Data we collect
We store your email address, your username, and the drills and sessions you create. When you're signed in, we record which features you use, linked to your account: for example drawing, saving as an image, PDF or video, the paywall being shown, the drill pages you open, your language and your device type (mobile or desktop). When you're not signed in, we record the same events per visit. Our server works out the visit ID from your IP address and browser, and it changes every day. We don't store the IP address. Payment data is processed by Stripe.
Legal basis
We process your account data to provide the service (contract, GDPR Article 6(1)(b)). Usage analytics rests on our legitimate interest in improving the service and finding faults (Article 6(1)(f)). We count active users from sign-in sessions. We only send marketing emails if you've agreed to them.
How we use data
Data is used to provide the service, manage your account, and process subscriptions. We may email you to ask for feedback on the service. Answering is optional, and you can reply to say no to further requests.
Service providers
We use these providers: Supabase (database and sign-in, EU, Frankfurt), Stripe (payments), Vercel (hosting and cookieless visitor counts), OpenAI (the text sent to the Jürgen assistant, drill translation and the session generator), Resend (email), Sentry (error reports, EU, Frankfurt; a report can include your account ID, but not your name or email address) and Cloudflare Turnstile (bot check when you sign up with email). If you sign in with Google, Google passes us the name, email address and profile picture of your Google account. Vercel, Stripe, Resend, Sentry and Cloudflare transfer data outside the EU under the EU–US Data Privacy Framework, and their contracts also include the European Commission's standard contractual clauses. Supabase and OpenAI transfer data under the standard contractual clauses. OpenAI may also rely on a Commission adequacy decision.
Marketing emails
We only email you about new features and offers if you have agreed to it. You can give or withdraw consent any time from the account menu.
Data storage
Data is stored in Supabase within the EU (Frankfurt, Germany). Analytics events stay linked to your account or visit for 14 months. After that we remove the identifiers, and the events can no longer be tied to you or your visit. Payment data is stored by Stripe. Fonts are served from our own servers, so no third-party font service is used.
Your rights (GDPR)
Under the EU General Data Protection Regulation you can delete your account and all your data (Article 17) and download your data in a machine-readable format (Article 20). You can also object to usage analytics (Article 21) with the Usage analytics switch in the account menu, or by emailing support@tacticsboard.app. From then on we record no events linked to you, and your earlier analytics events are deleted the following night. In the browser you're signed in on, Vercel's cookieless page counts are switched off as well. Billing events are kept. If you've already declined analytics, that still stands. Deleting your account and downloading your data are in the account menu too. If you think we handle your data unlawfully, you can complain to a data protection authority.
Support access to your account
An administrator can sign in to your account to investigate a problem. They then have the same rights you have, including the right to change your content and your subscription. Every sign-in is logged.
Cookies and device storage
Analytics stores nothing on your device. Your browser keeps only what sign-in and settings need, such as your sign-in, language, theme and the notices you've closed. YouTube and Vimeo videos on drill pages, Stripe's payment page and Cloudflare's bot check load from those services' own servers, and they may store data on your device under their own terms.
Contact
For data protection inquiries, contact: support@tacticsboard.app
Updated 16 October 2026