Privacy, in plain words.

Playing as a guest

When you create or join a room, your browser receives a guest cookie. It holds a random token that lets this device get back to its seat after a refresh or a lost connection; the server stores only a hash of it. It expires after 30 days. Telling us on the pricing page that you would pay later sets the same cookie if this device has none yet, only to count that one click and to rate-limit it.

We also keep your language choice in a cookie for one year, and a few display settings, such as the colour theme, in your browser's local storage. None of this is used for advertising or to follow you across other sites.

When you arrive on one of our public pages from another website (a search engine, an AI assistant, a social site or any other site), the browser tab notes which of our pages it was, which kind of site sent you and which site that was (such as Google, ChatGPT or Reddit, or just “another website”), in session storage. It is deleted when you close the tab and never leaves your device unless you create a room within 30 minutes; see Statistics.

Solo puzzles save your progress on each puzzle (the questions you asked, the witnesses you suspect, who you crossed out and your result), and the days you played for your streak, only in this browser's local storage, so a reload picks up where you left off; clearing the site's data removes it. Each question and answer goes to our server to be answered and judged, and the server keeps nothing about who played (see Statistics). A shared result link carries only how many tries each puzzle took, never who you are.

Your nickname is public in the room

The nickname you enter is shown to everyone in that room, on the shared screen, and in the results and game history of the people you played with.

If you are signed in, the nickname field starts with your default name: your Google name or Discord display name, unless you set a different default on your account page. Change it before you join if you would rather not show it.

Signing in with Google (optional)

Signing in keeps your game history across devices. When you sign in, Google shares with us a stable account identifier, your email address and whether Google has verified it, your name and the address of your profile picture. We store the identifier only as a hash.

We use these to sign you in, to suggest your default nickname, and to show you your own account page. Your email address, Google name and profile picture are shown only to you: never to other players, on the shared screen, in results or in statistics. We do not send you email and do not use the address to match or merge accounts.

Your profile picture is loaded from Google by your browser, and only on your account page. The sign-in session lasts 7 days.

Signing in with Discord (optional)

Signing in with Discord also keeps your game history across devices. We ask only for Discord's basic "identify" permission, never for your email address, your servers, your friends or your messages. Discord then sends your account identifier, username, display name, avatar and a few account settings such as your language; we keep only the identifier, your display name and your avatar, and discard the rest. We store the identifier as a hash, but the address of your avatar on Discord contains your Discord user ID, so while we keep your avatar we also hold that ID.

We use these to sign you in, to suggest your default nickname from your display name, and to show you your own account page. We never use your Discord username, because it identifies you across Discord. Your Discord name and avatar are shown only to you, just like a Google profile.

A Discord account and a Google account are separate accounts here: signing in with the other one starts a new account with its own history, and we never link or merge them.

Your avatar is loaded from Discord by your browser, and only on your account page, so Discord sees that request and your IP address. Once we have read your details, we ask Discord to end the access it gave us; we never store it. The sign-in session lasts 7 days.

Games and results

While a game runs, the server keeps its secret state, such as roles, words and individual votes, and sends each player only what they are allowed to see. That private state is deleted 7 days after the game ends. The public record (who played, the revealed roles, the winner and what everyone saw during the game, such as each seat's team votes and how many fail cards a mission had) is kept with no end date so players can look back at it. Secret choices, such as who played which mission card, are never kept after the 7 days.

Statistics

We record a small set of product events, such as a room being created or a game being completed, in our own database. Each event carries a pseudonym computed from your device identifier with a secret key. It never contains your nickname, room code, role, words, votes or account.

Solo puzzles are the exception: fetching puzzles and submitting an answer record only a count without a pseudonym: the game, the language, whether it was the day's puzzles, an earlier issue or another round, the difficulty and whether the answer was right.

On our public pages we use PostHog, a third-party service, for analytics that help with development and product improvement. It is not used for advertising.

We also count requests for published public pages using only a fixed page category, language, source-site category and browser or crawler category. These counts contain no visitor identifier, raw address, search query, referrer or full browser identification string, and we do not link them to your room events.

