Privacy Policy

Last updated: October 2026

Who is responsible

The controller for the processing of your data on boardfella.com is ideenwerkstadt leis GmbH, Mathildenstraße 5, 65189 Wiesbaden, Germany, email: hello@boardfella.com. Further details are in the imprint.

The short version

boardfella is a public leaderboard for the use of AI coding tools. With an account, you can use the boardfella command line tool (CLI) to upload aggregated usage figures, which then appear on the leaderboard. A connected computer also sends its daily usage to your account, where only you see it under “My usage”. We only set cookies that are needed for signing in and for security, and we use no analytics or advertising services. Your browser loads every file of the site, including the fonts, from our own server. We do not sell data and only share it with the service providers named below. What is on the leaderboard, however, can be seen by anyone.

Server and logs

boardfella runs on a server of Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in a data center in Germany. Hetzner processes the data only on our behalf (Art. 28 GDPR).

When you open boardfella, your browser sends your IP address and technical information. Without them, the server cannot deliver the page to you. The web server logs every request: time, requested URL, method, status code, amount of data, response time, your browser identifier (user agent) and other technical information from your browser, such as the language setting. Before it writes an entry, it shortens your IP address: for IPv4 the last byte is removed, for IPv6 only the first 48 bits are kept. It also leaves out the URL of the page you came from (referrer), cookies, credentials, redirect targets and the query parameters token, code, state, email, redirect and q, because they can contain confirmation links, device codes or email addresses. We delete these access logs after 14 days.

The application itself writes an operating log with status and error messages. In case of errors, it can contain identifiers such as your user ID or your email address. The log is limited in size, and older entries are overwritten automatically.

To prevent abuse of sign-in, registration and email sending, we limit the number of attempts. For this we do not store your IP address, but a hash value created with a secret key:

• For a sign-in with password, we count the attempts in 15-minute windows, per hash value of your IP address and per hash value of your account (for an unknown name: of the entered username or email address). We delete these counters after one to two days.
• If you request a confirmation or password email, we store hash values of your IP address and of the email address. We delete these entries after seven to eight days.
• With every upload we store a hash value of your IP address, so that we can trace abuse (see “Devices and uploads”).

The legal basis for logs and limits is our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

Your account

For an account we need your email address, a username and a password. We store your password only as a bcrypt hash, never in plain text. We send a confirmation link to your email address that is valid for 24 hours. A link to reset your password is valid for the same time. We store both links only as hash values.

When you sign in, we create a session and set a cookie (see “Cookies”). A session expires after seven days. We also store your display name, your avatar, your leaderboard settings and when you created and last changed your account. If you change your username, the old one stays reserved for you for 30 days. If admins block an account, for example because of manipulation of the leaderboard, we store the time and the reason of the block.

We keep your account data as long as your account exists. The legal basis is the contract of use you enter into when you register (Art. 6(1)(b) GDPR). If you want to delete your account, write to us at hello@boardfella.com. We then delete the account with its devices, uploads, leaderboard figures and the daily figures from “My usage”. The site has no delete button yet, so we delete by hand within 14 days of your email and confirm it to you.

Signing in with GitHub

Instead of an email address and password, you can also register and sign in with your GitHub account, or connect GitHub to your account in the settings. GitHub is provided by GitHub, Inc., 88 Colin P. Kelly Jr. Street, San Francisco, CA 94107, USA. If you click “Continue with GitHub”, we send you on to GitHub. There you sign in and decide whether boardfella may read your public profile and your email addresses (permission user:email). What GitHub processes in the process is described in the GitHub privacy statement.

If you agree, our server receives an access token from GitHub and uses it to request your profile and your email addresses. Of this we store only your GitHub user ID, your GitHub username, your primary email address as confirmed at GitHub and the access token. With the access token we check whether you have starred the boardfella project on GitHub, when you want to use Cloud Sync. We do not take over your profile picture or the other details of your GitHub profile. If you create a new account this way, your GitHub username becomes your username and display name (if it is already taken, we append a few random characters) and your confirmed address becomes the email address of your account, unless another account already uses it. If an account already exists whose email address is confirmed and matches this address, we connect GitHub to that account instead of creating a new one. During sign-in we set up to two cookies, which by default expire after ten minutes and are deleted as soon as you come back from GitHub: oauth_state makes sure that only the browser that started the sign-in can complete it, and oauth_redirect remembers the page you return to afterwards.

