Ultiboard

1. Information We Collect

Ultiboard collects the following information to provide and improve the Service:

Account information: email address, display name, and authentication credentials when you create an account.
Strategy content: the strategies, step diagrams, player positions, movements, sticky notes, and annotations you create.
Usage data: analytics events such as page views, strategy creation, duplication, publishing, sharing, playback, and onboarding completion, sent via Vercel Analytics. Your internal account ID (not your email or name) is attached to events when you are signed in.
Authentication data: if you sign in with Google, we receive your name and email address from Google. We do not receive your Google password.

2. How We Use Your Information

To provide, maintain, and improve the Service.
To authenticate your identity and manage your account.
To send essential account-related communications.
To display your public strategies in the gallery when you choose to publish them.
To protect the security and integrity of the Service.

3. Data Sharing and Disclosure

We do not sell your personal information. We may share data:

With service providers who help us operate the Service (such as Vercel for hosting, Resend for email delivery, and Google for OAuth authentication).
When you choose to publish a strategy to the public gallery, that strategy and your display name are visible to all users.
If required by law or to protect our legal rights.

4. Data Storage and Security

Your data is stored on servers provided by Vercel and in a PostgreSQL database. We use industry-standard security practices including encryption in transit (HTTPS), password hashing (bcrypt), and database-level access controls. No method of electronic storage is completely secure, and we cannot guarantee absolute security.

5. Cookies

We use essential cookies to maintain your session and keep you signed in. These session cookies are necessary for the Service to function and do not track you across other websites. We also use a first-party analytics cookie (ultiboard_utm, 30-day expiry) to store marketing attribution parameters (source, medium, campaign) from referral links. This cookie does not contain personal information and is not shared with third parties. We do not use third-party advertising or tracking cookies.

6. Your Rights

You have the right to access, correct, or delete your personal data. You can update your display name through your account settings. To request data deletion or export, contact us at the email below. If you signed up through Google, you can manage Ultiboard's access in your Google Account settings.

7. Data Retention

We retain your account information and strategies for as long as your account is active. If you request account deletion, we will delete your personal data within 30 days. Some strategy data shared publicly may remain in cached or archived form.

8. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the new policy on this page and updating the date above.

9. Contact

For questions about this Privacy Policy or to exercise your data rights, contact us at support@ultiboard.app.