Privacy Notice

• You can play as a guest without an account. Creating a room and saving your stats requires an account (email + password).
• We store your account details, your in-game activity, your chat messages, your avatar, and gameplay statistics.
• We use a privacy-focused analytics tool (PostHog, hosted in the EU). No advertising, no session recording, no third-party tracking cookies.
• Game rooms and all in-game chat are automatically deleted about 24 hours after the room is created.
• Our database, login, file storage and analytics run on Supabase, Vercel and PostHog.

a) The moment you open the site — even before you sign in

• Our analytics (PostHog) records a page view and a randomly-generated device identifier, stored in your browser's local storage (not a cookie). It lets us count returning visitors without identifying you by name.
• Your browser type and operating system are recorded by analytics.
• We do notstore your IP address in our analytics (PostHog’s “Discard client IP data” setting is enabled).
• If you are already signed in, your session is restored and your analytics activity is linked to your account's internal id only — a random UUID, never your email or username.

b) If you play as a guest (no account)

• The display name you choose (shown to the other players in your game).
• A random player id kept in your browser so you keep your seat if you refresh or reconnect.
• Your in-game activity for that game: the room you join, your secret role, your actions, votes, minigame score, and any chat messages you send (see (d)).

c) If you create an account

Handled by Supabase Authentication:

• Your email address and a password. The password is stored only as a secure hash — we never see or keep it in plain text.
• Email is used to confirm your account and to reset your password. You log in with your email.
• A username (shown publicly to other players).
• A character avatar you design (a set of style choices such as build, hair and colours — not an uploaded photo), stored with your profile and shown publicly.
• Any featured badges you choose to display, and the date your account was created.

d) In-game data and chat

• Your assigned secret role, votes, minigame answers and score, in-match energy, and player state (active / imprisoned / hospitalised / out).
• The chat messages you send: one-to-one "outreach" messages, group consultation chat, team (camp) chat, and dead-player chat. They are visible to other players according to the game's rules and are stored until the room is deleted.
• Whether you have been muted, and your connection state.

e) Friends, statistics and progression (accounts only)

• Your friendships (who you have added, and who added you).
• Your game results — which finished games you played, your role and team, and whether your side won — used for your profile statistics and the worldwide leaderboard.
• Your achievements/badges, in-game currencies (Life Proficiency, Mano, Soul Fragments, XP and level) and ranked standing.

f) Safety and moderation

If you report another player, or are reported, we log the report: who reported whom, an optional reason, and the game it happened in. We use this to detect and act on abuse; after enough separate reports in one game, a player is automatically muted for that game. We also filter messages for slurs and profanity.

g) Stored on your own device (local storage, not cookies)

For the app to work, small items are kept in your browser's local storage: your guest/player id and name, your analytics device id, which first-time tips you have dismissed, your daily-reward claim date, and your per-game block/report choices. These stay on your device.

We rely on the following service providers ("processors"), who store and process data on our behalf:

• Supabase — database, authentication and realtime. Holds everything in sections 2(b)–2(f). Region: EU (West).
• Vercel— hosts and serves the website; may process technical request logs. Served from Vercel’s global edge network; your personal data is stored in the EU (see Supabase above).
• PostHog (EU Cloud) — product analytics (section 2a). Hosted in the European Union.
• Resend — sends your account-confirmation and password-reset emails (processes your email address).
• Discord — if you click our Discord link you leave our site and Discord's own privacy policy applies.

Your personal data is stored within the EU/EEA. Some providers operate global infrastructure for content delivery and email routing; where any processing occurs outside the EU/EEA it is covered by that provider’s standard data-protection safeguards (such as Standard Contractual Clauses).

• To provide the game (accounts, matchmaking, gameplay, chat, friends, statistics): necessary to perform the service you ask for (contract).
• Account security and email (confirmation, password reset): contract and our legitimate interest in keeping accounts secure.
• Safety and moderation (reports, muting, message filtering): our and other players' legitimate interest in a safe service.
• Analytics (improving the game, understanding retention): your consent, which account holders give when creating an account (see below), and our legitimate interest in a privacy-preserving form for guest play (no ads, no cross-site tracking, no IP stored).

How we obtain consent: when you create an account you confirm you have read and agree to this notice. There is no separate cookie or consent pop-up when you open the site. You can withdraw your consent at any time by contacting us (section 6); this does not affect processing that is necessary to run the game.

• Game rooms, players and all in-game chat: automatically deleted about 24 hours after a room is created. Un-started lobbies are deleted after 10 minutes.
• Account data (profile, username, avatar, email, friends, badges, currencies, ranked) and game results: kept while your account exists. Game results are retained for your statistics even after the room itself is deleted.
• Moderation reports: kept only as long as necessary to keep the game safe (to detect repeat abuse and act on it), and deleted when no longer needed for that purpose.
• Analytics: retained by PostHog for up to 12 months, then deleted or aggregated.

If you delete your account or ask us to erase your data, we remove your account data (see section 6).

Under the GDPR (and comparable laws) you can ask us to: access the data we hold about you; correct inaccurate data; delete your data ("right to be forgotten"); restrict or object to certain processing; receive your data in a portable format; and withdraw consent where processing is based on it.

You also have the right to complain to your data-protection supervisory authority (in the Netherlands, the Autoriteit Persoonsgegevens). To exercise any of these, contact Nowmatstudios@gmail.com. We respond within the time the law requires (one month under the GDPR).

We do not use advertising or third-party tracking cookies. Our analytics uses your browser's local storage (not a cookie), does not record your screen, and does not follow you across other websites.

The game is intended for users aged 13 and over. We do not knowingly collect data from children under 13. Note that in some countries the age at which a child can consent to data processing on their own is higher (16 in the Netherlands and parts of the EU); where that applies, a parent or guardian’s consent is required. If you believe a child under the applicable age has given us their data, contact us and we will delete it.

Passwords are stored hashed by Supabase Authentication, and data is transmitted over encrypted (HTTPS) connections. We continue to strengthen our safeguards as the game grows.

We may update this notice. The "last updated" date at the top shows the current version.

M.M. Ansinger (Nowmat Studios) — Nowmatstudios@gmail.com.