We keep the details from GitHub as long as GitHub is connected to your account. In the settings under “Linked Accounts” you can disconnect it if you can also sign in another way, for example with a password. We then delete the GitHub ID, username, email address and access token. The username, display name and email address that we took over from GitHub when we created your account then belong to your account and stay there as long as it exists. You can also revoke boardfella's access at any time at GitHub under “Settings”, “Applications”, “Authorized OAuth Apps”. Signing in with GitHub is voluntary. The legal basis is the contract of use (Art. 6(1)(b) GDPR); we need no consent for the two cookies (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). Because GitHub is based in the USA, data is transferred to the USA in the process. The basis for this is the certification of GitHub, Inc. under the EU-US Data Privacy Framework; in addition, GitHub relies on the EU standard contractual clauses.

Devices and uploads

When you connect a computer to your account (with boardfella connect and the local helper it starts, or with boardfella login), we store the device name (by default the name of your computer), the CLI version, when the device was connected and when it last uploaded something, and a device key that we store encrypted. You can disconnect a device at any time, for example with boardfella logout. The entry of a disconnected device stays stored as long as your account exists.

An upload contains aggregated token counts per period (day, week, month, year and all time), broken down by tool, by model and by both together, plus the CLI version and your operating system. An upload does not contain the content of your sessions, prompts, responses, source code, file paths, project data or timestamps of individual requests. Since version 1.5.22, the CLI sends only the last part of a model name that is a path on your computer, usually the file name. Our server estimates the costs from the upload. With every upload we store the time, the device, the result of the check and a hash value of your IP address.

We keep the leaderboard figures as long as your account exists. We delete the records of individual uploads, including the hash value of the IP address, after 180 days. The exception is the upload that a leaderboard row was last based on: it stays stored as long as that row exists.

To keep the leaderboard fair, our server checks every upload automatically. Examples of anomalies are a high share of models without a known price, a device that uploads the same period very often, or a sudden jump compared to the previous figures of a device. The server flags such uploads. They do not appear on the leaderboard until an admin approves them. Admins can also review the devices and uploads of an account if a rank looks implausible. We delete notes about refused devices after 35 days and automatic review notes after 90 days. Admin decisions and exceptions, as well as your requests and confirmations, stay stored as long as the account exists. boardfella makes no automated decisions with legal or similarly significant effects (Art. 22 GDPR): a flag only affects what the leaderboard shows, and an admin reviews it.

Uploading and showing your figures are part of the contract of use (Art. 6(1)(b) GDPR). We base the checks for manipulation on our legitimate interest in a fair leaderboard (Art. 6(1)(f) GDPR).

My usage

Under “My usage” you see the AI usage of your connected computers: tokens and estimated costs per day, tool and model. For this, a connected computer sends us its daily usage. It does so right after you connect it, when the local helper starts, regularly while the helper runs, with every upload and when you send figures from the local dashboard. It does so even if you never release figures for the leaderboard. The first transfers fill in earlier days, back to the oldest records on that computer.

A transfer contains, per day (in UTC), tool and model, the counts of input, output, cache read, cache write and thinking tokens. It also contains the CLI version, your operating system, the first day with records on that computer and whether the CLI has removed older local records. It does not contain the content of your sessions, prompts, responses, source code, file paths, project names or timestamps of individual requests. If a model name is a path on your computer, the CLI sends only its last part, usually the file name. Our server estimates the costs from the token counts and public model prices. For computers with an older CLI, “My usage” shows the daily figures of their leaderboard uploads instead.

We store the figures per device and day. On the site, only you see them, after signing in. They do not appear on the leaderboard, in the public interface (API), on your share page or in the admin area. If a computer sends days again, the new figures replace the old ones.

For every transfer we also keep a log entry with the time, the device, the period, the number of rows, a hash value of the content, the CLI version and your operating system. We use it to limit the number of transfers and to trace errors and abuse. We delete these entries after 180 days.

We keep the daily figures as long as the computer stays connected. If you disconnect it, on the uploads page or with boardfella logout, we delete its daily figures at once. Its log entries stay until their 180 days are over.

