PardyTime is a party-game platform operated by Grepbyte. This policy explains what personal data we collect, why, how long we keep it, and the rights you have under the EU General Data Protection Regulation (GDPR). If you use the iOS app, the section The iOS app is the one that applies to it.
1. Who we are
The data controller is Grepbyte, CVR 37053988, Strandvejen 81, 3070 Snekkersten, Denmark. You can reach us at support@grepbyte.com for any privacy question, request, or complaint. Copyright notices go to dmca@grepbyte.com.
2. What we collect and why
We collect the minimum data needed to run PardyTime:
| Data | Purpose | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Email address | Account sign-in (one-time code), receipts, security notices | Contract |
| Google account (email and name) | Optional sign-in. We receive the email and name Google shares when you choose Google. The cookies page describes the short-lived sign-in cookie. | Contract |
| Username and display name | Show who you are to other players and on your public profile | Contract |
| IP address (during sign-in) | Rate-limit sign-in attempts to stop brute-force and abuse | Legitimate interest (security) |
| Signup country (ISO country code) | Derived from Cloudflare's country header at account creation so staff can see where new accounts come from. Not an IP address. Set once, never overwritten. | Legitimate interest (product improvement) |
| Stripe customer and payment IDs | Process payments, recognise returning customers, handle refunds | Contract |
| Games and media you create | Store and serve the content you author | Contract |
| Guest device ID (random UUID in your browser) | Recognise you across page reloads inside a game room | Legitimate interest (gameplay) |
| Last active date (signed in) | Updated at most once a day while you are signed in, so staff can see which accounts are in use. | Legitimate interest (operating the service) |
| Site traffic (Plausible, nothing stored in your browser) | Counts page views and where visitors come from. Each page view records the page, the referring site or campaign tag, your browser, operating system and device type, and the country your IP address points to. Your browser sends it to our server, which passes it on to Plausible with your IP address and user agent. Plausible uses those only to tell visitors apart within a day and does not store them. Nothing is linked to your account. | Legitimate interest (operating the service) |
| Product analytics (Mixpanel, signed-in accounts) | What signed-in accounts do in PardyTime, so we can see whether the product works: signing up and in, finishing onboarding, making, copying and editing games (and for how long), uploading media, hosting lobbies and games, reaching a free-plan limit, viewing upgrade options, starting checkout, subscription changes, and requesting account deletion. Sent from our servers, keyed on your account's random ID. Along with each action we send your public @username, account type, plan, signup method and country (from Cloudflare's header or your signup country). For actions taken in your browser we add the region and city Cloudflare places your connection in, and your operating system, browser and device type, read from your browser's user agent. Never your email, real name, IP address or the user agent itself. Games you host carry counts of players, including how many joined by QR code, PIN or link, but nothing about the players themselves. Guests and players without an account are never sent. You can object at any time under Settings, Preferences: we stop sending anything about your account and delete your Mixpanel profile. | Legitimate interest (product improvement) |
We show no ads and use no advertising or cross-site trackers. Our two analytics services, Plausible and Mixpanel, store nothing on your device and run no session replay. See the cookies page for everything we store in your browser.
3. Service providers (subprocessors)
We use a small number of trusted providers to run the service. They process data on our behalf under their own data-processing terms.
- Cloudflare, Inc. hosting (Workers), file storage (R2), and real-time game rooms (Durable Objects). Privacy policy.
- PlanetScale, Inc. database hosting. Your account, games and play history are stored in its Postgres database in the EU (Dublin, Ireland). Privacy policy.
- Stripe, Inc. payment processing for subscriptions and one-time purchases. Card details are entered directly with Stripe and never reach our servers. Privacy policy.
- Resend sending sign-in codes and transactional email. Privacy policy.
- Mixpanel, Inc. product analytics for signed-in accounts, stored in Mixpanel's EU data centre. What it receives is in the table above. Privacy policy.
- Plausible Insights OÜ (Estonia) site-traffic counts, hosted in the EU, with no cookies and no personal data stored. Privacy policy.
Some content comes straight from another company, so it loads only when you ask for it: Stripe's payment form when you subscribe, YouTube when you play a video clue, and Cloudflare Turnstile (a check against automated sign-ups) on the sign-in page. Once loaded, that company receives your IP address and its own privacy policy applies.
