Privacy Policy · FaB Tabletop

1. What we collect

1.1 Your account

When you register we store your email address, the username you choose, a hashed version of your password (we never store the password itself), whether you have confirmed your email address, and — if you set one — your preferred game language. We also keep the sign-in tokens for your active sessions so you can be logged out everywhere when you change your password.

You do not need an account to browse the site or to play a game someone has shared with you. Anonymous visitors are given a random identifier stored in the site's own cookie, which exists only so your browser and your phone can find each other during a game.

1.2 Games

Creating or joining a game stores the game's title, format, language, the hero you selected, the decklist link you optionally provide, who is playing, whether the game is private or competitive, and the times people joined and left. While a game is running, your board trackers — life total, damage on the chain, effects, counters and proxy tokens — are held in memory and saved periodically so that a refresh, a dropped connection or a server restart does not wipe your board.

1.3 Tournaments

Registering for a tournament stores your entry, the decklist URL you submit, your check-in time, your pairings and your reported and confirmed results. Standings, pairings and results are visible to everyone who can see the tournament.

1.4 Card scanning

Clicking a card on your opponent's board runs the whole recognition pipeline inside your browser. The captured frame never leaves your device; only a short numeric fingerprint of the card image is sent to the server so it can be looked up in the card database. We do not keep those fingerprints.

1.5 Technical logs

Like any website, our servers and our hosting provider record ordinary request logs — IP address, timestamp, page requested, browser user agent, and any errors. These are used to keep the service running and to investigate abuse and outages, and are kept only for a short time.

1.6 What we do not collect

No recordings, screenshots or transcripts of your video or audio.
No analytics, advertising, or third-party tracking cookies.
No payment details — support through Patreon happens entirely on Patreon's own site, and we never see your card details.
No location data, contacts, or anything else from your device.

2. Video and audio

This is the part most people care about, so it is worth being precise.

Your camera and microphone are only switched on after your browser asks you for permission, and you can turn either off at any time from the in-game top bar.
Video and audio travel directly between you and your opponent wherever the network allows it, encrypted end to end by WebRTC. Our server passes the connection-setup messages between you, but the media itself does not route through it.
Establishing that direct connection uses public STUN servers, which see the IP addresses involved but none of the media. If a direct connection cannot be made, a relay server may forward the encrypted stream; it cannot read the contents.
Nothing is recorded. We do not store, capture or process your stream anywhere on the server, and there is no recording feature in the app.
Using your phone as a camera works the same way — the phone connects to your own desktop browser, and the video does not pass through us.

What we cannot control is the person on the other end. Your opponent sees your play area live and could record it with software outside this site. Recording someone without their consent is against our Code of Conduct and can be reported, but treat anything in frame as visible: point the camera at your playmat, not at your room.

3. Cookies and local storage

We use one cookie, and it is strictly necessary for the site to work — there is no advertising or analytics cookie to consent to.

What	Where	Why
Session cookie	Cookie	Keeps you signed in, protects forms against cross-site request forgery, and holds the random id anonymous players need to connect their phone camera.
Theme	Local storage	Remembers whether you picked light, dark, or your system setting.
Camera zoom & rotation	Local storage	Remembers your framing so you only set up your camera once.
Sound & view preferences	Local storage	Remembers effect and opponent volume, and whether you flip your opponent's view.

Local storage never leaves your browser. Clearing your browser data resets all of it, and you will simply be asked to set your camera up again.

4. How we use it, and who else sees it

4.1 How we use it

Only to run the site: to sign you in, put you in a game with the right opponent, keep your board state in sync, run tournaments, send the handful of emails described below, and keep the service secure and working. We do not sell your data, and we do not use it for advertising or profiling.

The only emails we send are transactional: confirming your address, resetting your password, and confirming changes to your account. There is no marketing mail.

4.2 What other players can see

Your username is public wherever you appear — the lobby, a game, tournament pairings, standings and recent-winners lists. So are the game title, format, language, hero and decklist link you choose to publish, and your tournament results. Your email address is never shown to other players.

4.3 Service providers

We keep the list of third parties as short as we can. Each one only receives what it needs to do its job:

Hosting and database — our application server and Postgres database are hosted by Fly.io.
Email delivery — account and password emails are delivered by MailerSend, which receives your email address and the message.
Connection setup — public STUN servers operated by Google are used to negotiate the direct video connection. They see IP addresses, not media.
Fonts — page fonts are loaded from Google Fonts, which sees the request your browser makes for them.

Links out to Fabrary decklists, Discord, Patreon and GitHub are just links: following one takes you to that site, under its own privacy policy.

4.4 Legal requests

We will disclose information if we are legally required to, or where it is necessary to investigate abuse or protect the safety of players.

5. Retention, your choices, and security

5.1 How long we keep things

Account details: until you ask us to delete your account.
Game and tournament records: kept as part of the site's history, so that standings and past results stay meaningful.
Live board state: discarded when the game ends or the session is reset.
Sign-in tokens: expire on their own, and are deleted when you log out.
Server logs: a short period, then rotated away.

5.2 Your choices

You can change your email address, username, password and language at any time from your account settings. You can decline camera and microphone permission — the rest of the site still works — and clearing your browser data removes everything stored locally.

Get in touch and we will help you with anything else: a copy of the data we hold about you, a correction, or deletion of your account. When an account is deleted, we remove your account details; where a game or tournament result has to stay for the sake of other players' records, your name is removed from it.

5.3 Security

Passwords are stored only as salted hashes. Traffic is served over HTTPS, video is encrypted by WebRTC, and sign-in tokens can be invalidated across all your devices by changing your password. No service can promise perfect security, but we will tell affected players if something goes meaningfully wrong.

5.4 Children

FaB Tabletop is not directed at children under 13, and we do not knowingly collect their information. If you believe a child has given us personal information, contact us and we will remove it.

5.5 Changes to this policy

If this policy changes we will update the date at the top of the page, and announce anything significant on Discord.