Privacy Notice

Last updated: 2026-10-24 Jurisdiction: Spain (EU)
Data controller: Miguel Mesa Chica
Contact: admin@partyf.es

---

1. What We Collect

PartyF is a real-time party game platform. You do not need an account to play. An optional account ("PartyF Pass") exists for people who want to keep stats and badges; everything about it is in §11. Decks you save to an account or share are covered in §12. An optional email list for news about PartyF is covered in §13.

When you use PartyF, we temporarily store:

• Your display name — the name you type when joining a room. This is visible to all other players in that room during gameplay.
• Your avatar emoji — the icon you select for your player. It is visible to the other players in that room during gameplay.
• Your game submissions — your answers, responses, and moves within each game, and any topic you suggest for a coming round (visible to the room and removable by the host). These are broadcast to other players in the room as part of normal gameplay.
• Your points/score — automatically calculated during games and visible to other players.
• A custom deck the host attaches — a copy of the deck's cards, kept with the room so its games can use them. The cards are shown to the room's players as they come up in play.

Important: Your display name is free text that you provide. If you enter your real name or other personal data, that becomes personal data in our system, even though we never ask for it.

Client-side storage: your browser also saves, in localStorage:

• your language preference, indefinitely;
• the last nickname you typed (while you are signed in, your account's display name), indefinitely, so you don't have to retype it next visit — this is cleared only if you clear your browser's storage yourself, choose "Also forget me on this phone" when signing out, or a different account signs in on this device;
• for 2-player games, the best combined score each pair has reached on this device, indefinitely. Each record is stored under a key containing the game and both players' display names as typed, so it is personal data if a real name was used. It stays on the device and is never sent to us;
• your last selected avatar emoji (while you are signed in, your account's emoji), your last three reactions, and interface choices you made on this device (for example, whether you collapsed the in-game header, tucked the reaction button away, prefer new rounds to pause on the rules screen, whether you want a short 3-2-1 countdown before a game starts, which themed pack you last picked for a game, your saved "My house rules" and the play mode and rule/timing choices you last used for a game, which one-time tips you have seen, short opaque codes (no text) of the last 300 built-in topics you were shown per game so suggestions vary (sent only to our server, so a new draw can avoid them), whether sound effects and vibration are on, whether PartyF should reduce motion and save data (Auto, On or Off), switched off Boardroom Bluff's contextual hint, or collapsed parts of its action panel), indefinitely, so PartyF can restore them; these are finite PartyF choices, not account/profile data;
• the custom decks you write on this device (up to 10 drafts: name, language, kind and cards), until you delete them or clear browser storage. If you save a draft to an account, the draft also records the id of the saved deck and of the account (no name or email), so it is not offered for import again. Drafts stay on the device unless you attach one to a room or save it to an account (§12);
• while you're in an active session, your room code/session token/player ID, so you can rejoin after a refresh without re-entering a room code — this is cleared when you leave or end a session, but a stale copy can remain in your browser's storage until then even after the session itself has expired server-side;
• temporarily, a request you tried to submit while offline may be queued in your browser so it can be retried. The queue can contain the session token and your submitted game content. Entries are discarded after 10 minutes when the retry queue next runs, but a stale local copy can remain until that happens or you clear browser storage;
• and, in sessionStorage for the current tab only, a one-time marker that lets the app reload once after an update without looping (it holds no personal data and is cleared once the app has loaded), and the "Your night" summary on the results screen: the room code and, for each game you finished in that room, its type and whether you played, won or reached the top three, plus any badges you earned there. It covers one room at a time, is written whether or not you have an account, is never sent to us, and is deleted when you close the tab. The same tab-only storage also keeps a few markers (holding no personal data) and your unsent Draw a Phone award picks, so a reload does not lose your picks, replay a screen you have already seen, or reopen a card you already folded (storage.md §1.10–§1.13).

Saved Draw a Phone images: the comic-strip and sticker images you save from a Draw a Phone results album are created on your device, using that game's nicknames and drawings. Unless you switch on "Hide names", the images show each player's nickname. They are not sent to PartyF and PartyF does not store them. What you do with a saved image, such as sharing it, is up to you.

See storage.md for the full technical disclosure.