The daily figures and their display are part of the contract of use (Art. 6(1)(b) GDPR): you choose this feature when you connect a computer. We base the log of transfers on our legitimate interest in secure and stable operation (Art. 6(1)(f) GDPR).

Public leaderboard

The leaderboard is public. Unless you change anything, it shows your display name, your username (if it differs from the display name), your avatar, your token counts and estimated costs, the tools and models you use, your rank and how it has changed. Our public interface (API) for the leaderboard returns the same information, together with your username, an internal user ID and the time your figures were last updated. Your share page (boardfella.com/share/<username>) and its preview image show it as well. We have excluded the share page from search engines. In the settings you can hide your profile or take part anonymously. Then the share page and the preview image no longer exist.

The legal basis is the contract of use (Art. 6(1)(b) GDPR), because the public leaderboard is the purpose of boardfella.

Database

Account data, devices, uploads, leaderboard figures and the daily figures for “My usage” are stored in a database at Supabase Pte. Ltd., Singapore, in a data center in Frankfurt am Main, Germany (Amazon Web Services, region eu-central-1). Supabase processes the data only on our behalf (Art. 28 GDPR). The data processing addendum of Supabase is part of its terms of service and binds both sides. Supabase and its sub-processors can access the data from outside the EU, for example from Singapore or the USA. The basis for such a transfer is the EU standard contractual clauses, which the data processing addendum includes.

Emails

We send confirmation and password emails through the service Resend (Plus Five Five, Inc., San Francisco, USA). For this, Resend receives your email address, the content of the email with the link and technical delivery data. Resend processes the data only on our behalf (Art. 28 GDPR). The data may be transferred to the USA in the process. The basis for this is the certification of Plus Five Five, Inc. under the EU-US Data Privacy Framework and, in addition, the EU standard contractual clauses in Resend's data processing addendum. The legal basis for sending is the contract of use (Art. 6(1)(b) GDPR).

If you email us, we process your address, your message and the technical data of the email to answer you (Art. 6(1)(f) GDPR). The mailbox of our contact address is hosted by IONOS SE, Montabaur, Germany. We delete your emails once your request is settled, at the latest after 12 months.

Backups

Our server backs up the database every night and keeps the backups for 14 days. In addition, Hetzner backs up the entire server daily, including logs and database backups, and overwrites these backups after seven days. Supabase keeps no backups of its own on our plan. Deleted data can therefore remain in backups for up to three weeks. We use the backups only to restore the service after an outage (Art. 6(1)(f) GDPR).

Cookies

boardfella only sets cookies that the site technically needs:

• ai_session keeps you signed in. It expires after seven days or when you sign out.
• csrf_token protects forms against forged requests (cross-site request forgery). It expires after one hour.
• oauth_state and oauth_redirect exist only while you sign in with GitHub (see “Signing in with GitHub”).

These cookies do not require consent (Section 25(2) no. 2 of the German Telecommunications Digital Services Data Protection Act, TDDDG). We base signing in on the contract of use (Art. 6(1)(b) GDPR) and the protection against attacks on our legitimate interest (Art. 6(1)(f) GDPR). boardfella does not use any other browser storage, such as localStorage.

Fonts and external content

Our own server delivers all fonts and files of the site. Our server requests the figures for the GitHub project on the home page from GitHub; your browser does not connect to GitHub for this. Links to GitHub, X or LinkedIn only open the pages of these providers when you click them. From then on, their privacy policies apply.

Do you have to provide data?

Not to read the site. Without your IP address, however, your browser cannot load it. For an account we need your email address, username and password, and for the leaderboard your uploads. Without this information you cannot create an account or take part in the leaderboard. A connected computer always sends its daily figures for “My usage”. If you do not want that, do not connect a computer, or disconnect it.

Your rights

You have the right of access (Art. 15 GDPR), rectification (Art. 16), erasure (Art. 17), restriction of processing (Art. 18) and data portability (Art. 20). Write to us at hello@boardfella.com. You can also change your display name, username, avatar and leaderboard visibility yourself in the settings.

You also have the right to lodge a complaint with a data protection supervisory authority (Art. 77 GDPR). The authority responsible for us is the Hessian Commissioner for Data Protection and Freedom of Information (Der Hessische Beauftragte für Datenschutz und Informationsfreiheit), P.O. Box 3163, 65021 Wiesbaden, Germany, datenschutz.hessen.de.