Privacy Policy

2. Data we collect

We collect only the data needed to create accounts, run synchronized private games, apply responsible-play settings, protect the service, and provide support.

• Account and profile. Your account nickname, table display name, language, selected preset avatar, optional uploaded avatar, avatar-consent time, and account/security timestamps. Your passcode is stored only as a one-way password hash; we do not store the readable passcode. A bearer token is used to keep you signed in.
• Age and responsible-play settings. Country and minimum-age selection, age-confirmation time, responsible-play agreement and version, alcohol or non-alcohol participation mode, personal limits, intensity, timer, hydration, and break preferences. These settings are used for eligibility and safer gameplay—not to diagnose intoxication.
• Private-room and gameplay data. Room names and codes, membership and host role, connection/presence state, game mode and settings, turns, cards, prompts, response choices such as Skip, Water, non-alcoholic, or alcohol, timestamps, room events, and game history. Other authorized players in the same private room receive the synchronized state needed to play.
• Content you submit. Custom question packs, prompts, translations, and content reports, including the reason and optional details you provide.
• Optional photos and consent. If you choose a camera or gallery feature and confirm consent, we process the image, whether it is an avatar or a before, during, or after game photo, the photo type, consent time, and optional display-only frame or sticker choice. Photos are not required to play and are not automatically published to the public.
• Security and network data. IP address, request and connection metadata, failed sign-in and rate-limit information, server timestamps, and diagnostic logs. Rate-limit bucket keys use one-way hashes of IP addresses, nicknames, or internal account identifiers. Per-account API buckets expire after 1 minute; buckets for player authentication and administrator sign-in expire after 15 minutes. Infrastructure logs may temporarily contain an IP address and request metadata.
• Data kept on your device. The app stores your sign-in token, profile, onboarding choices, locale, host presets, device preferences, and favorites in device-protected storage where supported. Camera, QR scanner, system photo picker, save-to-library, sharing, haptics, and local-notification features run only when you invoke or enable them. Local countdown, hydration, and break notifications do not require us to store a push-notification token.

The current release does not use advertising or third-party analytics SDKs and does not collect precise location, contacts, microphone recordings, advertising identifiers, purchases, or server push-notification tokens. If that changes, this policy and the app-store privacy disclosures must be updated before release.

3. How we use data

• Create and secure your account, restore your settings, and authenticate requests.
• Run private rooms, synchronize turns and timers, enforce host and player limits, provide non-alcoholic alternatives, and deliver local reminders you enable.
• Prevent duplicate game actions, abuse, unauthorized access, and service disruption; investigate errors and security events.
• Respond to support, privacy, deletion, and content-moderation requests.
• Comply with law, protect users and the service, and establish or defend legal claims when necessary.

4. When data is shared

We do not make private-room data public. We disclose data only in the following limited situations:

• Private-room participants receive display names, avatars when one is enabled, player status, and the committed room/game state needed to play. Optional photos are not automatically posted publicly.
• Hosting, database, storage, networking, and security providers may process data for us under instructions to operate and protect the service. They may not use it for their own advertising.
• When you deliberately use the operating system's Save or Share action, the destination you choose processes that copy under its own privacy terms.
• We may disclose information when required by law or when reasonably necessary to protect a person, investigate abuse, or secure the service.

We do not sell personal data and do not share it for cross-context behavioral advertising.

6. Retention and deletion

• Account and preference data remains while the account is active, unless you update or delete it sooner.
• Uploaded avatars remain until replaced, removed, or the account is deleted. Account-owned game photos are deleted when the account is deleted or when a verified deletion request is completed.
• Committed room, turn, card, event, and prompt-snapshot records may remain in de-identified form for as long as the related shared room/game record exists so other participants' histories and multiplayer reconciliation remain consistent. The current release does not apply a fixed automatic expiry to these shared records.
• Hashed per-account API rate-limit buckets expire after 1 minute; hashed rate-limit buckets for player authentication and administrator sign-in expire after 15 minutes. Operational logs are kept only through the configured security and diagnostic rotation period.
• If a deleted item exists in a protected backup, it remains inaccessible in normal service use and is removed when that backup is overwritten under the applicable backup rotation. A legal hold may delay deletion only where the law requires it.

For the exact deletion steps, data removed, retained records, and external request process, see Account deletion.

9. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete, restrict, or object to processing, receive a copy of your data, or withdraw consent. We may need to verify that you control the account before acting on a request.

• Update your display name, language, participation, reminder, and safety preferences in Settings.
• Revoke camera, photo-library, or notification permission in device settings.
• Remove an avatar or avoid capturing, saving, or sharing optional photos.
• Delete the account directly in the app, or use the external request path if you cannot access the app.
• Email the privacy contact to ask for access, correction, a portable copy where applicable, or to raise a concern.