Feedback you choose to submit: PartyF has an optional in-app "Feedback" link for reporting bugs or suggesting features/games. If you use it, the free-text message you write — and a screenshot, only if you actively choose to attach one — is sent to our error-tracking vendor, Sentry. The form does not show a name or email field, so we don't collect either through it. See §6 for more on Sentry.

Crash reports and product analytics: PartyF sends crash/error reports to Sentry and anonymous product-analytics events (e.g. which screens are viewed, which games are started/ended) to PostHog. PostHog derives an approximate country from your IP address for each event, as it does by default for every PostHog Cloud customer — PartyF's own code never stores your IP address, and logs it only when a request is rate-limited (kept up to 30 days, §8). This is active on the production site (partyf.es) today, not a hypothetical — this notice is written to also cover preview/staging deployments where either vendor may be unconfigured, hence "deployment-dependent" language elsewhere in this section, but for the site you are reading this on, both are on. See §6 for details.

What We Do NOT Collect

• Email addresses, except the optional email list in §13 (never needed to play, and never collected for accounts)
• Phone numbers
• Real-world addresses
• Payment information
• Account passwords

Exception — optional accounts (see §11): if you choose to create a PartyF account, we do store a small profile for you beyond the 6-hour session limit. Nothing in this list changes for people who play without one.

Exception — optional email list (see §13): if you choose to type your email address into the "PartyF news by email" form and confirm it, we keep that address on a separate list.

Exception — advertising (see §6): PartyF shows ads served by Monetag, which set their own cookies/device identifiers for ad delivery and measurement, independent of anything PartyF's own code stores — and only after you accept the in-app consent banner. This is disclosed in full in §6, not omitted here as it was in earlier drafts of this notice.

---

2. How Long We Keep It

This section covers session data (everything above). Optional accounts, which are kept longer, are covered in §11.

All session data is automatically deleted according to strict, enforced time limits:

• Hard cap: Sessions expire after 6 hours of creation, regardless of activity.
• Idle timeout: Sessions are automatically reaped if inactive for 30 minutes. The reaper runs every minute.
• Automatic deletion: We do not retain data after session expiry. Data is not backed up for recovery; it is deleted on expiry.

When you leave a room or the session expires, your data is gone. We have no way to retrieve it, and we do not retain it in any form.

---

3. Legal Basis

We process this data based on:

• Contractual necessity (GDPR Art. 6(1)(b)): We must store your name and submissions to provide the service.
• Our legitimate interest (GDPR Art. 6(1)(f)): Temporary storage of scores and session state is necessary to operate the game fairly.

Because the data is deleted automatically within hours, the privacy impact is minimal.

Optional accounts (§11) and saved and shared decks, including reports about them (§12), have their own legal bases, set out in those sections. The optional email list (§13) is based on your consent (GDPR Art. 6(1)(a)).

---

4. Where Your Data Lives

Sessions are stored on Google Cloud Run, region europe-west1 (physically located in Belgium). Data at rest and in transit are encrypted.

---

5. Who Can See Your Data

• Other players in your room: Your name, avatar emoji, submissions, and scores are visible to them during gameplay. This is how the games work. If you are signed in, they may also see your chosen badge and, only if you switch it on, your public profile (§11).
• Us: We can see session data for operational purposes (debugging, user support). We do not sell, share, or use this data for any other purpose.
• Google Cloud: Your data is stored on Google Cloud's infrastructure. Google's Cloud Data Processing Addendum applies automatically to all Google Cloud customers under the Cloud Terms of Service — there's nothing separate to sign or accept for this to apply.
• Anyone with a shared deck's link or code: the deck's name, language, kind and cards, never who made it. See §12.
• Our email provider (only if you join the email list, §13): the address you submit, and the messages sent to it, pass through the SMTP email service we configure, which acts as our processor.
• Sentry and PostHog (only on deployments configured to use them): If you submit in-app feedback, or if this deployment has crash reporting / product analytics enabled, that data is visible to us through Sentry's and PostHog's dashboards, for debugging and product-improvement purposes only. See §6.

We do not share data with any third party for marketing, analytics, or any other purpose.

---

6. Third-Party Data Transfers

Fonts are self-hosted (3 woff2 font files bundled with the app) and no third-party font requests are made. Confirmed against the deployed frontend: no fonts.googleapis.com/fonts.gstatic.com references remain in the codebase or the built image.

Error tracking (Sentry) and product analytics (PostHog) — both optional, per deployment. Frontend errors are always logged to your own browser console (console.error). Beyond that, each deployment of PartyF independently decides, at build time, whether to also connect to Sentry and/or PostHog; a deployment with neither configured makes no calls to either vendor.

• Sentry (EU data ingest): When configured, uncaught frontend errors and unhandled promise rejections are reported to Sentry for debugging. Sentry also powers the in-app "Feedback" link: submitting it sends your typed message (and a screenshot, only if you choose to attach one) to Sentry as a support ticket. The feedback form has no name or email input, so none is collected through it.
• PostHog (EU Cloud): When configured, PostHog collects anonymous product-analytics events (screenviewed and PostHog's own $pageview for the same screen views, gamestarted, gamestartcancelled, gameended, localhubopened, and localgameopened — screen views, which multiplayer games are started, cancelled before starting or ended, and when the single-phone games section and its games are opened; keepsakesaved — that a Draw a Phone image was saved, with only its format (story strip, all stories, drawing or sticker) and whether it was shared or downloaded, never the image or its content; plus connection-quality events wsstuck, wsgaveup, wsrecovered, wsatcapacity, resyncrequested, resyncapplied and resynctimeout — when the real-time connection stalls, gives up, recovers or is suspected at room capacity, and the state-refresh requests sent while it flaps) to help us understand how PartyF is used, including an approximate country derived from your IP address — standard PostHog Cloud behavior; PartyF's own code never stores the IP itself, and logs it only when a request is rate-limited (kept up to 30 days, §8). Game properties carry only the game id, player/round counts, how long the game ran (in seconds), and the instant-vs-gate start path — never names, guesses, or prompts. Connection-quality properties carry only the screen name, durations in milliseconds (msSinceLastFrame while the connection was silent, outageMs for a disconnection), the number of consecutive connection attempts that never opened (failures, only on wsatcapacity), the browser's network class (effectiveType/saveData, when the browser exposes it), and a state-revision number (revision, only on resyncapplied) — never room codes, tokens, nicknames, or message content; the state-refresh (resync*) events are rate-limited to at most one per event per 30 seconds per page. It is initialized with personprofiles: identified_only, so no persistent per-person profile is created unless the app explicitly identifies a user, which it does not currently do. Autocapture is explicitly disabled (autocapture: false in postHogAnalytics.ts) so PostHog only receives the named events above — PartyF is a text-heavy game (typed guesses, custom category names, drawing prompts), and default autocapture would otherwise send DOM element text from clicks/inputs, which could leak player-submitted content.

Email service provider (SMTP; only if the optional email list in §13 is switched on): the address you submit and the confirmation message (and later, news messages) are handed to the SMTP email provider we configure, which acts as our processor under a data processing agreement and sees the address and message content only to deliver them. The provider's name, location and any transfer safeguards will be listed here before the list is switched on.

Sentry and PostHog are third-party processors operating under their own privacy policies, independent of PartyF. PostHog's activation is gated behind PartyF's own consent banner (see below): it only starts once you accept, and stays off by default otherwise. See storage.md §2.1 for the technical detail.

Monetag (advertising): PartyF shows ads served by Monetag, in two formats: an in-page push-style unit that can appear anywhere in the app, and a native/vignette banner shown only on the static /games/<id>/ rules pages. Monetag may set cookies or use similar technologies (e.g. device identifiers) on your device to serve and measure ads. This processing is carried out by Monetag as an independent controller under its own privacy policy, not by PartyF.

Consent banner: PartyF asks for your consent via a first-party banner shown on your first visit (see storage.md §2.1 for the technical detail). If you decline the first time you are asked, Monetag's scripts never load and PostHog never starts; accepting unlocks both, and PartyF's own code checks this stored choice — rather than any Google or Monetag-provided consent tool — before either script is requested. You can change or withdraw your choice at any time, as easily as you gave it: choose "Privacy choices" in the footer of the home page, or in the "This phone" settings (tap your own name in a game's lobby, or open your profile from the home screen when accounts are available), to see the banner again with your current choice and pick Accept or Decline. Your choice also applies to the game rules pages (/games/…) from the next page you open there; to change it, go to the PartyF home page. If you decline after having accepted, PostHog stops collecting from then on and clears its own identifiers and session data from your browser. If ads had already loaded in your browser, the page reloads once so they stop: right away if you are on the home screen, otherwise (in a game room including its lobby, a single-phone game, or anywhere else) when you next return to the home screen. Declining stops new data collection; it does not delete cookies Monetag has already placed or data already sent to PostHog or Monetag. You can delete cookies in your browser settings, and you can ask us to delete analytics data (see §7).

