Privacy Policy

1. Who we are

Spybluff is an independent online party game made and run by an individual developer based in Ukraine, who is the controller of the personal data described here. This policy explains what data is processed when you play, why, for how long and who else is involved.

We follow the Law of Ukraine "On Personal Data Protection" and, for visitors from the European Economic Area, the United Kingdom and Switzerland, the General Data Protection Regulation (GDPR).

2. Data we process

Game data: the codename you enter, the room you join, your votes, scores and any custom themes the host adds. There are no accounts. A random secret is stored in your browser so you can rejoin a room, and the server keeps only a hash of it.

Technical data: when you load the site or play, our server logs record a shortened IP address (for IPv4 the last number is set to zero, for IPv6 only the first 48 bits are kept), the country that Cloudflare derives from your IP address, your browser and device type (user agent), the app version, the pages and game actions requested, the room code and an anonymous player ID, and the time. Your full IP address is used only briefly in the server’s memory to enforce abuse limits (requests, open rooms and connections per network) and is never written to logs or stored. We do not record your city, region or time zone.

Error reports: when something goes wrong on the server, a technical report is sent to our error-tracking service (Sentry). It contains the error and the request or game action that caused it, but no IP address, request headers, cookies, request bodies or user identifiers. A small sample of ordinary requests is also sent, in the same stripped-down form, to measure performance.

We do not ask for your real name, email address or password, and we do not sell personal data.

3. Why we process it

Game and technical data are needed to provide the game you asked for and to keep it secure and working (our legitimate interest in running and protecting the service).

Advertising cookies and personalized ads are used only on the basis of your consent where the law requires it, and you can change your choice at any time. Without your consent, Google may still show non-personalized or limited ads; cookies are used for them only where the law allows it or you consent. Showing such ads relies on our legitimate interest in funding a free game.

We do not make automated decisions that have legal or similarly significant effects on you.

4. How long we keep it

Rooms, their players, votes and custom themes are deleted automatically after 24 hours without activity.

Rooms that nobody joins are closed after about one minute. Server logs, including the shortened IP address and country, are kept for about 30 days and then deleted automatically. Error reports are kept for the retention period of our Sentry plan, at most 90 days.

Data in your browser stays there until you clear it, except the saved seat for a room, which is deleted automatically 24 hours after you last opened that room.

5. Data stored in your browser

The game keeps a few settings in your browser storage: your interface language, the rain effect setting, your last codename and the player ID and secret for each room you joined, so a page refresh does not drop you out of a case. You can clear them at any time in your browser settings.

6. Advertising, cookies and consent

The game is funded by ads served by Google AdSense. Ads are only requested on the home page, the content pages, the lobby and the screens after a case, never while someone is asking or answering.

Google and its partners use cookies and similar technologies to show ads and measure them, and may personalize ads based on your visits to this and other websites. If you are in the EEA, the UK or Switzerland, a consent message from Google, a certified consent management platform, asks for your choice before such cookies are used. You can change that choice at any time through the privacy settings link the message makes available on the site.

You can opt out of personalized ads in Google Ads Settings (https://www.google.com/settings/ads). How Google uses data from sites that show its ads is described at https://policies.google.com/technologies/partner-sites.

7. Ad blocker detection

To check whether ads can be shown, the game runs a small test in your browser and loads a small file from our own server. The result stays on your device and is only used to keep the game locked until you disable the ad blocker. The result is not sent to us or linked to you.

8. Service providers

Cloudflare, Inc. delivers and protects all traffic to the site, so it processes your IP address and request data (https://www.cloudflare.com/privacypolicy/).

Google Ireland Limited and Google LLC serve ads and the consent message (https://policies.google.com/privacy).

Functional Software, Inc. (Sentry) receives server error reports (https://sentry.io/privacy/).

The game server itself runs on our own hardware. Some providers process data outside Ukraine and the EEA, including in the United States. Where that happens, they rely on safeguards such as the EU Standard Contractual Clauses or the EU-US Data Privacy Framework.

9. Your rights

You have the right to know what data about you we process, to get a copy of it, to have it corrected or deleted, to restrict or object to its processing and to withdraw consent at any time without affecting earlier processing. Because we have no accounts, tell us the approximate time you played and your codename or room code so we can find the data.

In Ukraine you can complain to the Ukrainian Parliament Commissioner for Human Rights. In the EEA, the UK or Switzerland you can complain to your local data protection authority. We would appreciate the chance to sort it out with you first.

10. Changes

If we change how data is processed, we update this page and the date at the top.

11. Contact

Privacy questions and requests can be sent to [email protected]. We answer within 30 days.