Privacy and Personal Data Processing Policy

Version dated July 31, 2026.

This is a courtesy translation. In case of any discrepancy, the Russian version of this policy prevails.

1. General provisions

This policy is drawn up in accordance with the Russian Federal Law No. 152-FZ of July 27, 2006 “On Personal Data” and describes how personal data of users of the Polka Nastolok website at https://polkanastolok.ru (the “Site”) is processed and protected.

Personal data operator: Proshin Boris (the “Operator”). Contact for personal data inquiries: support@polkanastolok.ru.

The Site is provided free of charge. The Operator provides no paid services and accepts no payments.

By signing up for and using the Site, the user accepts this policy and consents to the processing of their personal data under the terms set out in it.

2. What data is processed

Account data:

• email address;
• password — stored only in hashed form; the Operator has no access to the plain-text password;
• username (nickname), if the user has provided one;
• first and last name, if the user has provided them;
• date of birth, if the user has provided it.

Data that arises from using the Site:

• information about the user’s board game collections: their contents, marks on games, bookmarks and lists;
• information about connections with other users: the friend list and friend requests sent and received;
• a browser push notification subscription, if the user has set one up — the subscription endpoint issued by the user’s browser;
• a subscription to preorder deadline notifications, if the user has set one up.

Technical data transmitted automatically:

• IP address, browser and device information, Site access logs;
• data stored in cookies (section 6);
• where the user has consented — data about behaviour on the Site collected by the web analytics service (section 6).

The Site does not collect special categories of personal data or biometric data. Providing a first and last name, date of birth and username is voluntary: the Site works without them, except for the features named in section 3.

3. Purposes of processing

• email address, password — registration and sign-in, address confirmation, account recovery;
• email address — sending service emails. No marketing emails are sent;
• username (nickname) — displaying the user on the Site and letting other users find them;
• first and last name — displaying them in the profile, at the user’s discretion;
• date of birth — restricting access to material about games intended for people over 18;
• collections, marks, bookmarks, lists — the Site’s core functionality: keeping a board game collection;
• friends and friend requests — being able to open your collection to people you know and to view theirs;
• push notification subscription, preorder deadline subscription — sending the notifications the user subscribed to;
• technical data — keeping the Site operational and secure;
• web analytics data — understanding how the Site is used and improving it; only where the user has consented.

4. Legal grounds for processing

Processing is based on the user’s consent given at sign-up and on the necessity to provide the user with the Site’s functionality.

Web analytics data is processed solely on the basis of separate consent, which the user gives in the cookie notice and may withdraw at any time (section 6).

5. Who processes the data on the Operator’s behalf

To provide the Site, the Operator engages the following parties that process personal data on its behalf:

• OOO “Timeweb” — Site hosting and data storage; processes all data named in section 2; servers are located in the Russian Federation;
• OOO “VK” (Mail.ru) — sending service emails; processes the email address; servers are located in the Russian Federation;
• OOO “YANDEX” — web analytics (Yandex.Metrica); processes the data named in section 6, and only where the user has consented; servers are located in the Russian Federation.

The Operator collects, records, organizes, accumulates, stores, updates, retrieves, uses, blocks, deletes and destroys personal data by automated means.

Personal data is not shared with any other third parties except where required by the laws of the Russian Federation and in the case described in section 8.

Personal data is kept until the user’s account is deleted or consent is withdrawn. Technical logs are kept no longer than six months from the moment they are recorded.

6. Cookies and web analytics

Necessary cookies are always active; the Site does not work without them:

• session — the authentication session, so the user does not have to log in again on every visit;
• NEXT_LOCALE — the selected interface language.

In addition, the user’s analytics choice is stored in the browser’s local storage, so that the question is not asked on every visit.

Analytics cookies are only enabled after the user has pressed “Accept” in the cookie notice. The Site uses Yandex.Metrica (OOO “YANDEX”). Metrica collects information about visited pages, actions on them, the referral source, as well as the IP address and browser and device information. Until consent is given, the Metrica script is not loaded and no data is collected.

The user may decline analytics outright or withdraw consent given earlier: it is enough to clear the Site’s data in the browser settings — the notice will appear again, and “Necessary only” can be chosen in it. Declining analytics does not affect how the Site works.

No advertising trackers are used on the Site. No advertising is placed on the Site.

7. User rights

The user has the right to:

• obtain information about the processing of their personal data;
• request that their personal data be corrected, blocked or deleted;
• withdraw consent to the processing of personal data;
• request deletion of their account.

To exercise these rights, send a request to support@polkanastolok.ru from the email address used at registration. The Operator responds within the period required by law, and no later than 10 business days from the request. Withdrawing consent or deleting the account terminates access to the Site.

8. Push notifications and cross-border transfer

If the user has subscribed to push notifications, they are delivered through the push service of the user’s own browser — Google (Firebase Cloud Messaging) for Chromium-based browsers, Mozilla for Firefox, Apple for Safari. The servers of these services are located outside the Russian Federation.

Such a service receives the subscription endpoint it issued itself and the text of the notification. The email address, password, collection contents and other data from section 2 are not transferred.

The Operator carries out no other cross-border transfer of personal data: everything else is stored and processed within the Russian Federation.

This transfer can be declined by turning push notifications off in the Site’s or the browser’s settings. This does not affect the rest of the functionality.

9. What other users can see

Some data is by its nature visible to other users of the Site:

• the username (nickname) — in people search and in friend lists;
• the first and last name, if the user has provided them — in the profile;
• the contents of collections — to those users the user has given access to;
• the existence of a friend connection — to the parties to it.

The user controls this themselves: by not providing optional data, not adding friends and not opening up collections.

10. Data protection

The Operator takes the necessary organizational and technical measures to protect personal data from unauthorized access, alteration, disclosure or destruction: the connection to the Site is protected by HTTPS, passwords are stored only in hashed form, and access to the infrastructure is restricted.

11. Final provisions

The Operator may update this policy. The new version is published on this page with its revision date. Continued use of the Site after a new version is published constitutes acceptance of it.

This policy is published in Russian and English. The Russian version is the legally binding one; the English version is provided for convenience, and in case of any discrepancy the Russian text applies.

Questions about this policy can be sent to support@polkanastolok.ru.