The legal basis for the ad cookies themselves is consent, not legitimate interest/contract — that's settled under ePrivacy/GDPR for non-essential advertising cookies, not a judgment call, and it's what the consent banner above is built to collect.

---

7. Your Rights

Under GDPR and local data protection law, you have the right to:

• Access: Request a copy of the personal data we hold about you. Because our data has a hard 6-hour TTL, requests about session data must be submitted within the session window to be meaningful. Account, deck and email-list data are kept longer and can be requested at any time (§11–§13).
• Deletion: Request deletion of your data. Session data is deleted automatically on expiry, so this right is largely moot for it, but you may request manual deletion by contacting us. Accounts, saved decks and the email list are kept longer and have their own deletion routes (§11–§13).
• Rectification: Request correction of inaccurate data.
• Portability: Request your data in a structured, machine-readable format.
• Object: Object to specific processing (though the minimum processing we do is necessary for the service).
• Withdraw consent: Where we rely on your consent (ads and analytics, §6; the email list, §13), you can withdraw it at any time, as easily as you gave it, without affecting what was done before.
• Lodge a complaint: File a complaint with a data protection authority. In Spain this is the Agencia Española de Protección de Datos (AEPD, aepd.es); you may also complain to the authority of your own country.

To exercise these rights, contact: admin@partyf.es

For the optional email list, see §13 (withdrawal, access and erasure).

For saved and shared decks and for reports about them, see §12, which also explains what we can and cannot find for a given report (GDPR Art. 11).

---

8. Data Retention Summary

---

9. Contact

For privacy questions or data subject rights requests:

Email: admin@partyf.es
Organization: Miguel Mesa Chica (individual operator, not a registered company)
Jurisdiction: Spain (EU)

No dedicated Data Protection Officer is appointed. GDPR Art. 37 requires one only for public authorities, or for large-scale systematic monitoring or large-scale special- category-data processing — PartyF's ephemeral, non-systematic-monitoring processing (§1–§2), plus the small optional accounts, saved decks and email list in §11–§13, doesn't approach that threshold at any deployment scale realistic for this product. Revisit only if the product's data collection changes fundamentally (e.g. mandatory accounts, profiling, or special-category data).

---

10. Changes to This Notice

We may update this notice if our processing changes. Material changes will be published here with a new "Last updated" date.

---

11. If You Create an Account

Accounts are optional. You can play every game without one, and if you never sign in, none of this section applies to you. Signing in is offered by a "Sign in with Google" button, and only on deployments where accounts are switched on.

What we store about your account. Unlike the session data in §1, which disappears within hours, an account is kept until you delete it or it is deleted for inactivity (see below). It consists of:

• an internal account ID we generate;
• your Google account's sub, a stable identifier Google issues to us so we can recognise you when you sign in again. It is not your email address, and we do not receive or store your email address, your Google name or your Google profile photo;
• your display name and avatar emoji (chosen inside PartyF; there is no uploaded photo);
• your synced preferences: language, your saved "My house rules" (the room settings new rooms you host start with), and some of the remembered interface choices listed in storage.md §1.6 (which ones is set out in storage.md §1.6a), copied to the account so they follow you across devices. An account created before 24 October 2026 may also hold an older copy of your nickname, avatar and language; it is no longer used and is erased the next time you sign in, change a setting, or use the account more than a week after your last sign-in;
• your game statistics, per game type: games finished, won, finished in the top three and hosted, points earned, and when you last played. A game only counts if at least 2 players took part and at least 2 rounds were played; a game you host while sitting out as a viewer counts only as hosted. Statistics hold no names, answers, drawings or room codes;
• the badges you have earned, and your chosen badge;
• whether you have switched on "Show my profile in rooms" (off unless you switch it on); and
• your sign-in tokens. A token is stored on our side only as a SHA-256 hash, never in readable form, and is valid for 90 days. Your device keeps the readable token (see storage.md §1.6a) until you sign out or delete your account.

