Privacy Policy

Vibe Check is operated by Uncanny Vibrations, LLC, a Tennessee limited liability company doing business as Vibe Check ("we," "us," or "our"). We run the party game platform available at vibecheck.mobile and related subdomains. This Privacy Policy explains how we collect, use, disclose, and safeguard information about you when you use our website or services (collectively, the "Service").

The short version: players play anonymously and their answers are deleted within 24 hours of the game ending; hosts have accounts because hosting requires one. The details follow.

Questions? Email us at support@vibecheck.mobile.

2.1 Players — no account, no download, no email

Players join a game by scanning a QR code or entering a four-digit room code. We do not ask players for an email address, phone number, or any account. From a player we collect:

• A display name. Whatever name you type when you join. It is shown to the room during the game and in the host's game history afterward, so pick accordingly.
• A game-scoped session token. A random identifier created when you join, used only to attribute your votes in that game. We store it only as a SHA-256 hash on our servers. It is not linked to any account or persistent identity.
• A device ID, if your browser allows it. A random identifier your phone creates the first time you join and sends with each join after that. It is how a host's room recognises you from one game to the next (Section 8). It is not an account, is not derived from your phone's hardware or any advertising ID, and authorises nothing — it cannot be used to join, vote, or act as you.
• Your in-game activity. The answers you submit, votes in Plead Your Case rounds, and emoji reactions, used to run the game — scoring, badges, and awards.

2.2 Hosts — information you provide directly

• Account information. When you create a host account, we collect your email address and a password (stored as a hash by our authentication provider, Supabase — we never see or store your plaintext password).
• Host identity. If you claim a host alias and host number, they are displayed to your rooms on the lobby screen.
• Payment information. If you make a purchase, our payment processor Stripe collects your card number, billing address, and related details, and we store a Stripe customer identifier and your purchase and entitlement records. We never see or store your raw card number — Stripe handles all payment data in accordance with PCI-DSS standards.
• Content you create. Custom questions and Custom Packs (Lifetime and Whitelabel hosts), favorites, and game configurations stored in your account.
• Support communications. If you contact us, we retain a record of that correspondence.

2.3 Information collected automatically

• Game and usage data. We log games hosted, player counts, question types, and round outcomes to power game history, milestones, and host stats.
• Aggregate answer statistics. For multiple-choice questions we keep a running count of how all players everywhere answered each question (e.g. "62% said option A"). These are totals only — they contain no names, tokens, or anything tying an answer to a person. We also keep the same counts per game, linked to the account that hosted it and to the approximate location described below — never to a player.
• Log data. Our hosting infrastructure (Vercel) automatically records IP addresses, browser type, pages visited, timestamps, and referring URLs when you access the Service.
• Approximate location of games. When a host starts a game, we record the city, state and country our hosting provider associates with the host's connection. We use it only to understand where Vibe Check is played. We also keep approximate coordinates for that city (rounded to about a kilometre) so it can be drawn on a map. It is visible only to us, is never shown to other users, and we do not store the IP address it came from. Players' locations are never collected.
• Rate-limiting data. To keep the Service healthy we keep short-lived counters keyed by IP address, game, or hashed session token in Upstash Redis. They expire automatically within minutes to hours.

2.4 Information we do not collect

We do not collect your phone number, physical address, government ID, precise location, or any sensitive personal data (as defined under GDPR Article 9) unless you voluntarily provide it in a support message. We do not run advertising trackers or sell data to anyone.

• Provide the Service. Create and maintain host accounts, process purchases and grant the content they unlock, deliver live game sessions, and display game history, milestones, and stats.
• Communicate with you. Send transactional emails (password resets, purchase receipts, renewal reminders for an opted-in Season Pass). We will only send marketing emails if you have opted in, and you can unsubscribe at any time.
• Improve the Service. Analyze aggregate usage patterns to fix bugs, prioritize features, and improve question quality. We do not sell or share individual-level data for this purpose.
• Enforce our Terms. Detect and prevent fraud, abuse, or violations of our Terms of Service.
• Legal compliance. Fulfill obligations under applicable law, respond to lawful requests from authorities, and protect our legal rights.

If you are located in the European Economic Area (EEA) or United Kingdom, we process your personal data under the following legal bases:

• Contract (Art. 6(1)(b)). Processing necessary to provide the Service you signed up for, including account management and payment processing.
• Legitimate interests (Art. 6(1)(f)). Fraud prevention, security monitoring, rate limiting, and aggregate analytics — where these interests are not overridden by your rights.
• Consent (Art. 6(1)(a)). Marketing communications, where you have opted in.
• Legal obligation (Art. 6(1)(c)). Where we are required to process data to comply with applicable law.

We do not sell your personal data. We share information only in the following circumstances:

5.1 Service providers (sub-processors)

• Stripe (stripe.com) — payment processing. Stripe's privacy policy is available at stripe.com/privacy.
• Supabase (supabase.com) — database hosting, authentication, and real-time game infrastructure. Data is stored in U.S.-based AWS regions. Supabase's privacy policy is available at supabase.com/privacy.
• Vercel (vercel.com) — application hosting and edge delivery. Vercel's privacy policy is available at vercel.com/legal/privacy-policy.
• Upstash (upstash.com) — short-lived rate-limiting counters. Upstash's privacy policy is available at upstash.com/trust/privacy.
• Resend (resend.com) — transactional email delivery to hosts. Resend's privacy policy is available at resend.com/legal/privacy-policy.

Each provider is only permitted to process your data as necessary to provide their services to us.

5.2 Business transfers

If the Company is involved in a merger, acquisition, or asset sale, your information may be transferred. We will provide notice before your data is transferred and becomes subject to a different privacy policy.

5.3 Legal requirements

We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court order or government agency).