We also measure how fast our pages load. Your browser times the page load and sends the result to our server, without cookies and without storing anything on your device. On a room page it also times how long connecting and reconnecting take and how long each of your actions takes to be confirmed, and sends those when the page is hidden or you leave the room. Each result carries the kind of page (never a room code or the address of an account page), whether your device looks like a phone or a computer, and where you are: your country and, in the United States and Canada, your state or province, as Cloudflare reports it for your connection. We do not store your IP address or city with it, and we do not link it to any room, game or account. We use it only to find places where the site loads slowly, and keep it for 30 days.

When you create or join a room, that event also records the country Cloudflare reports for your connection, and your device type (phone, tablet or computer), operating system and browser family as your browser or our app announces them. We never store your IP address or your browser's full identification string.

If you used “Pick a game for us” before creating the room, the room-created event also records the three answers you gave (how many of you, what it should feel like, whether there is a TV or projector) and the game it suggested, only to count how the guide is used.

If you create a room within 30 minutes of arriving from another website, the room-created event also records which of our pages you arrived on, which kind of site sent you and which site that was (from a fixed list of well-known sites, otherwise just “another website”), only to count which pages and sites lead people to play. We never record the address you came from, what you searched for or any other site you visited.

In the PartyGame app

The PartyGame app for phones and tablets gets the same guest cookie the first time it is opened, and renews it each time the app starts, so a device can be counted once and find its seat again. Besides the events above, the app records that it was opened (and whether for the first time), that a QR code was scanned and that the device entered shared-screen mode: the event name and the same pseudonym, nothing else.

If you turn on new game reminders, the app asks for permission to send notifications and gives us this device's push token, whether it runs iOS or Android, and the app's language. We keep them only to send those reminders, never during a game. When you turn reminders off, we delete the token as soon as the app can reach us; we also delete it when the device has not used the app for 30 days.

Your default nickname, favourite games, the rooms this phone opened and your app settings are kept on the phone, not uploaded as lists. As on the site, the nickname is sent when you create or join a room, and the app asks the server whether a room you opened is still open.

Who else is involved

The site runs on servers we operate. Cloudflare carries the traffic between your browser and those servers, and so handles your IP address and request details as our network provider. Google's or Discord's sign-in service is involved only if you choose to sign in with it. If you turn on reminders in the app, Expo's push service, and through it Apple's or Google's, receives the device's push token and each reminder's text so it can deliver them. If you buy Party Pass or Party Plus, Stripe sells it to you on our behalf as the merchant of record and handles the payment and any sales tax: you enter your card, email and billing address on Stripe's checkout page, never on ours. We give Stripe only an internal account number to match the purchase to your account, and Stripe tells us what you bought and until when. Stripe keeps its own payment records under its own privacy policy.

How long we keep things

• Guest cookie and device credential: 30 days.
• Counts of public-page requests and page-load timing: 30 days.
• App push token (reminders on): until you turn reminders off (deleted as soon as the app can reach us), or with the device credential 30 days after the app was last used.
• Sign-in session: 7 days. An unfinished sign-in attempt: 10 minutes.
• Private game state and vote verification data: 7 days after the game ends.
• Results, game history and the nicknames in them: kept with no end date. Deleting your account replaces your name in them; a guest can ask us, using the contact below, to remove theirs.
• Your Google or Discord profile and default nickname: until you delete your account.
• Purchases (which plan, when it starts and ends, and the Stripe customer number): until you delete your account. Stripe keeps its payment and invoice records as long as the law requires.
• Backups: before each release we back up the database on the same server. Backups older than 7 days are removed when the next release goes out, so a backup can last longer if no release happens for a while.

Export and deletion

On your account page you can download your data (your profile, statistics and game history, as an Excel file) or delete your account. Both ask you to sign in again if your last sign-in was more than 5 minutes ago. The download does not include purchases; Stripe emails you a receipt for each one. If you have Party Plus or a Party Pass, deleting your account cancels it at once and ends what you paid for, with no refund.

Deleting your account signs you out everywhere, ends any game you are in, replaces your name in other players' results with a placeholder, and erases your email address, Google or Discord name, profile picture and default nickname. Copies in backups remain until those backups are removed (see above). Restoring a backup does not re-apply deletions automatically: if we ever had to restore one, an account deleted after that backup was taken could come back and would need to be deleted again. Write to us if that happens to you. A guest has no account to delete: the guest cookie expires on the schedule above, and a guest can ask us, using the contact below, to remove their nickname from past games.