Privacy

Bystanders is a party game played in one room. We collect as little as possible and we do not use your data for advertising or marketing.

Guests (players who join with a room code)

Guests give only a display name. Your browser gets an anonymous session identifier so that you keep your seat and your card when you reload the page. No email address, no account.

Hosts (accounts)

Hosts also give an email address and a password. They are stored by our authentication provider (Supabase Auth). The email address is used only to sign in, to confirm the account and to reset the password. It is never shown to other players and never used for marketing. Other players only see the display name you choose.

Cookies

We use only the cookies that keep you signed in (as a guest or as a host). They are strictly necessary for the game to work, so there is no cookie banner. There are no tracking cookies and no advertisements. The game also remembers two choices in your browser's local storage: that you have seen the short introduction in the lobby, and how you reveal your card. They are not sent to us.

What we store and for how long

• Rooms, including the private cards and every player's answers, can no longer be opened 24 hours after the game was started. A room whose game was never started closes 30 days after it was created. A closed room is deleted by a clean-up that runs once a day, so at most a day later, together with the names of the players who joined it.
• Game history. When a game is finished it is saved to the host's account: the players' display names, the team's answers, the score and the results. It never contains private cards or individual answers. It is kept until the host deletes that game or the account.
• Abuse protection. To limit automated requests we keep short-lived counters based on a one-way hash of the IP address. The daily clean-up deletes them, at the latest two days after they were written.
• Problem reports. When you use "Report a problem" we store what you wrote, the category you chose, the kind of page you were on (for example "room", never the address or a room code), the type of your browser (for example "Chrome on Android") and, if you were in a room, which case was played and in which phase. Your email address is stored only if you enter one, and it is used only to answer you. A report is not linked to your account. Only the operator of the site can read reports. If you send a report from a room, your browser sends the room code so that the case and the phase can be looked up; the code itself is not stored. A report is kept until it has been dealt with and is deleted 90 days after it was resolved.
• Usage counts. To see how the game is used we count events per day: how often each kind of page was opened, and how many rooms and games were created, started and finished, per case and group size. These are plain counts. They contain no names, no account, no room code and no IP address, we set no cookie for them, and they are not shared with anyone. If your browser sends "Do Not Track" or "Global Privacy Control", your page views are not counted.

Deleting your data

A host can delete a single game on its history page, or delete the whole account on the Account page (type DELETE to confirm). Deleting the account removes the account, the rooms it created and the complete game history. Guests have no account to delete: their rooms are deleted as described above. A guest's display name stays in the host's saved game until the host deletes that game or the account. The anonymous session identifier of a guest stays with our authentication provider; it holds no name and no email address.

Service providers

The app is hosted on Vercel and stores its data with Supabase. Emails for account confirmation and password resets are sent through an email provider on our behalf.