Privacy

You decide what is collected, who sees it and when it disappears. We hold it so the game can run, and for nothing else. We do not sell it, we do not use it to train anything, and we do not use it to advertise to you or to your guests.

In legal terms: for the content your guests submit — and the content you provide about them — you are the data controller and we are your processor. What that means in practice is that you make the calls and we carry them out — including when you tell us to delete.

The display name a guest is known by at your party, the photos they upload, the facts they write about themselves, and their answers during the game. In the surprise quiz you provide these details about your guests instead: their name, a photo, how you know them, a fun fact and their table.

That is the whole list. We ask guests for no email address, no phone number and no account. A guest's phone holds an anonymous token so they can come back to their own submission — it identifies a browser, not a person.

Your email address, so you can log in with a link rather than a password, and the details of your event. If you invite a co-host, we hold their email address for the same reason and remove it with the event.

Every guest is told, in your event's language and before they submit anything, what is collected, that it will be shown to the other guests during the game and in the who-is-who directory afterwards until deletion, and when it will be deleted. Nothing is uploaded until they have said yes.

A guest can change or withdraw their submission while submissions are open. After that, ask the host — you can remove any guest from the event, which removes everything they sent.

Guest photos, names and answers are deleted automatically after a window you choose when you create the event: anywhere from 7 to 90 days after the event date, and 30 days if you leave it alone.

You do not have to wait. The event's settings page has a button that deletes all of it immediately, and the countdown to the automatic deletion is shown there too.

What survives is a row of numbers with no names in it — how many guests, how many rounds, how many correct answers. We keep those to understand whether the product works. Nothing in them points at a person.

In the EU. The database, the photo storage and the servers that run the site are all EU-hosted, and we intend to keep it that way.

Photos are stored in a private bucket. They are never reachable by a public address: each one is served through a signed link that expires minutes after it is created.

Supabase hosts the database, authentication and photo storage in the EU. Vercel runs the site from its Stockholm region. Resend sends the login emails. Sentry receives error reports, configured not to include personal data. Stripe handles payment if and when the product is paid; we never see a card number.

Each of them processes data on our instructions, under a data-processing agreement, and nothing goes to any of them that the game does not need.

Photos are resized in the browser before they are uploaded, and re-encoded on the way in. That re-encoding strips the EXIF metadata a camera writes — including the GPS coordinates of where the picture was taken. The orientation is read and applied first, so a portrait photo stays the right way up.

You can ask us for a copy of what we hold about you, ask us to correct it, or ask us to delete it. Write to support@whogame.app and we will answer within a month.

If a guest at your party asks you the same question, you can answer it yourself from the event's pages — and you are welcome to send them to us if you would rather we did.

If you think we have handled your data badly, you can complain to Datatilsynet, the Danish data protection authority.

We set what is needed to run the site and nothing more: a session cookie once you log in, a token so a guest can return to their own submission, and a note of which language you chose. There is no advertising cookie and no third-party tracker, which is why this site does not greet you with a consent banner.