Decks you save to your account are described in §12.

We do not collect an email address for accounts. The separate, optional email list in §13 is not part of your account and is never linked to it.

Legal basis. We process your account data to provide the account you asked for: performance of a contract (GDPR Art. 6(1)(b)). If you do not create an account, none of this processing takes place.

Where it is stored. Account data lives in Google Cloud Firestore, in region europe-west1 (Belgium), the same region as the rest of PartyF (§4). Google acts as our processor under the Google Cloud Data Processing Addendum (§5).

Google sign-in and your IP address. Google's sign-in script (accounts.google.com, Google Identity Services) is requested only when you open the sign-in option on a deployment that has accounts on, never for visitors who simply play. Loading it means your browser contacts Google, which therefore sees your IP address and browser details under Google's own privacy policy, as an independent controller. PartyF does not receive that information from Google. This script is not loaded behind the consent banner in §6, because it is part of the sign-in you requested, but you can avoid it entirely by not opening sign-in.

Your seat in a room. When you create or join a room while signed in, or sign in while you are already in one, your seat in that room is linked to your account: games that end while it is linked count toward your statistics and badges, including a game already under way when you signed in. Signing out or deleting your account while in the room unlinks the seat, and you stay in the room as a guest. Your chosen badge, and your public profile if you show it, are copied onto your seat, and a change to either reaches the room you are in straight away.

Your public profile in rooms. If you switch on "Show my profile in rooms" in your profile sheet, everyone in a room you are in can see your favourite game (the type you have played most) and how many games you have played. This is copied from your statistics onto your seat when you join a room or your seat is refreshed (for example when you sign in or change the setting), and is kept with the room's other temporary session data until the room expires, at most 6 hours (§2). Switching it off removes it from the room you are in.

Stats on your device before you sign in. While you are signed out, PartyF counts your finished games on your own device (storage.md §1.6b) so it can offer to add them to a new account. This stays on your device unless, right after signing in, you choose "Add to my account".

How long we keep it.

• Until you delete it. "Delete account" in your profile sheet erases your account, statistics, badges, preferences, sign-in tokens, saved decks and their share links immediately (§12).
• Room copies. Deleting your account also unlinks your seat in the room you are in on that device. A room you are in on another device, or one where that request does not get through, may still hold your account ID inside its temporary session record (the stored session data only, not shown to other players), with the badge and public profile shown on your seat, until the room expires, at most 6 hours (§2). They are deleted with the room.
• Inactivity. An account that has not been used for 24 months is deleted, with its saved decks, automatically by a scheduled clean-up that runs on our servers.
• Sign out. Signing out ends the sign-in on that device; the account itself is kept. If you also choose "Also forget me on this phone", PartyF removes from that device your remembered name and emoji, your synced preferences, the game counts kept for an account offer (storage.md §1.6b) and the record of which account last signed in there. It does not remove what lets you rejoin a room you are in.

Who can see it. Other players in a room see your display name and emoji as for any player, your chosen badge, badges you earn during a game, and, only if you switch it on, your public profile (see above). We can see account data for operations and support. We do not sell it or use it for advertising.

Your rights. The rights in §7 apply. You can delete your account yourself from the profile sheet without contacting us, and download a copy of your account data, including your saved decks, with the "Download my data" button there; for any other request, write to admin@partyf.es.

---

12. Saved and Shared Decks

Saving and sharing need an account; opening, playing and reporting a shared deck do not. If you never save, share, report or attach a deck, this section does not apply to you. Drafts you have not saved or attached stay on your device (storage.md §1.6c).

What we store about a saved deck. For each deck you save to your account, we store:

• the deck's name, language, kind (lines or words), the card texts you entered, and when it was created and last changed;
• the ID of the account that owns it;
• whether you have shared it, and its share code (a short code that is part of its link);
• whether it has been hidden, and the reason; and
• the number of distinct reporters in the last 30 days (counted once per internet connection, not who they were), and when that number reached the level that leads to automatic hiding.

Card texts are free text that you write. If you write personal data about yourself or someone else into a card, that becomes personal data in our system, in the same way as a display name. Please keep decks to words and lines that do not identify anyone. If a deck contains data about you, write to admin@partyf.es and we will review it and remove it where the law requires.

We do not store your email address or Google details with a deck.

