Pipster Privacy Policy

Version 2026-09-14

Pipster records the backgammon matches you play across the board and keeps your history and stats, with a match clock and scoreboard built in. This page says what it stores, who can see it, and what happens when you delete your account. It describes what the app actually does, in plain terms.

The short version. Your email address is the only thing you have to give us, and it exists so we can sign you in. Your username is visible to everyone; your real name is visible to people you share a club with, and to everyone else only if you choose that. We use no analytics, no advertising and no third-party trackers. You can delete your account from Settings — though a match you played against another member stays in their history, which is explained below.

Who we are

Pipster is run by an individual in Aotearoa New Zealand, not a company. If you need to reach a person about anything on this page, use the Contact us link on the home screen.

What we collect, and why

Things you give us

What	Required?	Why
Email address	Yes	It identifies your account and is how we send your sign-in code. There are no passwords.
Username	Yes	How other players find you and see you. Chosen once when you sign up.
First and last name	Yes	Shown to people who may see your details — see Who can see what.
Country, “about me”	No	Optional profile details. Leave them blank and nothing is stored.
Match results	No	Scores, match length, when it was played, who against, whether it ended on the clock. The clock and scoreboard work without an account and save nothing.
Clubs and tags	No	Which club a match was for, and any tags you add to it.
Contact messages	No	What you write in the contact form, plus the address to reply to.

Things collected automatically

One cookie, named pipster_session. It holds a random session identifier and nothing else — no personal data is stored in it. It is HttpOnly, so scripts cannot read it, and it lasts 30 days. It is strictly necessary to keep you signed in; there are no other cookies, and none for analytics or advertising.
Your IP address, used to rate-limit sign-in and contact requests so the service cannot be flooded or used to send unwanted email. It is held only for as long as the counter, which is minutes, and is not stored against your account.
Server logs, which record requests as they happen — the time, the path, the response status, and the IP. They are kept on the server for system administration and diagnosing faults.
Match times and clock data you generate while playing, which is the point of the app.

Things we do not collect

No analytics or usage tracking of any kind.
No advertising, and no data shared with advertisers.
No location data. The app never asks for your location.
No payment details — Pipster has no billing of any kind.
No contacts, photos, or anything else from your device.

Who can see what

This is the part worth reading closely, because Pipster is social by design.

Your username is always visible to any signed-in player. It is how you are found and how you appear on a club roster.
Your email address is never shown to anyone. Not on your profile, not to clubmates, not in search.
Your real name, country and “about me” follow the Visibility setting on your profile:
- Anyone — any signed-in player can see them.
- My clubs only — only players who share a club with you.
Sharing a club always reveals your details to that club’s members, whichever setting you choose. Joining a club is a social act, and a roster of anonymous handles serves nobody. The setting governs who sees you beyond your clubs.
Your name is not searchable by surname. Member search matches on username and first name only, so nobody can confirm a guessed surname by typing it in.
A match against another member appears in both histories. It is one shared record, so they see the score, the date, the result and which club it was for. That is what makes a result mutually attested rather than one person’s word.
Tags are yours alone. Whoever recorded a match is the only person who sees the tags on it. The other player is not shown them and cannot tell whether any exist.
Hiding a match hides it from your view only. The record stays, and the other player still has their copy — one player tidying their history cannot change someone else’s.

Deleting your account

You can delete your account at any time from Settings → Delete account. It cannot be undone. Here is exactly what happens.

What is deleted

Your account: email address, username, names, country and “about me”.
All your sessions, so you are signed out everywhere.
Your club memberships.
Any invitations you sent that had not yet been accepted.
Every match that only you hold — those recorded against someone who is not a Pipster member. Nobody else has a copy, so they go.
Your email address becomes free to sign up with again, and your username becomes available for someone else to take.

What is kept, and why

A match you played against another member is kept, and transfers to them. It was always their record too, and deleting your account is not a way to remove a result from someone else’s history — the same reason hiding a match never affects the other player.

On those matches your name is kept, marked “(left Pipster)”, so the other player can still tell who they played. The name kept is exactly what that person could already see under your visibility setting at the moment you deleted: your full name if they shared a club with you or your profile was set to “Anyone”, and your username otherwise. Nothing becomes visible to anyone that was not already.

Everyone who inherits a match is emailed to say you have left, so the change to their history is not silent.

If you own a club, deletion is refused until you hand it to another member or delete the club — a club with no owner cannot be administered, and dissolving a group of other people without asking them would be worse.

Backups. The database is backed up nightly and those backups are kept for 14 days, so a deleted account may persist in a backup for up to that long before ageing out. Backups are only ever used to restore the service after a failure.

Email we send you

We email you only when there is a reason:

Your sign-in code, when you ask for one.
Confirmation of a new email address, when you change it.
Club invitations and join requests involving you.
An invitation to Pipster, if a member invites you.
Notice that someone you played has closed their account.
A reply, if you write to us.

There is no marketing email, no newsletter, and nothing to unsubscribe from. Sign-in codes are typed into the app rather than clicked, so we do not ask you to follow links in mail claiming to be from us — with one exception, an invitation link, which carries which clubs you were invited to and never signs anyone in by itself.

Who else processes your data

Who	What they handle
Resend	Sends our email. They necessarily process the recipient address and the message contents in order to deliver it.
DigitalOcean	Hosts the server and the database, on a single machine in their Sydney, Australia region. Both the live database and its nightly backups stay on that one machine — nothing is copied to another region.
Let’s Encrypt	Issues the certificate that encrypts traffic to the site. No personal data is involved.

That is the complete list. Your data is not sold, rented, or shared with anyone else, and there is no advertising or analytics provider in the picture.

How it is protected

All traffic is over HTTPS.
There are no passwords to steal. Sign-in uses a six-digit code that expires in minutes, works once, and dies after five wrong guesses.
Emailed tokens — an email-change confirmation, an invitation — are stored only as a hash, so the database does not contain anything replayable.
The database is not reachable from the internet; only the app can read it.

Your rights

You can ask to see the personal information we hold about you, and ask us to correct it. In practice most of it is already in front of you:

See it — your profile, history and clubs are all in the app.
Correct it — edit your profile at any time.
Delete it — Settings → Delete account, with the exceptions above.
Anything else — use the contact form. If you would like a copy of everything held about you in a file, ask and we will put one together.

Children

Pipster is not aimed at children and asks no age. If you are a parent and believe your child has created an account you would like removed, contact us and we will delete it.

Changes to this policy

The version date at the top changes when this document does. Accounts record which version they accepted, so if the policy changes in a way that matters we can tell who has seen which wording and ask again where it is warranted.

Contact

Use the Contact us link on the Pipster home screen. It reaches a person, and works whether or not you can sign in.

← Back to Pipster