Privacy
Foray Tabletop is published by Vigor Sci. This explains what the app and this website collect, why, and what you can do about it. It describes what the software actually does today, not what it might do later.
What we collect
Your account: the email address you sign up with, a hashed password, a username and a display name. If you sign in with Apple or Google we receive an identifier from them, and your email address if you let them share it.
Your profile: the games you play, your city and area, the days and times you say you are free, an optional photo and description, and whether ranked play is on.
Your location, only while the app is open and only if you allow it. It sorts players and stores by distance. Decline and the app uses the centre of the city you picked instead, which works for everything except walking directions.
What you write and upload: looking-for-game posts, marketplace listings, photos, messages to other players and to stores, support tickets, and reports you send us.
What you do: matches, bookings, reported results, blocks, listings you save, and the posting credits you hold or spend.
Technical: a notification token if you turn on notifications, sign-in tokens for your devices, and ordinary server logs that include your IP address.
Why we collect it
To run the service you asked for: finding players near you, arranging matches, booking tables, listing items, and letting you message the people involved.
To keep it safe: acting on reports, enforcing blocks, and stopping accounts that break the rules from coming back.
To meet legal obligations, and to establish or defend legal claims where that becomes necessary.
We do not sell your data. There is no advertising service and no analytics service in the app, so nothing about your use of it is sent to a third party for those purposes.
How long we keep it
While your account exists, and then as set out on our deletion page.
Deleting your account removes your email address, password, display name, photo, description, area, availability, sessions and notification tokens, cancels your posts and takes down your listings. Matches you played stay on your opponents' records as a deleted player, because their own history has to keep making sense, and reports involving your account are kept so that deleting an account is not a way to shed a safety record.
We keep operational backups for no more than 30 days and never restore a deleted account from one.
Server logs are kept for a short period for security and debugging.
Your rights
You can see and change most of what we hold from inside the app: your profile, your games, your availability, your listings and your settings.
You can delete your account at any time, from Settings or by writing to us, and you can ask us what we hold on you.
You can object to or ask us to restrict certain processing, and you can ask for a copy of what you have given us.
Thailand's Personal Data Protection Act applies to people here, and equivalent rights apply if you are covered by another country's law. If you think we have handled your data badly, tell us first and we will try to fix it; you are also entitled to complain to your data protection authority.
To use any of these, write to hello@foray.games.
How it is protected
Passwords are stored as Argon2id hashes, so nobody, including us, can read them back.
Everything between the app and our servers travels over HTTPS, and the connection between our servers and the database does not leave the host.
On a phone your sign-in tokens are held in the device keychain rather than ordinary storage. In a browser they are held in the browser's storage, which is why the app is on its own address, separate from this website.
Staff access to moderation tools requires a named account, and every action a moderator takes is recorded with their name against it.
Cookies and storage
This website sets no cookies and runs no analytics. The only pages here that talk to our servers are the two that finish an email link, and they send nothing but the code in that link.
The phone app uses no cookies. It keeps your sign-in tokens in the device keychain and your preferences in ordinary app storage.
Foray Tabletop in a browser keeps your sign-in in that browser's own storage, which is why it runs on its own address and cannot read anything belonging to this website.
The store dashboard and our staff tools set one cookie, which holds the signed-in session and nothing else. It is not used for tracking and no third party can read it.
Age
Foray Tabletop is for people aged 18 and over, because it arranges games and trades that happen in person. We do not knowingly collect anything from anyone under 18, and an account we find belongs to someone under 18 is removed and its data deleted.
Our child safety standards are published separately and explain how to report a concern.
Changes
If this policy changes we will publish the new version here with a new date, and we will tell you in the app before anything material takes effect.
The date at the bottom of this page is always the date of the version you are reading.
Contact
Write to hello@foray.games with anything about this policy or about the data we hold on you.
Foray Tabletop is published by Vigor Sci.
Last updated 2 November 2026. · hello@foray.games