privacy policy

1. playing as a guest vs. linking a free account

guest sessions: you can play party havoc! without registering an account. when you visit, supabase assigns an anonymous session identifier stored in your browser’s local storage along with your chosen room nickname, doodle avatar settings, and audio preference so you stay connected to rooms and keep local progress on that browser.

optional free accounts: if you choose to link an email + password or sign in with google, we store your email address, authentication provider identifier, and linked user id in supabase auth so your level, xp, virtual coins, unlocked cosmetics, career stats, and pinned medals sync across devices.

2. payments & billing information (stripe)

all havoc+ purchases (including the $2.00 1-week pass, $4.00/month pass, and $32.00/year pass) and self-serve billing changes are processed directly by stripe.

party havoc! never sees, collects, or stores your credit card number, cvv, bank details, apple pay token, or billing street address on our servers. stripe shares only non-sensitive billing status metadata with our backend (your stripe customer id, subscription id, plan tier, renewal/expiration timestamp, and payment event id) so we can unlock havoc+ perks and credit bonus coins.

3. room gameplay & user inputs

while you play in a room, game state such as drawings, clues, guesses, votes, moves, and your display name are transmitted in real time to the other players inside your 4-letter room code. temporary room data is automatically cleaned up after rooms go inactive.

4. local storage & first-party analytics

we do not use third-party advertising networks, behavioral ad trackers, or sell personal information to third parties. we record lightweight first-party aggregate event counts (such as page visits, device category, rooms created, and games completed) inside our own supabase database solely to keep the service reliable and see which games people enjoy.

5. how we share information

we never sell or rent your data. data is shared only with core infrastructure providers strictly necessary to run the site:

• supabase — authentication, realtime multiplayer rooms, and profile database hosting.
• firebase hosting (google cloud) — static web hosting and content delivery.
• google oauth — only if you click “continue with google”, solely to verify your email identity.
• stripe — only if you purchase or manage a havoc+ pass, to process payment, tax calculation, receipts, and subscription management.

6. data retention, children’s privacy & your rights

account & privacy rights: wherever you live (including under gdpr, uk gdpr, ccpa/cpra, and state privacy laws), you may request access to, export of, correction of, or permanent deletion of your account and profile data at any time by contacting us below.

children’s privacy: guest family play requires no personal data. creating a registered account or purchasing havoc+ is intended for individuals age 13 and older (or with verifiable parent/guardian permission where required). if a parent or guardian believes a child under 13 registered an email account without consent, contact us and we will promptly delete it.

7. contact & updates

if we make material updates to this privacy policy, we will post the revised version at https://partyhavoc.web.app/privacy with an updated date. for privacy questions or data deletion requests, email support@partyhavoc.com.