Legal basis. We process a saved deck to provide the feature you asked for: performance of a contract (GDPR Art. 6(1)(b)). Automatic screening, reports and hiding are processed for the protection of other players and of the Service, on the basis of our legitimate interest in keeping the Service safe (GDPR Art. 6(1)(f)). Acting on an order from a competent authority is processed to comply with a legal obligation (GDPR Art. 6(1)(c)).

Where it is stored. Saved decks live in Google Cloud Firestore, in region europe-west1 (Belgium), the same as account data (§11 and §4). When you attach a deck to a room you host, a copy of its cards is also kept with that room's temporary session data, in the same way as the room's other data (§2). That copy is deleted when the room expires, at most 6 hours later.

Who can see a shared deck. Anyone who has the link or code for a shared deck can see its name, language, kind, number of cards and its cards, can play it and can save a copy. The preview of a shared deck never shows who made it: it does not show your display name, your avatar, your account ID or any other information about you as the author. The code in a shared deck's link is removed from page addresses before any analytics or error report is sent. Other players in a room see the cards of a deck you attach to that room, as they see any topic in the room. They do not see that the deck is yours unless you tell them. We can see saved decks and reports for operations, support and reviewing reports.

Reports. When someone reports a shared deck, we store the deck, when the report was made, and a pseudonymous reporter key. The key is a keyed hash (using a secret kept only on our server) of the reporter's internet (IP) address combined with the deck, so the stored keys cannot link one reporter's reports on different decks. Apart from logs, PartyF's code uses the internet (IP) address only to compute the key and to limit how many reports one address can send, and does not store it. Like every request, the report also appears, with the deck's code and your address, in our hosting provider's platform logs, and if you send reports too quickly our own logs record your address too; both are kept for up to 30 days (§8). No reason is stored. We use the keys to count separate reporters without counting the same connection twice. We do not store the reporter's name or account, and we never tell the deck's author who reported it. This is a pseudonym, not anonymity. Reports are deleted with the deck, when we restore a hidden deck after review, and in any case about 12 months after they were made, by automatic expiry.

The key does not show who made a report and we do not try to work it out, so we usually cannot find a given report. If you give us the deck code and the internet (IP) address you used, we can check whether a matching report exists (GDPR Art. 11(2)).

Hiding and review. When a deck receives reports from several separate reporters (counted once per internet connection) within a limited period, it is hidden automatically. That is not a decision about the content: we review the deck and restore it or keep it hidden. If a deck is hidden, "My decks" shows that it is hidden, whether that happened automatically after reports or by us, and why. To appeal, write to admin@partyf.es with the deck's code (Terms of Use §3.4).

Copies. When someone saves a copy of a shared deck, the copy is kept in their account, or on their own device if they are not signed in, and is independent of your deck. Deleting your deck or stopping sharing does not remove copies saved while it was shared, and hiding the original does not hide copies (they are checked again when published).

How long we keep it.

• Until you delete the deck or your account. "Delete" in "My decks" erases the deck and its links from our servers immediately. Deleting your account erases all of your saved decks and their links immediately; the 24-month inactivity deletion (§11) does the same.
• Shared decks. A shared deck stays available to anyone with its link until you stop sharing it, delete it, or we hide it under the Terms of Use (§3.4). Stopping sharing and sharing again revives the same link. Deleting your deck or stopping sharing does not remove copies other people saved while it was shared (see "Copies" above and Terms §3.4).
• Your device. Deleting a saved deck from your account deletes a draft of it kept on this device only if you choose to delete that copy too, and deleting your account does not delete drafts on your devices; delete those under "My decks" or by clearing this site's browser storage (storage.md §1.6c).
• Room copies. Copies attached to rooms end with the room (at most 6 hours, §2).
• Reports. Deleted with the deck, when we restore a hidden deck after review, and in any case about 12 months after they were made.

Your rights. The rights in §7 apply. You can see, export and delete your saved decks yourself: the "Download my data" button in your profile sheet includes your decks, and "Delete" in "My decks" or "Delete account" in your profile sheet removes them. For any other request about a deck, write to admin@partyf.es.

---

13. Optional Email List ("PartyF news by email")

Joining is optional and never needed to play or to have an account. If you never type your email address into the sign-up form, this section does not apply to you. The form is shown only on deployments where the list is switched on.