• In-game answers. The answers players submit during a game are deleted within 24 hours. The live record of the vote is deleted the moment the game ends. A round-by-round copy is kept for up to 24 hours so that the end-of-game badges and awards can still be shown if the host's screen reloads, and is then deleted automatically (sooner if the game is removed first). It is never visible to other players. What survives a game is the scoreboard, not the ballots.
• Aggregate answer statistics. The anonymous running totals described in Section 2.3 (how the crowd voted on each question, across all games) are retained indefinitely. They cannot be tied back to any player.
• Player names and results. Player display names, teams, scores, and badges from a finished game are retained as part of the host's game history. Abandoned or unfinished games are purged automatically within hours. Older finished games beyond a host's recent history are periodically deleted, leaving only anonymous aggregate statistics.
• Room standings. For players whose phone sent a device ID, a running total per host — the name you last used, games played, wins, how often you were with the majority, pleas won, and Opp of the Night awards — kept for as long as that host's account exists, or until you use Forget this device (Section 8).
• Player session tokens. Stored only as SHA-256 hashes, and deleted with the game data they belong to. On the player's own device, the saved session expires after 12 hours (Section 8).
• Host accounts. We retain your account data for as long as your account is active. Upon account deletion, we remove your personal data within 30 days, except where retention is required for legal compliance (e.g., financial records, which we retain for 7 years as required by U.S. tax law).
• Rate-limiting counters. Expire automatically, typically within minutes.
• Game locations. The city-level location of a game, and any venue we add to it by hand, are retained indefinitely as part of our own records of where the game is played. If a host deletes their account, the link to that account is removed.
• Log data. Infrastructure logs are retained for the short periods set by our hosting providers.

Depending on your location, you may have the following rights regarding your personal data:

• Access. Request a copy of the personal data we hold about you.
• Correction. Request correction of inaccurate or incomplete data.
• Deletion. Request deletion of your personal data ("right to be forgotten"), subject to legal retention requirements.
• Portability. Receive your data in a structured, machine-readable format.
• Objection. Object to processing based on legitimate interests.
• Withdraw consent. Where processing is based on consent, withdraw it at any time without affecting prior processing.
• California residents (CCPA). You have the right to know what personal information we collect, to delete it, to opt out of its sale (we do not sell personal data), and to non-discrimination for exercising these rights.

To exercise any of these rights, email support@vibecheck.mobile. We will respond within 30 days (45 days for complex requests). We may need to verify your identity before fulfilling a request. Note that player data is anonymous and short-lived by design: once a game ends and its answers are deleted, we generally have no way to identify which data belonged to which player. Room standings are the one exception, and you can erase them yourself without contacting us — see Section 8.

• Hosts — authentication cookies. Strictly necessary session cookies that keep you logged in. These cannot be opted out of without logging out of the Service.
• Players — local storage, not cookies. Joining a game saves a small entry in your browser's local storage (your player ID, session token, and display name for that game) so that if your phone briefly kills the tab you can rejoin without losing your score. It stays on your device, is keyed to that one game, and expires after 12 hours.
• Players — what your phone remembers between games. When a game finishes we also keep a running total on your device: the name you last used, how many games you have played, how often you were with the majority, how many times you won a Plead Your Case, and which holiday nights you played on. This is what lets the results screen say “your 5th game” and lets the join screen offer your usual name instead of an empty box. That running total stays on your phone.
• Players — what a host's room remembers. Your phone also keeps a random device ID and sends it when you join. We use it for one thing: adding up your results in that host's room across games, so the room can keep standings — games played, wins, pleas won, and the like, under the name you used most recently. The host sees those standings by name; nobody, the host included, ever sees the ID itself. It is not an account, not shared with anyone, not used for advertising, and not linked to anything you do outside Vibe Check. Private browsing or cleared storage simply means no ID, and you play exactly the same.
• Forget this device. The button on the join screen erases all of it: it deletes your room standings on our servers, removes the device ID from every game record that carried it, and then clears everything saved on your phone. If our servers cannot be reached, nothing is cleared yet and the button tells you so, so that pressing it again can still finish the job.

We do not use advertising cookies, retargeting pixels, or cross-site tracking technologies. You can control cookies through your browser settings, but disabling authentication cookies will prevent you from staying logged in as a host.

Host accounts are not available to children under 13, and we do not knowingly collect personal information from children under 13. Players do not create accounts, and the only information a player provides is a display name. If you are a parent or guardian and believe your child has provided us with personal information, please contact us at support@vibecheck.mobile and we will delete that information promptly.

If you are between 13 and 18, you may use the Service only with the involvement and consent of a parent or legal guardian.

We implement industry-standard technical and organizational measures to protect your data, including TLS encryption in transit, hashed passwords via our authentication provider, player session tokens stored only as SHA-256 hashes, database access restricted by row-level security and column grants, and access controls limiting who can access production data.

No method of transmission over the Internet or electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your data, we cannot guarantee absolute security. In the event of a data breach affecting your rights and freedoms, we will notify you as required by applicable law.

The Service is operated from the United States. If you access the Service from outside the U.S., your information may be transferred to and processed in the U.S. or other countries where our service providers maintain infrastructure. We take steps to ensure that such transfers are conducted in accordance with applicable law, including the use of Standard Contractual Clauses where required.

The Service may contain links to third-party websites. This Privacy Policy does not apply to those sites. We encourage you to review the privacy policies of any third-party services you visit.

We may update this Privacy Policy from time to time. We will notify you of material changes by posting the revised policy on this page with an updated "Last updated" date and, where required by law, by email to registered hosts. Your continued use of the Service after changes take effect constitutes acceptance of the revised policy.

If you have questions, concerns, or requests relating to this Privacy Policy, please contact us: