Privacy Policy

Last updated: October 12, 2026

This policy explains what personal information the meepz mobile app and its servers (together, "meepz", "we", "us") collect, why, who we share it with, how long we keep it, and the choices and rights you have. It applies to everyone who uses meepz, including in the European Economic Area (EEA), the United Kingdom (UK) and Switzerland. meepz is operated by Link Software LLC, 999 Jacksonian Way, Lenoir City, TN 37772, USA, which is the controller of your personal information.

This policy is published at https://meepz.app/privacy. Your use of meepz is also governed by our Terms of Service at https://meepz.app/terms.

Questions or requests about your privacy, or anything else: support@meepz.app.

The short version

  • We collect what we need to run the app: your account, your profile, your game collection, the plays you log, and the photos you add.
  • We do not sell your personal information, we do not show ads, we use no advertising cookies or trackers, and we do not track you across other companies' apps or websites.
  • Marketing email is off unless you turn it on, and you can turn it off at any time in Settings.
  • You can export your data or delete your account at any time from inside the app.
  • Minimum age: 13, or 16 if you live in the EU/EEA.

Information we collect

Account and sign-in

You sign in with an email address and password, with Sign in with Apple, or with Google Sign-In. Sign-in is handled by Google Firebase Authentication, which stores your email address, a securely hashed password if you use one, and the identifier Apple or Google gives us. If you use Sign in with Apple and choose to hide your email, Firebase receives an Apple relay address instead. Our own database stores only the Firebase account identifier; we do not copy your email address into it.

Profile

Your display name, handle (username), bio, profile photo (avatar), the games you pin as favorites, and, if you link one, your BoardGameGeek username.

Collection and play history

  • Your game collection, including any notes and tags you add, and your favorites.
  • The plays you log: game, date and duration, players and seats, teams, scores and score changes, winners, expansions used, and play notes.
  • Guest players: when you add someone who doesn't use meepz to a play, we store the name you type for them. Please use a first name or nickname. You can rename or anonymize a guest at any time.
  • Photos you attach to a play.

Shelf-scan photos

If you use the experimental, AI-powered "import from a photo" feature, we store the photo of your shelf and the results: the game titles detected, where on the photo each one was found, the matches we suggest, which ones you accept, and any rating you give the result. See "Shelf-scan image processing" below.

Social activity

Friend requests and friendships, users you block, and reports you file about other users or content (including the reason and any details you write).

Notifications and devices

If you allow notifications, we store a push token for your device and its platform (iOS or Android), along with the in-app notifications we send you (for example, friend requests and play invitations) and whether you have read them.

Subscriptions

If you subscribe to meepz Pro, Apple or Google process the purchase and our billing provider RevenueCat manages the subscription. We receive your subscription status, plan, store, and renewal or expiry dates, linked to your meepz account ID. We also keep your free-trial dates and how many shelf scans you have used. We never receive your payment card details.

Feedback

If you answer an in-app feedback survey, we store your answers (for example, a 0–10 rating and any comments you write), linked to your account.

Marketing-email preference

Whether you have opted in to marketing email, and a history of each time you turned it on or off: when, where in the app (sign-up or Settings), the exact wording you saw, and your platform and app version. We keep this history as evidence of your consent.

Crash and technical data

  • Crash reports. When the app or our server hits an error, a crash report is sent to Sentry. It contains technical details such as the error, the app version, the device model and operating system. We configure Sentry not to receive your name, email address, account identity, IP address, or sign-in tokens, and we strip email addresses and tokens from error messages before they are sent. We do not use Sentry for performance tracing, session replay, or screenshots.
  • Server logs. Our servers log each request (for example, which endpoint was called, when, the result, and a request ID), along with the app version and platform the app reports. We do not store IP addresses in our application logs. IP addresses are used only transiently, in memory, for rate limiting and abuse prevention, and our hosting provider may process them to operate the network. Application and infrastructure logs are kept for 30 days. We do not keep load-balancer access logs.

What we don't collect

We do not collect your precise location, contacts, or advertising identifier. Location and camera metadata (such as GPS coordinates) are removed from play photos when they are uploaded. The app does not ask for permission to track you and does not access the iOS advertising identifier (IDFA); on Android, the advertising ID permission is blocked. meepz does not use advertising or analytics cookies or similar trackers.

If you are in the EEA, UK or Switzerland, the law requires us to have a legal basis for each use of your information. These are ours:

  • Providing meepz (creating and securing your account, keeping your collection and play history, calculating stats, leaderboards and head-to-head records, connecting you with friends, showing play photos to the people in the play, sending notifications you've allowed, and reading shelf-scan photos you submit). Basis: performing our contract with you.
  • Subscriptions and trials (checking what features your account can use, processing purchases through RevenueCat, Apple and Google). Basis: performing our contract with you.
  • Keeping the community safe (enforcing blocks, reviewing reports, filtering prohibited language, acting on content or accounts that break our rules). Basis: our legitimate interests in a safe service, and legal obligations where they apply.
  • Security, abuse prevention and rate limiting. Basis: our legitimate interests in protecting the service and its users.
  • Diagnosing crashes and errors, and improving the app (crash reports, logs, feedback surveys, shelf-scan ratings, requests for new scoresheets). Basis: our legitimate interests in a reliable, improving service; for feedback you choose to give, your consent.
  • Marketing email. Basis: your consent, which you can withdraw at any time.
  • Keeping consent and deletion records, and responding to legal requests. Basis: legal obligations, and our legitimate interest in being able to show we handled your data lawfully.

