Privacy policy

What we collect

Depending on how you use Bored Hoard, we may process account details such as your email address; saved sites and votes; submissions and site-update requests; ownership-verification requests; reports and moderation history; Inbox notifications; feedback and any reply email you choose to provide; recently viewed site slugs used by the Recent feature; and limited technical or anonymous interaction data used to operate, secure and understand the service.

Please do not submit passwords, payment details, sensitive personal information or confidential material through feedback, reports or submissions.

Why we use data and our lawful bases

We process personal data only where we have a lawful basis under UK data-protection law. Different activities can rely on different bases.

• Contract or steps at your request: where processing is needed to provide an account or a feature you ask us to perform, such as saving a site, handling a submission, processing an ownership request or delivering account-related notifications.
• Legitimate interests: operating and improving a curated discovery service, keeping it secure, preventing abuse, moderating submissions and reports, preserving necessary operational records and protecting the service or its users. We use this basis only where those interests are not overridden by your rights and interests.
• Consent: where you choose to allow persistent anonymous usage measurement through Privacy choices. You can withdraw that choice at any time.
• Legal obligation: where we need to process information to comply with applicable law, regulatory requirements or valid legal requests.

Browser storage and cookies

Bored Hoard uses first-party browser storage for product features and preferences. The Recent feature uses a first-party cookie containing a short list of site slugs for up to 90 days. Find may use sessionStorage to restore your place during a browsing session. Authentication uses browser storage managed by Supabase so signed-in sessions can work. A privacy-choice cookie is kept for up to 180 days.

A random first-party anonymous-session cookie may also be used for up to 90 days where it is needed to keep an anonymous action consistent, such as a vote or report. Separately, if you choose to allow anonymous usage measurement, that session can also be used to keep passive discovery signals consistent across visits.

You can change the optional measurement choice at any time using Privacy choices in the footer. Declining it does not remove core product features such as Recent, Find restore, signing in, voting or reporting.

Analytics

Bored Hoard uses PostHog Cloud EU for lightweight product and web analytics. PostHog is configured in permanent cookieless mode, with person profiles disabled, autocapture disabled and session replay disabled. Bored Hoard does not identify signed-in users to PostHog or link analytics events to account profiles.

PostHog may receive technical request information needed to provide the analytics service. Analytics traffic is sent through the first-party endpoint e.boredhoard.com to PostHog's EU service. Bored Hoard uses aggregate analytics to understand product usage and web performance, including web vitals.

Service providers and sharing

We do not sell personal data. We use service providers to run Bored Hoard, including Supabase for database, authentication and storage services; Cloudflare for hosting, delivery and security infrastructure; and PostHog for cookieless analytics. These providers may process data on our behalf or receive limited technical information needed to provide their services.

We may also disclose information where reasonably necessary to comply with law, protect legal rights, investigate abuse or protect the security of Bored Hoard or other people.

International transfers

Some service providers or their subprocessors may process information outside the United Kingdom. Where UK data-protection rules require safeguards for an international transfer, we rely on the applicable transfer mechanism made available by the relevant provider, such as adequacy arrangements or approved contractual safeguards. You can ask for more information about applicable safeguards through the privacy contact route above.

How long we keep data

We keep personal data only for as long as reasonably necessary for the purpose for which it was collected, including providing the service, resolving disputes, preventing abuse and meeting legal obligations. Account information is generally kept while the account exists. Submissions, reports and moderation records may be kept for longer where needed to preserve the integrity of published listings, moderation decisions, security or legal claims. Feedback is kept for as long as it remains useful to investigate the issue or improve the service.

Browser-storage periods are described above. Data may remain for a limited period in backups, logs or provider systems after deletion in accordance with normal retention and recovery cycles.

Deleting your account

You can start self-service account deletion from Settings. The deletion workflow removes the account and data covered by that workflow. Some information may be retained where there is a legitimate or legal reason to do so, for example security, fraud prevention, moderation history, dispute handling or backup retention. Browser-level data such as Recent is stored separately on the device.

Your data-protection rights

Depending on the circumstances and lawful basis, UK data-protection law may give you rights to access your personal data, correct inaccurate data, request deletion, restrict processing, receive certain data in a portable format and object to processing. Where we rely on consent, you can withdraw it at any time without affecting processing that was lawful before withdrawal.

You have the right to object to processing based on legitimate interests. If you object, we will consider whether we have compelling legitimate grounds to continue processing or whether the data is needed for legal claims.

To exercise a right, use Feedback and choose Other. We may need to verify your identity before acting on a request.

Automated decisions

Bored Hoard does not currently make decisions about people based solely on automated processing that produce legal or similarly significant effects.

External websites

Bored Hoard links to third-party websites. Once you follow an external link, that site's own privacy, security and tracking practices apply. Bored Hoard does not control those practices.

Questions and complaints

Please contact us first if you have a privacy concern so we can try to resolve it. You also have the right to complain to the UK Information Commissioner's Office (ICO).

Changes to this notice

We may update this notice when the service, legal requirements or our data practices change. The date at the top shows the latest revision.