PardyTime is a party-game platform operated by Grepbyte. This policy explains what personal data we collect, why, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR).
1. Who we are
The data controller is Grepbyte, CVR 37053988, Strandvejen 81, 3070 Snekkersten, Denmark. You can reach us at support@grepbyte.com for any privacy question, request, or complaint. Copyright notices go to dmca@grepbyte.com.
2. What we collect and why
We collect the minimum data needed to run PardyTime:
| Data | Purpose | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Email address | Account sign-in (one-time code), receipts, security notices | Contract |
| Google account (email and name) | Optional sign-in. We receive the email and name Google shares when you choose Google. The cookies page describes the short-lived sign-in cookie. | Contract |
| Username and display name | Show who you are to other players and on your public profile | Contract |
| IP address (during sign-in) | Rate-limit sign-in attempts to stop brute-force and abuse | Legitimate interest (security) |
| Signup country (ISO country code) | Derived from our CDN's (Amazon CloudFront) country header at account creation so staff can see where new accounts come from. Not an IP address. Set once, never overwritten. | Legitimate interest (product improvement) |
| Stripe customer and payment IDs | Process payments, recognise returning customers, handle refunds | Contract |
| Passes and subscriptions you buy (pass, days, amount, Stripe invoice or subscription ID) | Work out when your Plus ends, and take back the right days if a purchase is refunded. Deleted with your account; Stripe keeps its own payment records. | Contract |
| When you asked Plus to start straight away, or to withdraw | Kept with the pass or subscription at Stripe, and repeated in the emails we send you (the purchase confirmation, the withdrawal receipt), as the record consumer law asks for. Stays with Stripe's payment records after you delete your account. | Legal obligation |
| Whether you want news and offers by email | Asked when you set up your account and changeable in Settings, Preferences. We only send news and offers if you said yes. Receipts and account emails don't depend on it. | Consent |
| Games and media you create | Store and serve the content you author | Contract |
| A game you start before signing up | Kept only in your browser (IndexedDB) until you save it, when it moves to your account. We never receive it before then. | Contract |
| Guest device ID (random UUID in your browser) | Recognise you across page reloads inside a game room | Legitimate interest (gameplay) |
| Last active date (signed in) | Updated at most once a day while you are signed in, so staff can see which accounts are in use. | Legitimate interest (operating the service) |
| Site visits (PostHog, without analytics cookies) | Counts page views, where visitors come from and what they click. Each event records the page, the referring site or campaign tag, the button or link clicked and its text (never what you type), how far you scroll and where you move and click on the page (for heatmaps), your browser, operating system and device type, and the country your IP address points to, as Amazon CloudFront (our CDN) reads it. Your browser sends it to our server, which passes it on to PostHog with your IP address and user agent. PostHog uses those only to tell visitors apart within a day, and does not store them. Nothing is stored in your browser and nothing is linked to your account. | Legitimate interest (operating the service) |
| Site visits (PostHog, with analytics cookies) | Only if you accept analytics cookies: the same events, placed by PostHog in the country, region and city your IP address points to, plus a random analytics ID kept in your browser, so visits on different days count as one visitor. Once you sign in, the ID is linked to your account's random ID, so we can see which pages lead to signing up and playing. You can withdraw at any time on the cookies page or under Settings, Preferences. | Consent |
| Product analytics (PostHog, signed-in accounts) | What signed-in accounts do in PardyTime, so we can see whether the product works: signing up and in, finishing onboarding, making, copying and editing games (and for how long), uploading media, hosting lobbies and games, reaching a free-plan limit, viewing upgrade options, starting checkout, buying a pass, a pass running out, subscription changes, and requesting account deletion. Sent from our servers, keyed on your account's random ID. Along with each action we send your public @username, account type, plan, signup method (and the page you signed up from, such as the end of a game), an age range (such as 25-34) worked out from your date of birth (never the date itself), and country (from CloudFront's header or your signup country). For actions taken in your browser we add the region and city CloudFront places your connection in, and your operating system, browser and device type, read from your browser's user agent. Never your email, real name, IP address or the user agent itself. Games you host carry counts of players, including how many joined by QR code, PIN or link, but nothing about the players themselves. Each action notes whether it came from the app, from an AI agent using your API token, or from our own servers (a payment, say). Guests and players without an account are never sent, except an answer to a game survey (below). You can object at any time under Settings, Preferences: we stop sending anything about your account and delete your PostHog profile and its events. | Legitimate interest (product improvement) |
| Feedback surveys (PostHog) | Now and then we ask one short question: after you host or play a game, or in your library after you make one. If you answer, we send your answer and anything you type in the optional comment, with the game's format and how many played. Signed in, it's linked to your account's random ID like the product analytics above. As a guest it's sent anonymously, with no ID that could link it to you or your other answers. An account is asked at most once a month, and not at all if you object under Settings, Preferences; a device is asked about a game at most once every two weeks. | Legitimate interest (product improvement) |
We show no ads and use no advertising or cross-site trackers. PostHog stores an analytics ID in your browser only if you accept analytics cookies, and we run no session replay. See the cookies page for everything we store in your browser.