Where we rely on legitimate interests, we have weighed them against your rights, and you can object (see "Your rights"). We do not use your information for advertising, and we do not sell it or use it to build profiles for anyone else. We do not make decisions about you by automated means that have legal or similarly significant effects; the AI used for shelf scans only suggests games for you to review.

Marketing email

Marketing email is opt-in only and off by default. You can opt in with the checkbox at sign-up or in Settings, and withdraw at any time in Settings or with the unsubscribe link in any marketing email. When we send marketing email, we look up your address from Firebase Authentication at the time of sending; it is not copied into our database. We don't send any marketing email yet; if we start, we'll only send it to people who opted in, and only about meepz features and updates. Service messages, such as password-reset emails, are not marketing and are sent regardless of this setting.

Who can see your information

  • Any signed-in meepz user can find you by handle or display name and view your profile: display name, handle, bio, avatar, pinned favorite games, and whether you have a paid Pro badge. Nothing else about your subscription is shown.
  • Your friends can also see your game collection, and your play results appear in friends-only leaderboards and head-to-head records.
  • People in a play (the other players) can see that play, including its scores, notes, players, and photos.
  • Users you block can no longer see your profile or find you.

Shared profile links

When you share your profile, meepz creates a link such as https://meepz.app/u/yourhandle and, if you choose, an image of your profile card (display name, handle, avatar, top games, and play stats). The image contains only what you see before you share it, and it goes wherever you send it. The link opens your profile in the meepz app, where the viewer must be signed in, so it shows them the same profile any signed-in user can see. If someone opens the link without the app installed, they see only a page prompting them to get the app; no profile data is shown to them.

Your avatar image is stored at a public web address so that it can be displayed quickly; anyone who has that address can view the image. Play photos are different: they are stored privately and only shown through short-lived, signed links to the people in the play.

Service providers we share information with

We share information with the providers below only so they can run parts of meepz for us. We have data processing agreements with our service providers that limit how they may use it.

  • Google Firebase Authentication: sign-in, account management, and password-reset emails. Stores your email address and sign-in identifiers.
  • Apple and Google: Sign in with Apple and Google Sign-In (if you use them); App Store and Google Play purchases; and delivery of push notifications through Apple Push Notification service and Firebase Cloud Messaging.
  • Amazon Web Services (AWS): hosts our servers, our database (Amazon RDS), file storage (Amazon S3) for avatars, play photos, shelf-scan photos and data-export files, and our server logs. AWS also runs the AI service that reads shelf-scan photos (see below). All of this is in the AWS US East (N. Virginia, us-east-1) region.
  • Expo (650 Industries): relays push notifications to Apple and Google using your device's push token, and delivers app updates.
  • RevenueCat: manages Pro subscriptions using your meepz account ID and your store purchase records.
  • Sentry: receives crash reports, with identity removed as described above. Sentry stores them in the United States and keeps them for up to 90 days.
  • BoardGameGeek (BGG): the source of our game information. Game box images are loaded directly from BGG's servers, so BGG receives your IP address, and the usual technical details of your device's request, when the app fetches them. If you import your BGG collection, we also send your BGG username to BGG to fetch the list of games you own there. BGG's own privacy policy applies to its handling of that information.

We may also disclose information if required by law, to protect the safety of any person, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply to your information.

Shelf-scan image processing

The "import from a photo" feature is experimental and AI-powered. Your shelf photo is uploaded to our private AWS storage and processed with AI models running on Amazon Bedrock, a service of Amazon Web Services (AWS), in the us-east-1 region, to identify the game boxes in it. The photo is not shared with other users. Under Amazon Bedrock's terms, the images and results are not used to train AI models. Shelf-scan photos are automatically deleted 30 days after upload. Please avoid photographing people or personal documents.

Tracking and advertising

meepz does not track you. We don't use advertising SDKs, advertising cookies, or analytics that follow you across other apps and websites, we don't access your device's advertising identifier, and we don't share your information with data brokers. The app's Apple privacy manifest declares no tracking and no tracking domains.

How long we keep information

  • While your account is open, we keep your information so the app works. You can delete individual items (games, plays, photos, guests, friendships) at any time.
  • Play photos are deleted when the play is deleted, when the person who uploaded them removes themselves from the play, or when that person deletes their account.
  • Shelf-scan photos are deleted 30 days after upload.
  • Data export files are deleted after 7 days; the download link itself expires after 24 hours.
  • Application and infrastructure logs are kept for 30 days.
  • Crash reports are kept by Sentry for up to 90 days.
  • Database backups are kept for 7 days.