4. International transfers
Cloudflare, PlanetScale, Stripe, Resend and Mixpanel are US-based companies that operate global infrastructure. Mixpanel stores our data in its EU data centre, the PlanetScale database is in the EU, and Plausible is an EU company hosting in the EU. Where personal data is transferred outside the EU or EEA, the transfer is covered by the EU Standard Contractual Clauses and the provider's own safeguards. The iOS app does not send data to Resend or Stripe. Its server-side processing is Cloudflare (file storage and real-time game rooms).
5. How long we keep your data
- Account data (email, username, display name) until you delete your account.
- Sessions sign-in sessions expire 30 days after creation; you can sign out at any time to invalidate yours sooner.
- Sign-in codes and attempt logs kept for a short period to detect abuse; codes expire minutes after issue.
- Site traffic Plausible keeps only aggregated counts, with nothing that identifies a visitor.
- Product analytics kept in Mixpanel while your account exists. When you opt out or your account is deleted, we delete your Mixpanel profile. Past events stay in Mixpanel under your account's random ID, which no longer belongs to any account once the account is deleted.
- Signup country kept with the account until you delete it.
- Games and media until you delete them or your account.
- Payment records retained as long as required by tax and accounting law (typically 5 to 7 years in the EU), then deleted.
6. Your rights
Under the GDPR you can, at any time:
- Ask for a copy of the personal data we hold about you (access);
- Ask us to correct inaccurate data (rectification);
- Ask us to delete your account and associated data, subject to the tax-law retention noted above (erasure);
- Ask us to export your data in a portable format (portability);
- Object to processing based on legitimate interest, including product analytics, which you can switch off yourself under Settings, Preferences;
- Lodge a complaint with your local data protection authority. In Denmark, this is Datatilsynet (datatilsynet.dk).
To exercise any right, email support@grepbyte.com. Account deletion is also available from your settings page: we email you a link to confirm, then hold the account for 30 days before permanently deleting your profile, quizzes and uploads. Sign in at any point during those 30 days to cancel.
7. Children
PardyTime is not directed to children under 16. If you are under 16, please do not create an account. If we learn that we have collected data from a child under 16 without parental consent, we will delete it.
8. Security
Sign-in is passwordless: we email you a one-time code, never a password. Session tokens are stored as one-way hashes; payment card details never reach our servers. All traffic is served over HTTPS.
9. Changes to this policy
We will update this page when the service changes in a way that affects your privacy. The "last updated" date at the top reflects the most recent version. Material changes will be announced by email or in-app.
10. Contact
Questions, requests, or complaints: support@grepbyte.com. Copyright notices: dmca@grepbyte.com.
11. The iOS app
The iOS app is for joining games. It does not create an account, take payment, or run ads or analytics. This section is what the app collects. Who we are, your other rights, and how to contact us are in the sections above.
| Data | Purpose | Lawful basis (GDPR Art. 6) |
|---|---|---|
| Display name | Shown to other players in a room. Stored on your device. | Legitimate interest (gameplay) |
| Guest id | A random id created on your device so this install can rejoin a room and so an uploaded photo can be found and deleted. We do not keep a database record of it. If you upload a photo, the id is part of that file's path. | Legitimate interest (gameplay) |
| Player photo (optional) | The picture you choose from the camera or photo library, stored so other players can see it. Replaced when you choose a new one. Deleted when you delete your identity in the app. A generated avatar is not this photo. | Legitimate interest (gameplay) |
Generated avatars are not stored by us. The app requests the picture from DiceBear using a random seed kept on your device. That request goes from your phone to DiceBear.
While a room is live, your name and avatar are shown to the other players. When the game ends, the host's result keeps the display name, the avatar reference, and the score. It does not keep the guest id. Delete identity removes the uploaded photo from our storage and clears that photo from stored results. The name and score on the host's result stay.
Delete identity also removes the name, photo, and guest id from the device. That happens immediately. The 30-day hold above is only for deleting a signed-in account on the web. This data is used for gameplay. Deleting the identity is how you stop that.
The app is part of the same service and is not directed at children under 16.