Privacy Policy

Vibe Check is operated by Uncanny Vibrations, LLC, a Tennessee limited liability company doing business as Vibe Check ("we," "us," or "our"). We run the party game platform available at vibecheck.mobile and related subdomains. This Privacy Policy explains how we collect, use, disclose, and safeguard information about you when you use our website or services (collectively, the "Service").

The short version: players play anonymously and their answers are deleted when the game ends; hosts have accounts because hosting requires one. The details follow.

Questions? Email us at support@vibecheck.mobile.

2.1 Players — no account, no download, no email

Players join a game by scanning a QR code or entering a four-digit room code. We do not ask players for an email address, phone number, or any account. From a player we collect:

• A display name. Whatever name you type when you join. It is shown to the room during the game and in the host's game history afterward, so pick accordingly.
• A game-scoped session token. A random identifier created when you join, used only to attribute your votes in that game. We store it only as a SHA-256 hash on our servers. It is not linked to any account or persistent identity.
• Your in-game activity. The answers you submit, votes in Plead Your Case rounds, and emoji reactions, used to run the game — scoring, badges, and awards.

2.2 Hosts — information you provide directly

• Account information. When you create a host account, we collect your email address and a password (stored as a hash by our authentication provider, Supabase — we never see or store your plaintext password).
• Host identity. If you claim a host alias and host number, they are displayed to your rooms on the lobby screen.
• Payment information. If you make a purchase, our payment processor Stripe collects your card number, billing address, and related details, and we store a Stripe customer identifier and your purchase and entitlement records. We never see or store your raw card number — Stripe handles all payment data in accordance with PCI-DSS standards.
• Content you create. Custom questions and Custom Packs (Lifetime and Whitelabel hosts), favorites, and game configurations stored in your account.
• Support communications. If you contact us, we retain a record of that correspondence.

2.3 Information collected automatically

• Game and usage data. We log games hosted, player counts, question types, and round outcomes to power game history, milestones, and host stats.
• Aggregate answer statistics. For multiple-choice questions we keep a running count of how all players everywhere answered each question (e.g. "62% said option A"). These are totals only — they contain no names, tokens, or anything tying an answer to a person or a game.
• Log data. Our hosting infrastructure (Vercel) automatically records IP addresses, browser type, pages visited, timestamps, and referring URLs when you access the Service.
• Rate-limiting data. To keep the Service healthy we keep short-lived counters keyed by IP address, game, or hashed session token in Upstash Redis. They expire automatically within minutes to hours.

2.4 Information we do not collect

We do not collect your phone number, physical address, government ID, precise location, or any sensitive personal data (as defined under GDPR Article 9) unless you voluntarily provide it in a support message. We do not run advertising trackers or sell data to anyone.

• Provide the Service. Create and maintain host accounts, process purchases and grant the content they unlock, deliver live game sessions, and display game history, milestones, and stats.
• Communicate with you. Send transactional emails (password resets, purchase receipts, renewal reminders for an opted-in Season Pass). We will only send marketing emails if you have opted in, and you can unsubscribe at any time.
• Improve the Service. Analyze aggregate usage patterns to fix bugs, prioritize features, and improve question quality. We do not sell or share individual-level data for this purpose.
• Enforce our Terms. Detect and prevent fraud, abuse, or violations of our Terms of Service.
• Legal compliance. Fulfill obligations under applicable law, respond to lawful requests from authorities, and protect our legal rights.

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases:

• Contract (Art. 6(1)(b)). Processing necessary to provide the Service you signed up for, including account management and payment processing.
• Legitimate interests (Art. 6(1)(f)). Fraud prevention, security monitoring, rate limiting, and aggregate analytics — where these interests are not overridden by your rights.
• Consent (Art. 6(1)(a)). Marketing communications, where you have opted in.
• Legal obligation (Art. 6(1)(c)). Where we are required to process data to comply with applicable law.

We do not sell your personal data. We share information only in the following circumstances:

5.1 Service providers (sub-processors)

• Stripe (stripe.com) — payment processing. Stripe's privacy policy is available at stripe.com/privacy.
• Supabase (supabase.com) — database hosting, authentication, and real-time game infrastructure. Data is stored in U.S.-based AWS regions. Supabase's privacy policy is available at supabase.com/privacy.
• Vercel (vercel.com) — application hosting and edge delivery. Vercel's privacy policy is available at vercel.com/legal/privacy-policy.
• Upstash (upstash.com) — short-lived rate-limiting counters. Upstash's privacy policy is available at upstash.com/trust/privacy.
• Resend (resend.com) — transactional email delivery to hosts. Resend's privacy policy is available at resend.com/legal/privacy-policy.