When you delete your account

You can delete your account at any time in the app. When you do, we delete all of your personal information:

  • your display name, handle, bio, avatar, linked BoardGameGeek username, and marketing preference, and your profile disappears from search;
  • your collection, favorites, friendships, and blocks;
  • the photos you uploaded to plays and the shelf-scan photos, results, and import history you created;
  • your push device tokens and in-app notifications;
  • the guest player names you created, your feedback-survey answers, and your scoresheet requests;
  • your Firebase Authentication account (including your email address), which also signs you out on all devices; and
  • your customer record at RevenueCat.

Plays you took part in belong to everyone in them, so they stay for the other players, but your name is removed and you appear only as a removed player.

The only things we keep are those we need for legal and safety reasons, and none of them identifies you by name or contact details:

  • a record that the account was deleted, and when;
  • the history of your marketing-email consent (and its withdrawal on deletion), as evidence that we handled your consent lawfully; and
  • anonymized moderation records (reports and blocks) needed to enforce our rules and protect other users.

Deleted information may remain in encrypted database backups for up to 7 days, until the backups expire. Deleting your account does not cancel a subscription; cancel it in the App Store or Google Play first.

Your rights and choices

Wherever you live, you can do the following in the app:

  • Access and portability: export a copy of your data in a machine-readable (JSON) format from the app.
  • Correction: edit your profile, collection, and plays at any time.
  • Deletion: delete your account and data from the app, as described above.
  • Marketing: turn marketing email on or off in Settings.
  • Notifications: turn off push notifications in your device settings.

EEA, UK and Swiss residents (GDPR and UK GDPR)

Under the GDPR and the UK GDPR you have the right to:

  • be informed about how we use your information (this policy);
  • access your personal information and get a copy of it;
  • have inaccurate information corrected and incomplete information completed;
  • have your information erased ("right to be forgotten");
  • restrict our processing of your information in certain cases;
  • receive your information in a portable, machine-readable format, and have it transmitted to another service where technically feasible;
  • object to processing based on our legitimate interests;
  • withdraw your consent at any time (for example for marketing email), without affecting processing that happened before; and
  • not be subject to decisions based solely on automated processing that have legal or similarly significant effects. We do not make any such decisions.

You also have the right to lodge a complaint with a data protection supervisory authority, for example in the country where you live, work, or where you think a violation occurred. In the UK this is the Information Commissioner's Office (ico.org.uk). We would appreciate the chance to address your concerns first, so please contact us.

California residents (CCPA / CPRA)

You have the right to know what personal information we collect, use, and disclose; to access and delete it; to correct it; and not to be discriminated against for exercising these rights. We do not sell your personal information, and we do not "share" it for cross-context behavioral advertising, so there is nothing to opt out of. We do not use sensitive personal information for purposes that would give you a right to limit it. The categories we collect are those in "Information we collect": identifiers (email, handle, account ID, device push token), profile and user content, commercial information (subscription status), and technical information (crash and log data). We disclose these only to the service providers listed above, for the business purposes described in this policy.

How to make a request

Use the in-app export and delete features, or email support@meepz.app from the address linked to your account, saying which right you want to exercise. We may need to confirm that you own the account before acting. You may use an authorized agent; we may ask for proof of their authority. We will respond within one month (30 days for most requests, and 45 days for California requests), and tell you if we need longer as the law allows. If we decline a request, we'll explain why and how you can appeal or complain to a supervisory authority.

Children

meepz is not directed at children. Minimum age: 13, or 16 if you live in the EU/EEA. If you are below that age, do not use meepz or give us any personal information. We do not knowingly collect personal information from anyone below the minimum age. If you believe a child below it has given us information, email support@meepz.app and we will delete it.

International transfers

meepz and its service providers process your information in the United States (AWS us-east-1), which may not have the same data-protection laws as your country. If you are in the EEA, UK, or Switzerland, we transfer your information to the United States on the basis of the safeguards set out in our data processing agreements with our service providers: the European Commission's Standard Contractual Clauses (with the UK addendum for UK transfers) and/or the provider's participation in the EU-U.S. Data Privacy Framework (and its UK and Swiss extensions), as applicable to each provider. You can contact us for more information about these safeguards.

EU and UK representatives

Link Software LLC is based in the United States. For the purposes of Article 27 of the GDPR and the UK GDPR, we have appointed representatives you can contact about this policy or your rights if you are in the EU or UK. You can also always reach us directly at support@meepz.app.

  • EU representative: [CONFIRM: EU representative name and contact]
  • UK representative: [CONFIRM: UK representative name and contact]

Security

We use encryption in transit (HTTPS), private storage with short-lived signed links for play photos, scoped access to our databases and storage, and sign-in tokens that we can revoke. No system is perfectly secure, but we work to protect your information and will notify you and the authorities of a breach where the law requires.

Changes to this policy

We may update this policy as meepz changes. The current version is always at https://meepz.app/privacy. We'll change the "Last updated" date above and, for material changes, tell you in the app or by email before they take effect. Using meepz after a change takes effect means the updated policy applies.

Contact

Email: support@meepz.app
Phone: (865) 466-1020
Post: Link Software LLC, 999 Jacksonian Way, Lenoir City, TN 37772, USA