Privacy Policy

Effective date: 2 May 2026

1. Who we are

Party Blast ("the Service", "we", "us") is a free browser-based multiplayer party game operated by Miles Cuthbert. If you have privacy questions, contact us at milescuthbert98@gmail.com.

2. What we collect

We collect the minimum needed to run a real-time party game:

Display name you enter at the home screen.
Avatar (one of the built-in emoji choices) and avatar colour.
A random player ID generated in your browser the first time you visit, stored in your device's localStorage.
Team assignment (A or B) when the host enables team mode for a room.
Scores and game stats from games you play (points, games played, wins, per-game records).
Room and game state while a room is active — who is in the room, whose turn it is, votes, predictions, drawings, cards in hand, the current Party Mix queue, and so on.
Voice recordings when you play Hum It. With your permission your browser records up to ~8 seconds of audio of you humming a song. The clip is uploaded to our database provider's Storage bucket and shared with the other players in your room so they can hear it and guess. Recordings are visible to anyone with the playback URL — see Section 5 for retention.
Scheduled game night data when a host schedules a future game night — the title and date/time you set are stored on the room so other players can see the countdown.
Your IP address is necessarily visible to our hosting and CDN providers as part of ordinary web traffic. We do not store it ourselves.

We do not collect: your email address, real name, phone number, payment info, precise location, or any analytics or advertising identifiers.

3. Why we collect it

To run the game (sync state between players, show your name and score to other players in your room).
To deliver Hum It audio so the other players in your room can hear what you've hummed and guess the song.
To deliver scheduled-game-night reminders so a room shows the right countdown to all players.
To power the all-time "Hall of Fame" leaderboard, if enabled.
To operate and secure the service (hosting logs, abuse prevention).

4. Legal basis (UK / EU GDPR)

We rely on:

Legitimate interests, for running the game and keeping a basic leaderboard.
Your consent, given when you enter a name and click Create Room or Join, for processing your display name and game participation.

5. How long we keep it

Room data is ephemeral. It stays while the room is active and is removed when the last player leaves or after a period of inactivity (typically 24 hours).
Hum It audio recordings are uploaded to a Supabase Storage bucket and accessed by URL while a round is in progress. They are not deleted automatically today; if you want a recording removed, contact us with the room code and round number and we will delete it.
Leaderboard data (display name, avatar, totals, per-game records) is kept indefinitely so your all-time stats survive between sessions. You can ask us to delete your entry at any time.
Hosting and database provider logs are kept according to those providers' own retention policies (see Section 7).

6. Cookies and localStorage

We do not set any cookies of our own. We use your browser's localStorage to remember:

Your randomly generated player ID (pb_player_id)
Your chosen display name (pb_player_name)
Your avatar choice and colour (pb_player_avatar, pb_player_avatar_color)
Your sound on/off preference (pb_sound)
A per-room session-history log of recent results (pb_history_<ROOMCODE>) — this stays on your device and is never sent to our servers.

You can clear all of these at any time through your browser's site data settings.

Third parties we load assets from (see Section 7) may set their own cookies or log your IP. We don't control those; see their policies for detail.

7. Who we share data with (sub-processors)

Party Blast itself is a static site plus a small database. These third parties necessarily see some of your data:

Hosting / DNS Cloudflare: serves the site from its global edge network, provides DNS for cuthbert.cloud, and runs bot-protection / WAF. Sees your IP, user agent, and requested URL via normal web traffic.
Static hosting Netlify: serves the site's static files. Sees your IP and basic request metadata.
Database & Storage Supabase: stores your display name, avatar, player ID, scores, live room state, scheduled-game-night metadata, and Hum It audio recordings (in a public Storage bucket so other players can stream them).
Fonts Google Fonts (fonts.googleapis.com): loads the web fonts. Receives your IP.
CDN jsdelivr (cdn.jsdelivr.net): serves the Supabase JavaScript library. Receives your IP.
QR api.qrserver.com: generates a QR code image when you open the Share Room modal. Receives the shareable room URL you are trying to share.
Optional Apple iTunes Search API (itunes.apple.com): when you tap the 🎧 preview button while picking a song to hum, your browser sends the song title to Apple's public Search API to fetch a 30-second preview clip. Apple receives your IP and the song title per their own privacy policy. The preview audio streams directly from Apple's CDN to your browser; we never see it.
Optional YouTube: only used as a fallback when Apple has no preview for a song — your browser then opens a YouTube search in a new tab. YouTube/Google receives your IP and the song title per their own privacy policy. We do not embed YouTube on the page.
Optional Google Calendar: when a host clicks "Add to Google Calendar" for a scheduled game night, your browser opens Google Calendar in a new tab with the event details prefilled. We don't transmit anything to Google ourselves.

If this list ever changes, we will update this policy.

7a. Microphone access (Hum It only)

The Hum It game asks your browser for microphone permission only when you tap "Start recording". You can deny it; the game then degrades to text-only and you won't be able to hum. The recording is captured locally, encoded as WebM/Opus (or your browser's default), and uploaded to our Storage bucket where the other players in your room can play it back. We do not transcribe, analyse, or use these recordings for anything other than the round you uploaded them in.

8. Your rights

If UK or EU data protection law applies to you, you have the right to:

Request a copy of the personal data we hold about you
Ask us to correct inaccurate data
Ask us to delete your data (for example, remove your leaderboard entry)
Object to or restrict our processing
Request your data in a portable format
Withdraw consent at any time (noting this won't affect past processing)
Complain to your local data protection authority (in the UK, the ICO)

To exercise any of these, email milescuthbert98@gmail.com with your display name so we can find your record.

9. Security

Connections to the site and the database are encrypted with HTTPS. The database uses our hosting provider's standard access controls. We cannot guarantee perfect security; please do not enter sensitive personal information as your display name.

10. Children

Party Blast is intended for users aged 13 and over (or the minimum age in your country, such as 16 in parts of the EU). We do not knowingly collect data from children below that age. If you believe a child has entered data, contact us and we'll remove it.

11. International transfers

Our sub-processors may process your data outside your home country, including in the United States. Those transfers rely on the relevant provider's standard contractual clauses or equivalent safeguards.

12. Changes to this policy

We may update this policy. Material changes will be reflected here with a new effective date. If the change is significant, we may also surface a note on the home screen.

13. Contact

Miles Cuthbert
Email: milescuthbert98@gmail.com