Privacy policy

Overview

This Privacy Policy covers Spyfall. The Charade (Charades Remix) party game app has its own privacy policy at https://apps.beffa.xyz/charade/privacy.

Data We Collect

The browser games do not require an account. We process the following information to provide the website and online games:

Spyfall iOS online games and administration

Optional iOS online games process your chosen display name, game messages, clues, reactions, votes, guesses and outcomes on our server. Your installation uses a random credential stored in Keychain, separate from your local game data. Offline gameplay does not require this service.

Online conversation and the relevant game context are sent to the Google Gemini API to generate game responses. Provider processing and retention follow the applicable Google API terms and account settings. Do not share personal or sensitive information in game chat.

We retain game audits for administrator review, including the transcript, reactions, player assignments, game actions, rejected message attempts (including drafts submitted for screening), moderation categories, model responses, short vote justifications and provider diagnostics. A pseudonymous guest identifier links your retained games even if your display name changes. Access is restricted to the one configured administrator. The default audit retention is 30 days from game creation; it is configurable. Expired audits are hidden immediately and deleted by hourly cleanup when the service is running. Hosting logs and backups are managed separately. Other unsent drafts and access credentials are not included in these audits. Content-free win/loss records are retained separately.

The private administrator dashboard uses Google login to verify the authorized administrator email. It uses an expiring, HttpOnly session cookie and is excluded from website analytics and advertising. Ordinary players do not need a Google account and cannot access the dashboard. Contact us using the address below for questions about retained game data.

Spyfall iOS analytics, purchases and feedback

Spyfall iOS sends screen views, selected usage events, the app language, and app and device information (app version, device model, iOS version and screen size) to Umami analytics software on a server we operate. No installation identifier, advertising identifier or cookie is used. The server tells installations apart by a value derived from the network address and device details, which changes every month, and estimates an approximate location from the network address without storing the address. These events help us understand gameplay flows and improve the app. Session replay is not used in the app. Names, chat, custom collection text, photos and secret cards are not sent to analytics.

Versions of Spyfall iOS before 2.0.5 sent usage events to PostHog US Cloud under a random installation identifier. The current version no longer sends or uses that identifier. Contact us about access to or deletion of data from those versions.

Spyfall iOS contains no third-party advertising or attribution SDK, does not request tracking permission and does not track you across other apps or websites. The game shows no advertisements.

Starting with version 2.0.7, App Store builds of Spyfall iOS ask Apple once, through Apple’s AdServices framework, whether an Apple Ads campaign led to the download. Apple answers with campaign, ad group and keyword numbers and the country of the campaign, without any identifier. The app keeps this answer on the device and adds the campaign number to its analytics events, such as purchases, so we can see which campaigns lead to purchases. This answer is not shared with advertisers.

From version 2.0.9, the first time you open Spyfall iOS, it sends our server one message that it was installed: a random number made for that message, the app version and the iOS version. Our server keeps none of it and passes it to Meta (Facebook, Instagram), so Meta can count how many installs our ads bring. It sends no IP address and no device identifier, so Meta can’t link it to you. The app has no Meta code and doesn’t track you.

Purchases use Apple StoreKit. Apple handles payment details; Spyfall receives verified purchase information to grant access.

Feedback you send from the Spyfall app on iOS or Android goes to our server at apps.beffa.xyz with the details shown under the form: app version and build, system version, device model, app language, where the form was opened and, for Pro, that Pro is active. Your email address goes with it only if you enter one. So that our server takes messages only from the real app, each one also carries a check that it was sent by a genuine copy of Spyfall: on iOS a signature from Apple’s App Attest, made with a key the app creates for this purpose on your device, and on Android a Google Play Integrity token. Neither contains your name or email address. Only the developer reads your message, to answer you and improve the game. If you choose to email it instead, your own email app sends it to our support address. Sending feedback is optional. On iOS, the app also remembers that feedback was sent so it can add the free collection credit.

To show the developer’s replies under Settings › Messages, the app keeps the messages you sent on your device and asks our server for answers to them, at most every few hours and when you open Messages, for up to 180 days after a message. It uses a random key made for each message; there is no account and no notification permission.

How We Use Your Data

We use the information we collect to:

Analytics

When configured, the website uses Umami analytics software on a server we operate. It sets no cookies and stores no analytics identifier in your browser. It counts views of public pages and a few selected events: opening the App Store link, starting and finishing a one-phone game, and creating or joining a room. A one-phone game event carries the game type, player count, timer length, chosen built-in collections and which side won. Page addresses are sent without query strings or fragments, and a referring address is reduced to the name of the other site. Nothing is sent from invitation, room or administrator pages. Player names, room codes, nicknames, access tokens, private cards, votes and guesses are not sent to analytics.

Umami tells visitors apart by a value derived from the network address and browser details, which changes every month, and does not store the address. From each request it records the browser, operating system, device type, screen size, language and an approximate location.

On some visits, Umami also records a session replay and heatmap data for public pages: the page as displayed, scrolling, pointer movement and clicks. Text typed into form fields is masked, and a one-phone round with its cards is blocked from the recording. The recorder does not run on invitation, room or administrator pages; opening a room from a recorded visit loads a fresh page without it. Replay data can include the full address of a public page.

Data Storage

Browser room access tokens are stored in this browser tab’s session storage to recover membership after refresh. Leaving a room or discovering an expired membership removes its saved access. Closing a tab may lose access; some browsers copy session storage when duplicating a tab. If storage is blocked, access lasts only while the page remains open.

Private cards are held in page memory, not saved in browser storage. Cards are concealed when you leave the page or the room disconnects. Live rooms are temporary and expire after inactivity; a server restart can end a room. The server can also save durable history in PostgreSQL, including player identifiers, nicknames, votes, assignments, drawn locations or words, final-guess information and outcomes. This history is separate from live-room expiry. Leaving a room removes membership access but does not immediately erase recorded history. Contact us about data requests.

The application’s default history policy makes a room’s recorded history eligible for deletion 30 days after the room was created. When deployed and enabled, cleanup runs in limited batches at startup and hourly; operators can configure the period and schedule. Expired history stops receiving new game records, while live play can continue. Cleanup failures, downtime or a backlog can delay deletion, so 30 days is not a guaranteed deletion deadline. Deployment of these controls has not yet been confirmed. Hosting logs, database backups and analytics are managed separately and are not erased by history cleanup; their deployed retention periods have not yet been confirmed.

A service worker downloads the application shell, icons and bundled local packs for offline play. It only stores an explicit list of public build files, never room responses, socket tickets or credentials. Local player names, assignments and scores stay in page memory and reset on reload. Clear this site’s browser data to remove its offline download.

Public location packs can be cached by the browser. Room and private API responses are not cached. Analytics data, when enabled, is kept on our Umami server and is not shared with an analytics company.

Optional website advertising

When enabled, one manual Google AdSense placement is available only on the public rules page at spyfall.beffa.xyz. Advertising is disabled on the parent beffa.xyz site, the dashboard, invitations, local games, online rooms and results. Entering or leaving the advertising page opens a fresh document so advertising code does not continue running inside a game.

The Advertising choices button loads Google’s consent manager. It can process connection and device information and store your consent preferences. The ad loader runs only after the manager confirms the required purpose and Google vendor consents. Unknown, declined, unavailable or unsupported consent states leave ads off. Games remain available if you decline, block ads or are offline.

If you allow advertising, Google may use cookies, identifiers, IP address and browser information for ad selection, measurement and fraud prevention. Visit policies.google.com/technologies/ads for Google’s advertising information. We do not pass room codes, credentials, names, cards, words, clues, votes or guesses to advertising code. Ad and consent responses are not included in our offline cache.

Reopen Advertising choices on the rules page to change your permissions. Withdrawing consent reloads the page to stop previously loaded ad code. Availability depends on deployment configuration and provider approval; a visible choices control does not guarantee an ad will be served.

Your Rights

Depending on your location, you may have certain rights regarding your personal data, including:

Children's Privacy

Spyfall is not intended for children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided us with personal information, please contact us.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date.