security data. Your IP address is also used, briefly, to rate-limit requests and to cap how many live connections one address can open.
• Reports. What you type into the report form: the problem type, an optional championship, the title and description, your name or nickname, and your email address. We also keep the date and the language of the page. If you were signed in, the report is linked to your account. Only the developer reads reports. They are never shown to other users.

We don't ask for your phone number, postal address or date of birth, and LiveBoard doesn't process payments. Tips go through your own bank app using Pix, and the developer's bank statement may show the sender's name. Like any web server, ours may also keep standard access logs.

LiveBoard uses only what it needs to work. There are no advertising or analytics cookies, no ad scripts and no fingerprinting. Everything below is strictly necessary for something you asked for, so we don't show a cookie banner.

• st_session cookie. Keeps you signed in. It lasts up to 24 hours or until you log out.
• Room cookies, whose names start with rt_ and end with the room ID. They let you back into a password-protected room without typing the password again. They last up to 12 hours.
• Local storage. Your guest ID, your nickname, and two display settings: how other people's pointers are shown and whether home page live presence is on. It stays until you clear site data.

To offer the Sign in with Google button, every page loads a script from Google. When it loads, Google can see your IP address and browser details, under Google's privacy policy. Fonts and club crests come from our own domain.

You can delete cookies and local storage in your browser at any time. The site keeps working, but you get a new guest ID, so you lose ownership of rooms you created as a guest.

We use your data for four things, each with a legal basis.

• Running LiveBoard. We identify you, host rooms, save guesses, keep tables in sync and answer the reports you send. Basis: providing the service you asked for (LGPD art. 7, V; GDPR art. 6(1)(b)).
• Keeping it safe and fair. We rate-limit requests, enforce kicks, filter offensive names and investigate abuse. Basis: our legitimate interest (LGPD art. 7, IX; GDPR art. 6(1)(f)).
• Counting usage. We estimate how many people visit so we can size the hosting. Basis: legitimate interest.
• Obeying the law. For example, we answer a valid court order or a request about your own data. Basis: legal obligation (LGPD art. 7, II; GDPR art. 6(1)(c)).

We don't use your data for advertising or marketing profiles, and nothing here is an automated decision with legal effects on you. Name filtering is automatic, but it only decides whether a nickname or room name is accepted.

Google user data (your account ID, email, name and picture) is used only to sign you in and show your profile inside LiveBoard. We don't sell it or share it for advertising. Only the developer can access it, for support, security or legal reasons. We handle it in line with the Google API Services User Data Policy.

We don't sell or rent personal data. It reaches these parties:

• People in your room. Your nickname, colour, current tab, pointer position and guesses. Anyone with the room link, and the password if there is one, can join and see them. Your Google name and picture are never shown to the room.
• Google, when you use Sign in with Google, as described above.
• Our hosting provider, which runs the server LiveBoard sits on and processes data only on our behalf.
• Authorities, when the law or a valid court order requires it.

Our hosting provider and Google may process data in countries other than yours. Where the law requires safeguards for such transfers, we rely on the contractual clauses those providers offer.

Different data lives for different times:

• Session and room cookies. 24 hours and 12 hours.
• Kick bans. 7 days.
• Rooms. We archive a room after 90 days without activity. An archived room can't be opened any more, but its record, guesses included, stays in our database until you ask us to delete it.
• Account data. Until you ask us to delete your account.
• Visit records. We keep them for security and usage statistics. No automatic deletion exists yet, so they stay until we remove them, which we do on request.
• Reports. We keep a report while we work on it. No automatic deletion exists yet, so a closed report stays until we remove it, which we do on request.

Under Brazil's LGPD, the GDPR in the EU and UK, and similar laws, you can ask us to:

• confirm whether we process your data, and give you a copy;
• correct data that is wrong or out of date;
• delete your data, or anonymise or block data that is unnecessary or excessive;
• export your data to another service;
• restrict processing, or object to processing that rests on our legitimate interest;
• tell you who your data has been shared with;
• withdraw any consent you gave, which doesn't affect what happened before.

Use the report form and pick "Delete all my data" or "Other request about my data", or email [email protected]. So we can find your data, sign in before you send the form, or write from the address linked to your Google account. For guest data, include your guest ID. You can find it in your browser's developer tools, under local storage, key simulador-tabela:guestId. We answer within 15 days, free of charge.

There is no delete-account button yet, so deletion happens through the report form or by email. Meanwhile you can change your nickname at any time, log out to end your session, change or remove a room password if you own the room, and clear your browser's site data.

If you are unhappy with our answer, you can complain to Brazil's data protection authority, the ANPD, or to the data protection authority in your own country.

LiveBoard uses HTTPS. We store room passwords as salted scrypt hashes. Session and room tokens are signed and expire, logging out ends your session, and we rate-limit requests. No system is perfectly secure. If a breach puts your data at risk, we will tell you and the ANPD, as the law requires.

LiveBoard isn't meant for children under 13, and we don't knowingly collect their data. If you are a parent or guardian and think a child has given us data, email us and we will delete it.

When this policy changes, we update the date at the top of the page. If the change matters, such as a new kind of data or a new third party, we will also post a notice on the site before it takes effect.

Use the report form for anything about your data, or email [email protected]. The contact page lists other ways to reach us.

The rules for using the site are in the Terms of Service.