Purpose. Occasional emails about new PartyF games and features. Nothing else: no third-party or sponsored content, no profiling, and no tracking of whether you open an email or click a link. "Occasional" means a few messages a year, not a fixed schedule. The form tells you who is responsible (Miguel Mesa Chica), the purpose and the legal basis (your consent) next to the checkbox, and links here.

What we store. When you submit the form we store your email address (in lower case), your interface language, where you signed up (the home screen or your account panel), the version of the consent wording you ticked, the status of your subscription (waiting for confirmation, confirmed or unsubscribed) and the times of sign-up, consent, confirmation, opt-out and the last email sent to you. You type the address yourself: we never read it from your Google account (we do not receive it, §11). The list is stored apart from account and player data and is never linked to your Google sub, your account, your name or a room. The form keeps nothing in your browser's storage (storage.md). The links in our emails carry a signed code in the part of the address after the #, which your browser never sends to our server, so it does not appear in our or our hosting provider's request logs. Addresses with non-ASCII characters are not accepted (an internationalised domain only in its ASCII xn-- form).

Double opt-in. After you tick the consent box and submit, we send one message with a confirmation link, valid for 48 hours. Opening it shows a button; you are on the list only once you press it. We send at most one such message to an address every 10 minutes, and no more than 30 per minute across the whole service (if that is exceeded the form still answers normally but no message is sent; try again later). The message is sent in the background, so the form's answer is the same whether or not the address was already known, which keeps it from revealing who is on the list. A message that is being sent when our service restarts can be lost; submit the form again after 10 minutes.

Legal basis. Your consent (GDPR Art. 6(1)(a)), given by ticking the box and confirming by email. You can withdraw it at any time, as easily as you gave it, without affecting what was done before.

If you never confirm. The request is deleted automatically 7 days after the last confirmation email we sent (the confirmation message says so). If that first email cannot be sent, the request is deleted straight away. Until deletion the address receives nothing else.

Withdrawal. The confirmation message contains an unsubscribe link (also offered through the email's List-Unsubscribe header); every news message we send will carry one too. It does not expire and needs no sign-in: opening it shows a button, and pressing it withdraws your consent immediately. (This protects you from mail scanners that open links automatically.) You can also write to admin@partyf.es.

What we keep after you unsubscribe. We delete your email address, language and sign-up source. We keep only a hash of the address (so we can recognise it without storing it), the status "unsubscribed", the consent, confirmation and opt-out times, the version of the consent wording, and the sign-up and last-email times. This record has two purposes: not emailing you again, and showing that you consented and later withdrew. The legal basis for keeping it is our legitimate interest in honouring your choice and proving consent (GDPR Art. 6(1)(f)).

If your unconfirmed request had already been deleted when you open the unsubscribe link, the same kind of record is still created, holding only the hash, the status "unsubscribed" and the sign-up and opt-out times, so that the address is not mailed later. Because of it, signing up again with the same address is silently ignored (the form still answers as if it worked, and no email is sent). To rejoin, write to admin@partyf.es.

How long we keep it. A confirmed address is kept until you unsubscribe. The opt-out record has no automatic end date at present. Unconfirmed requests: see above.

Language. Our emails exist in English and Spanish. If your interface language is French, Italian, Catalan or Basque, the email is sent in English.

Processor and where it is stored. The list lives in Google Cloud Firestore, region europe-west1 (Belgium), under the Google Cloud Data Processing Addendum (§5, §11). Messages are sent through the SMTP email provider named in §6, which receives your address and the message content solely to deliver it, as our processor; §6 names it, with where it processes data and any international transfer safeguards. The confirmation message is plain text, with no tracking images, and its links point to partyf.es (we require the provider to have open and click tracking and link rewriting switched off). The message names the sender and links this notice.

Who can see it. We can see the list for operations and for sending news. We do not sell it, share it for marketing, or combine it with any other data.

Your rights. The rights in §7 apply. To see what we hold about your address, correct it or have it erased, write to admin@partyf.es from that address (we may need to confirm it is yours). Erasure of the opt-out record means you could be emailed again if you sign up again, so we will tell you that before we do it. "Download my data" and "Delete account" in your profile sheet do not touch the email list, because it is not linked to accounts: unsubscribe through the link in any message, or write to us, to be removed.