1. Who processes your data
The personal data operator is individual entrepreneur Svetlana Yurievna Khokhlova (INN 503210238760, OGRNIP 323508100223352).
The operator runs the VOG board game club: the websites vogclub.com, vogclub.ru, vogclub.games, the Windows client and the mobile apps (the "Service").
Personal data questions: privacy@vogclub.com. The operator's postal address is listed in the Roskomnadzor register of personal data operators (pd.rkn.gov.ru) and can also be requested at privacy@vogclub.com.
This policy is based on Russian Federal Law No. 152-FZ of 27.07.2006 "On Personal Data" (the "Law"). The Russian version of this policy prevails.
2. Who this policy applies to
It applies to everyone whose data the Service processes: registered players, guests playing without an account, website visitors, and people who contact us through the feedback form.
The Service is intended for persons over 14 years old. By registering you confirm that you are at least 14. If we learn that an account was created by someone under 14, we close it and delete the data.
3. Club data before 2026
The VOG club has been running since 1997. Since 1 April 2026 the operator of the club's data is the individual entrepreneur named in section 1. Accounts, game history and ratings accumulated by the club earlier continue to be processed for the purposes and in the manner described in this policy. If you do not want your earlier data to be processed, delete your account in your profile or write to privacy@vogclub.com.
4. What data, why, and on what basis
We collect only what a specific purpose requires. We do not process phone numbers, passport data, special categories of data (health, beliefs, etc.) or biometric data.
| Purpose | Data | Basis |
|---|---|---|
| Account and sign-in | email address; nickname; profile picture; when signing in with Yandex, VK, Google, GitHub or Telegram — your identifier and name at that service; IP address, browser details, country and city derived from the IP; passkeys and second-factor methods, if you enabled them | performance of our contract with you — the Terms of Use (Art. 6(1)(5) of the Law) |
| Playing | nickname; games, their moves and results; ratings; tournament participation; answers and progress in lessons; settings | performance of the contract |
| Profile and communication | information you add to your profile yourself (name, gender, date of birth, country, about you); friends and following; room and table chat messages; private messages; reactions to news | performance of the contract |
| Security and rule enforcement | IP address, country and city derived from it, browser details next to sign-ins and chat messages; sign-in log; restrictions for rule violations; history of nickname and email changes | legitimate interest of the operator and users in protecting the Service (Art. 6(1)(7) of the Law) |
| Answering requests | name or nickname, email address, request text | performance of the contract; for requests without an account — your request |
| Club news emails | email address | your consent (separate checkbox; withdraw in settings) |
| Gravatar picture | hash of your email address | your consent (enabled in your profile when the option is available) |
| Service statistics | account number, time and duration of visits, country and city derived from the IP | legitimate interest of the operator |
| Technical support | IP address, browser details, client installation identifier, error and crash information | legitimate interest of the operator |
| Mobile app notifications | device notification identifier | your permission in the app |
Service emails — sign-in codes, access recovery, sign-in alerts — are sent regardless of the news email consent: the account cannot be used without them.
5. What other players see
Other players see your nickname, profile picture, ratings, games played and messages in public chat. Your profile is visible within the visibility settings you choose. Your email address, IP address and sign-in log are never shown to other players.
6. Cookies and browser storage
The websites use only cookies they cannot work without: signing in, interface language, marks of news you have seen and the catalog view you chose. There is no third-party analytics and no advertising cookies. Game settings and unfinished guest games are kept in browser storage on your device. Sign-in pages use Yandex SmartCaptcha bot protection; if it fails to load, Cloudflare Turnstile is used instead.
7. Who receives the data
The data is stored in the Russian Federation, on the operator's own servers. Traffic to the websites passes in encrypted form through an entry point at a Russian hosting provider; the data is neither decrypted nor stored there.
Only the following receive data:
- sign-in services you choose yourself: Yandex, VK; for users outside Russia and Belarus also Google, GitHub, Telegram;
- bot protection services on sign-in pages: Yandex SmartCaptcha, and, if it fails to load, Cloudflare Turnstile (Cloudflare, Inc., USA);
- Gravatar (Automattic Inc., USA) — only if you enabled the Gravatar picture;
- Apple and Google notification services — in mobile apps, if you allowed notifications;
- other players — to the extent described in section 5;
- public authorities — where required by law.
Processing on the operator's behalf is carried out by the person who runs the Service under a contract with a confidentiality obligation (Art. 6(3) of the Law).
Transfers abroad happen only in the cases above: Gravatar and notification services (USA) — at your choice; Cloudflare Turnstile (USA) — only when the Yandex check fails to load; Google and GitHub (USA) and Telegram sign-in — at your choice and only outside Russia and Belarus. We do not sell data and do not share it for advertising.
8. How long we keep data
| Data | Period |
|---|---|
| Account, profile, connections | while the account exists |
| IP address and browser details | 1 year; after that only country, region and city remain |
| Public chat messages | 90 days |
| Private messages and support requests | 3 years after the last message |
| Records of accepted documents and consents | while the account exists and 3 years after its deletion or the withdrawal of consent |
| Games played and ratings | indefinitely — they are the history of the club and of your opponents; after account deletion your nickname in them is replaced with an anonymous one |
| Technical logs, error data, backups | up to 90 days |
9. Deleting your account
You can delete your account in your profile without contacting us. 30 days after the request the account data is anonymised: email, nickname, profile, picture, connections and sign-in methods are deleted, and the account's IP addresses are erased. You can cancel the deletion within 30 days. Games played and ratings remain with an anonymous nickname (section 8). Data leaves backups as they are replaced.
10. Your rights
You have the right to:
- learn what data of yours we process, why and how;
- demand that data be corrected, blocked or destroyed if it is incomplete, outdated, inaccurate or processed without a legal basis;
- withdraw consent — for emails and Gravatar this is done in your profile settings; withdrawal does not affect what was done before it;
- appeal our actions to Roskomnadzor (the Russian data protection authority) or a court.
Send requests to privacy@vogclub.com from the email address of your account, or by post to the operator's postal address (section 1). We reply within 10 working days; this period may be extended by no more than 5 working days with an explanation.
11. How we protect data
Data is transmitted over networks only in encrypted form; access to data is restricted and protected by a second factor; sign-in secrets are stored encrypted and codes as hashes; databases are not reachable from the Internet; sign-ins and security events are logged; backups are made. We notify Roskomnadzor of security breaches affecting your data within the time limits set by the Law. Report vulnerabilities and possible leaks to security@vogclub.com.
12. Changes to this policy
A new version is published on this page with its date; previous versions are listed below. If changes affect the purposes of processing or require new consent, we will tell you when you sign in.