3. Service providers (subprocessors)
We use a small number of trusted providers to run the service. They process data on our behalf under their own data-processing terms.
- Amazon Web Services, Inc. hosting, the database, file storage, real-time game rooms and the content delivery network (CloudFront). Your account, games, uploaded images and play history are stored in its US East (Northern Virginia) region. Privacy policy.
- Stripe, Inc. payment processing for passes and subscriptions. Card details are entered directly with Stripe and never reach our servers. Privacy policy.
- Resend sending sign-in codes and transactional email. Privacy policy.
- PostHog, Inc. site and product analytics, stored in PostHog's EU data centre (Frankfurt). What it receives is in the table above. Privacy policy.
Some content comes straight from another company, so it loads only when you ask for it: Stripe's payment form when you buy Plus, YouTube when you play a video clue, and Cloudflare Turnstile (a check against automated sign-ups) on the sign-in page. Once loaded, that company receives your IP address and its own privacy policy applies.
4. International transfers
Amazon Web Services, Stripe, Resend and PostHog are US-based companies that operate global infrastructure. Our database and files are stored in the United States (AWS, Northern Virginia); PostHog stores our analytics in its EU data centre. Where personal data is transferred outside the EU or EEA, the transfer is covered by the EU Standard Contractual Clauses, the EU-U.S. Data Privacy Framework where the provider is certified under it, and the provider's own safeguards.
5. How long we keep your data
- Account data (email, username, display name) until you delete your account.
- Sessions sign-in sessions expire 30 days after creation; you can sign out at any time to invalidate yours sooner.
- Sign-in codes and attempt logs kept for a short period to detect abuse; codes expire minutes after issue.
- Analytics kept in PostHog while your account exists. When you opt out or your account is deleted, we delete your PostHog profile and ask PostHog to delete its events, which PostHog does in a weekly batch. Visits counted without analytics cookies are never linked to anyone.
- Signup country kept with the account until you delete it.
- Games and media until you delete them or your account.
- Payment records retained as long as required by tax and accounting law (typically 5 to 7 years in the EU), then deleted.
6. Your rights
Under the GDPR you can, at any time:
- Ask for a copy of the personal data we hold about you (access);
- Ask us to correct inaccurate data (rectification);
- Ask us to delete your account and associated data, subject to the tax-law retention noted above (erasure);
- Ask us to export your data in a portable format (portability);
- Object to processing based on legitimate interest, including product analytics, which you can switch off yourself under Settings, Preferences;
- Lodge a complaint with your local data protection authority. In Denmark, this is Datatilsynet (datatilsynet.dk).
To exercise any right, email support@grepbyte.com. Account deletion is also available from your settings page: we email you a link to confirm, then hold the account for 30 days before permanently deleting your profile, quizzes and uploads. Sign in at any point during those 30 days to cancel.
7. Children
PardyTime is not directed to children under 16. If you are under 16, please do not create an account. If we learn that we have collected data from a child under 16 without parental consent, we will delete it.
8. Security
Sign-in is passwordless: we email you a one-time code, never a password. Session tokens are stored as one-way hashes; payment card details never reach our servers. All traffic is served over HTTPS.
9. Changes to this policy
We will update this page when the service changes in a way that affects your privacy. The "last updated" date at the top reflects the most recent version. Material changes will be announced by email or in-app.
10. Contact
Questions, requests, or complaints: support@grepbyte.com. Copyright notices: dmca@grepbyte.com.