Privacy Policy
Last updated 2026-11-02
The short version
Woolholm is a board game run by Jeremy Ettlinger as a hobby. It collects the minimum needed to seat you at a table: who you are and what happened in your games. Paying is optional and handled by Paddle; there is no advertising, no tracking in your browser, and nothing is sold or shared for marketing. The only email we send is about your account and your plan. You can delete the whole account yourself, any time.
What we collect
Account data. When you sign in with Google or GitHub we receive and store your verified email address, display name, and avatar URL, plus when you last signed in. We never see your password for that provider.
Guests. Joining a table by invite link needs no account. We store the name you type and a random id in a cookie so a reconnect finds your seat. That id is not linked to anything else about you.
Game data. Every table keeps its full record: who sat where, every move and dice roll, trades, and anything typed into table chat. A finished game stays readable as a replay. That replay — the chronicle — opens for anyone holding its link, with no sign-in, so treat the link the way you would the invite link. Weekly standings show the winner's name, the table name, and the turn count to every signed-in user; who else sat at your table is shown only to you.
Security log. Sign-ins and changes to your tables are recorded with a salted hash of your IP address — enough to spot abuse, not enough to recover the address.
Claude seats. If you connect a Claude session to play, the key we issue carries your account id and display name so the table knows whose seat it is. Nothing about your Claude conversation reaches us.
Billing data. If you buy the plan, Paddle holds your payment details; we never see a card number. We store Paddle's customer and purchase references, the plan's status, and when it ends. We also send a few plan events (for example "checkout opened") to PostHog under your internal account id.
Email we send you
We write to the address on your account, and only about the account: a welcome note when you first sign in; when you buy, a confirmation that hosting is on; a warning if a payment fails; a notice when your access ends, and one a few days before a pass runs out; and a confirmation if you delete your account. There is no newsletter and no marketing. The welcome note carries an unsubscribe link; plan email does not, because it is about your money. Paddle's own receipt is a separate email from Paddle.
Resend delivers it for us. A message waits in a Cloudflare queue until it is sent; one that keeps failing is held there for two weeks at most (Cloudflare's limit), then discarded.
Why we're allowed to
Account and game data are processed to provide the service you asked for. The security log is kept on the basis of our legitimate interest in keeping the tables running and free of abuse — the IP is hashed for exactly that reason. Plan email is part of the service you bought; the welcome note is sent on our legitimate interest, and you can stop it with one click.
Who else touches it
These are the only third parties involved:
| Service | Purpose | What they see |
|---|---|---|
| Cloudflare | Hosting, database, game rooms, CDN, and cookieless page-load analytics | Everything the app stores, plus request logs and page-load timings |
| Google / GitHub | Sign-in | They tell us your verified email, name, and avatar; we tell them nothing |
| Paddle | Payments, tax, and receipts for the paid plan, as merchant of record | Your email, billing address, and payment details — only if you buy |
| Resend | Sending account and billing email | Your email address and the message |
| PostHog | Counting plan events (paywall shown, checkout opened, plan started) | Your internal account id and the event — no email, no browsing history |
Cookies
One cookie holds your sealed, encrypted session — it is what keeps you signed in. Guests get one cookie holding the random seat id described above. A short-lived cookie remembers which page you were heading to when you signed in. That is all; there are no advertising or cross-site tracking cookies.
How long we keep it
Account data lives until you ask us to delete it. Game records live until the table's host removes it or the account behind it is deleted. The security log is kept indefinitely, but holds only an internal account id and the hashed IP, so once the account is deleted nothing in it points back to you. Cloudflare's request logs age out on their schedule.
Your rights
You can remove any table you host from its lobby yourself, and you can delete your account yourself from your account page — it takes effect immediately and also deletes the tables you hosted and your email settings. If a monthly plan is running, deleting your account cancels it first, so it will not renew or charge you again; if Paddle cannot confirm the cancel, nothing is deleted and you are told to cancel from your plan first. To get a copy of what we hold, or to correct anything wrong, email hello@woolholm.com from the address on the account and it is done within 30 days. If you are in the UK, EU, or a similar jurisdiction you may also complain to your data protection authority.
Security and breaches
Data is encrypted in transit and at rest, sessions are sealed cookies, and only Jeremy Ettlinger has access to production. If a breach affects your data we will tell you and the relevant regulator as the law requires.
Contact
Jeremy Ettlinger — hello@woolholm.com