Your data, by the fire.

Campfire Board keeps as little about you as it can. This notice says what each part of the site and the games processes, why, for how long, and how to get it changed or deleted.

Version: 2026-11-04 · Prepared under Vietnam’s Law on Personal Data Protection (2025) and Decree 356/2025/ND-CP.

Who is responsible.

Data controller: Campfire Board, run by an independent developer based in Vietnam.
Contact: Send a request with the form under “Your rights”. We reply by email. Go to the form
Where data lives: On our own server in Vietnam, which runs campfireboard.com, every game room and the voice relay.

What we process.

Visiting this website: Your IP address, browser and the page you asked for are written to the web server log, to keep the site running and stop abuse. Logs are deleted automatically after 14 days. No analytics, no ads, and no cookies unless you sign in. Fonts are served from our own server.
Open tables: The home page asks the game server which rooms are open. That request carries your IP address like any page load; nothing about you is stored.
Playing as a guest: The name you type, your character’s look, your chat messages, votes and role exist only in the server’s memory while the room is open. They are gone when the room closes or the server restarts.
Voice chat: Voice goes straight between players’ browsers. When a direct line fails, it passes through our relay server in Vietnam. Voice is never recorded or stored. The relay keeps a technical connection log (IP address, time) for 14 days.
Visitor counts: To count daily visitors, the game server stores a one-way keyed hash of your IP address, never the address itself. The daily counts and hashes are deleted after 90 days.
Account (optional): Only if you choose “Sign in with Google”: your Google account ID, email address, name, first name and profile picture link, plus when you signed up, last signed in and were last seen, and how many times you signed in. We also record which version of this notice you agreed to and when. Kept until you delete the account. Sign-in sessions expire after 30 days and are stored only as a hash.
Player profile (signed in): While you are signed in, the account also keeps the player name, character look and sound and effect settings you choose, so they follow you to other devices, and your game results: for each of your last 20 games the role, team, win or loss, whether you survived, number of days and players, the map and the date, plus totals per team and role and the badges you earned. Only you can see your profile. Other players in a room only see that you are signed in (a gold frame on your nameplate). Kept until you delete the account.
On your device: The game saves your name, language, settings and character look in your browser’s local storage. If you sign in on campfireboard.com/login, one sign-in cookie (cb_session, HttpOnly, 30 days) holds your session key so every Campfire Board game knows it is you; signing out or deleting the account removes it. Clearing site data removes all of these.
Requests you send us: The email address, request type, game account email and message you write in the form below. Used only to answer you. Kept until the request is closed and 12 months after, as a record that we answered.
Donations: If you send money by MoMo, bank transfer or PayPal, we see what that service shows the receiver: usually your name, the amount and your message. We use it only to know who gave and to thank you, and never publish it without asking.

Why, and on what basis.

Running the games: Rooms, names, votes and voice exist so the game can be played. You start this by opening or joining a room.
Your account: An account keeps your name, character, settings and game profile across games and devices, and unlocks extra cosmetics and signed-in-only rooms. We create it only after you tick consent and sign in, and you can withdraw that consent at any time by deleting the account.
Security and counting: Server logs, rate limits and hashed visitor counts protect the service and tell us how many people play. Nothing is used for advertising or sold.

Google (outside Vietnam): Only when you sign in with Google: Google’s Firebase Authentication handles the sign-in, and your profile picture is loaded from Google’s servers. Google processes this under its own privacy policy, and the data leaves Vietnam. You can play every game without signing in.
Payment services: MoMo, Vietcombank and PayPal process donations under their own terms.
Game stores: If you play a Campfire Board game through itch.io or Steam, those stores process your data under their own policies.
Nobody else: We do not sell, rent or share personal data for advertising.

Your rights.

You can ask to see your data, correct it, delete it, withdraw consent, or restrict or object to its use. Use the form below. We confirm within 2 working days, then:

See or correct: within 10 days
Withdraw consent, restrict or object: within 15 days
Delete: within 20 days
Delete it yourself: In the Ma Sói lobby, signed in: “Delete account” removes your account and every session at once.
Complain: You can also complain to the Department of Cybersecurity and High-tech Crime Prevention (Ministry of Public Security).

Children.

Guests can play without an account. If you are under 16, sign in only with your parent’s or guardian’s agreement. A parent or guardian can ask us to delete a child’s account.

Keeping it safe.

Every page and game runs over HTTPS. Session keys and visitor IP addresses are stored only as hashes. Only the operator can open the admin dashboard. If a breach puts your data at risk, we report it to the authorities within 72 hours and tell you when the law requires it.

Changes.

When this notice changes, the version date above changes. If the change affects what we collect for your account, the game asks for your consent again.