Each provider is only permitted to process your data as necessary to provide their services to us.

5.2 Business transfers

If the Company is involved in a merger, acquisition, or asset sale, your information may be transferred. We will provide notice before your data is transferred and becomes subject to a different privacy policy.

5.3 Legal requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court order or government agency).

• In-game answers. The answers players submit during a game are deleted when the game ends, as an automatic part of finishing the game — not on a schedule, not after a grace period. What survives a game is the scoreboard, not the ballots.
• Aggregate answer statistics. The anonymous running totals described in Section 2.3 (how the crowd voted on each question, across all games) are retained indefinitely. They cannot be tied back to any player.
• Player names and results. Player display names, teams, scores, and badges from a finished game are retained as part of the host's game history. Abandoned or unfinished games are purged automatically within hours. Older finished games beyond a host's recent history are periodically deleted, leaving only anonymous aggregate statistics.
• Player session tokens. Stored only as SHA-256 hashes, and deleted with the game data they belong to. On the player's own device, the saved session expires after 12 hours (Section 8).
• Host accounts. We retain your account data for as long as your account is active. Upon account deletion, we remove your personal data within 30 days, except where retention is required for legal compliance (e.g., financial records, which we retain for 7 years as required by U.S. tax law).
• Rate-limiting counters. Expire automatically, typically within minutes.
• Log data. Infrastructure logs are retained for the short periods set by our hosting providers.

Depending on your location, you may have the following rights regarding your personal data:

• Access. Request a copy of the personal data we hold about you.
• Correction. Request correction of inaccurate or incomplete data.
• Deletion. Request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements.
• Portability. Receive your data in a structured, machine-readable format.
• Objection. Object to processing based on legitimate interests.
• Withdraw consent. Where processing is based on consent, withdraw it at any time without affecting prior processing.
• California residents (CCPA). You have the right to know what personal information we collect, to delete it, to opt out of its sale (we do not sell personal data), and to non-discrimination for exercising these rights.

To exercise any of these rights, email support@vibecheck.mobile. We will respond within 30 days (45 days for complex requests). We may need to verify your identity before fulfilling a request. Note that player data is anonymous and short-lived by design: once a game ends and its answers are deleted, we generally have no way to identify which data belonged to which player.

• Hosts — authentication cookies. Strictly necessary session cookies that keep you logged in. These cannot be opted out of without logging out of the Service.
• Players — local storage, not cookies. Joining a game saves a small entry in your browser's local storage (your player ID, session token, and display name for that game) so that if your phone briefly kills the tab you can rejoin without losing your score. It stays on your device, is keyed to that one game, and expires after 12 hours.

We do not use advertising cookies, retargeting pixels, or cross-site tracking technologies. You can control cookies through your browser settings, but disabling authentication cookies will prevent you from staying logged in as a host.

Host accounts are not available to children under 13, and we do not knowingly collect personal information from children under 13. Players do not create accounts, and the only information a player provides is a display name. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@vibecheck.mobile and we will delete that information promptly.

If you are between 13 and 18, you may use the Service only with the involvement and consent of a parent or legal guardian.

We implement industry-standard technical and organizational measures to protect your data, including TLS encryption in transit, hashed passwords via our authentication provider, player session tokens stored only as SHA-256 hashes, database access restricted by row-level security and column grants, and access controls limiting who can access production data.

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security. In the event of a data breach affecting your rights and freedoms, we will notify you as required by applicable law.

The Service is operated from the United States. If you access the Service from outside the U.S., your information may be transferred to and processed in the U.S. or other countries where our service providers maintain infrastructure. We take steps to ensure that such transfers are conducted in accordance with applicable law, including the use of Standard Contractual Clauses where required.

The Service may contain links to third-party websites. This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party services you visit.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the revised policy on this page with an updated "Last updated" date and, where required by law, by email to registered hosts. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

If you have questions, concerns, or requests relating to this Privacy Policy, please contact us: