Privacy Policy

1. Who we are

This policy explains how Faji ("Faji", "we", "us") handles personal data when you use our website at faji.games and play.faji.games, and the Faji app on iOS and Android (together, the "Service"). Questions at any time: hello@faji.games.

2. What we collect

• Guest play. If you play as a guest, we store only the display name you type and your in-room activity (scores, votes, answers, assigned roles), tied to the room you're in.
• Accounts. If you sign in with Google, Google shares your name, email address and profile picture with us; if you sign in with Apple, Apple shares your name and email (or a private relay address, if you choose to hide your email). We store what's shared with your account so the app can welcome you back and sync your profile.
• Gameplay. Rooms, join codes, player lists, rounds played, scores and results are stored so everyone's phones stay in sync in real time.
• Catalog and preferences. We store owned and wishlisted products, host settings, mature-content preferences, languages, selected decks, Party Mix settings and verified room feedback so the catalog and games work as requested.
• Commerce. We store product, price, currency, payment status, provider transaction references, receipt-verification results, refunds and entitlements. Faji does not receive the full payment-card number used by an app store or payment processor.
• Private custom content. If you create private cards or decks, we store their content, collaborators, visibility and moderation status until you delete them or the applicable retention period ends.
• Advertising and attribution. When enabled, we may process consent choices, coarse region, campaign parameters, ad interactions and provider identifiers needed to deliver, measure, limit and secure advertising or rewarded access.
• Technical and security logs. Our hosting provider keeps standard server logs (IP address, timestamps, device/browser type) to run and secure the Service, and we keep pseudonymous gameplay event logs (for example "a round of Charades started in room X") to understand how the game is used. These logs never contain the text of private prompts or roles.

3. What we don't do

• We don't sell or rent your personal data to anyone.
• We don't sell personal data to advertisers. Ads and sponsored content, when enabled, are governed by the consent and privacy controls shown in the Service.
• We don't access your Google or Apple account beyond the basic profile information above — not your mail, contacts, files or anything else.

4. Why we process data (legal bases)

• To provide the Service — running rooms, syncing phones, keeping scores (performance of a contract, or steps pre-contractual at your request).
• To keep the Service safe and working — security logs, abuse and rate limiting (legitimate interests).
• To understand usage — aggregated, pseudonymous gameplay analytics (legitimate interests; you can object at any time by email).
• To provide purchases and subscriptions — verifying payments, restoring access, preventing fraud, handling refunds and keeping required financial records (contract and legal obligations).
• To personalize the catalog — applying language, market, safety and host preferences without using precise location unless a feature clearly asks for it.
• To fund free play — showing and measuring permitted advertising or sponsored content, using consent where required.
• Because you asked — e.g. signing in with Google or Apple (consent, withdrawable at any time from your account or your Google/Apple account settings).

5. Who we share data with

We share data only with service providers that run the Service for us:

• Supabase — our database, authentication and realtime provider, which processes game and account data on our behalf under a data processing agreement.
• Google — provides Google Sign-In (and, if you installed the app from Google Play, app distribution and related services).
• Apple — provides Sign in with Apple (and, if you installed the app from the App Store, app distribution and related services).
• Apple, Google Play and configured web payment providers — process and verify purchases, subscriptions, refunds and chargebacks.
• Configured advertising and measurement providers — receive only the data permitted by your consent choices and the provider configuration active in your market.

We may also disclose data if legally required, or to protect the rights and safety of Faji and our players. We never transfer data in exchange for money.

6. How long we keep data

• Game rooms are temporary: they're automatically deleted a short time after the room ends or becomes inactive.
• Account data is kept until you ask us to delete your account. Deleting is immediate for anything personally identifying — your name, email and linked sign-in are removed right away. What remains is a marker record (so a night you hosted still makes sense to the people who played it, and so support can answer "what happened to this account") and your display name on rooms you played in, which we cannot remove without also erasing other players' own history of that night. Ask us and we'll permanently erase what's left.
• Purchase and entitlement records are kept while needed to restore access, resolve disputes, prevent fraud and meet financial or legal duties.
• Private custom decks are kept until their owner deletes them, the account is deleted, or moderation and safety obligations require a longer record.
• Logs are kept only as long as needed for security and stability, and in any case no longer than 12 months.

7. Your rights

Where GDPR, UK GDPR, CCPA or similar laws apply to you, you can ask us to access, export, correct, or delete your personal data, object to or restrict certain processing, and lodge a complaint with your supervisory authority. We'll respond within 30 days. Just email hello@faji.games — include the name or email you play with so we can find you.

8. Children and age-restricted content

Faji is not intended for children under 13 (or a higher age where local law requires), and we don't knowingly collect their data. Some games and content decks — such as Do or Drink and After Dark — are intended for adults (18+). The host controls the room safety setting, and an individual mature-content opt-out blocks 18+ content for that room. If you believe a child has given us personal data, contact us and we'll delete it.

9. International transfers

Our providers may process data outside your country. Where that happens, we rely on the safeguards those providers offer, such as EU Standard Contractual Clauses.

10. Security

We use access controls, encryption in transit and row-level database rules so players can only ever read what belongs to their own room. No system is perfect — if something ever goes wrong, we'll tell affected players and this page.

11. Changes to this policy

We'll update this policy as the Service grows. Material changes will be announced in the app or by email to signed-in players, and the "Effective" date at the top will always show the current version.

12. Contact