PRIVACY POLICY

Pitchfaced works without accounts. We never ask for your email, real name, phone number, or location. There are no ads, no trackers, and no analytics cookies. Game rooms self-destruct automatically — everything tied to a match is deleted within 24 hours of it ending.

When you host or join a room, we store:

• The nickname you type in — it can be anything; it doesn't have to be your real name.
• Game activity — cards dealt and tapped, scores, drink tallies, and game events for your room.
• Room details — the room code, match name, game mode, and timestamps.

That's the complete list. We do not collect email addresses, passwords, contacts, precise location, or device fingerprints.

We use your browser's local storage (similar to cookies) to remember a few things between visits:

• A random device ID — generated on your device; used only to remember a Tournament Pass purchase, if you ever make one.
• Your player ID for the current room — so a page refresh doesn't kick you out of the game.
• Small preferences — like whether you dismissed the "install app" prompt.

None of this identifies you personally, and you can wipe it anytime by clearing your browser data for this site.

Game data is stored in a managed PostgreSQL database hosted by Supabase. The site itself is served by Vercel. Both are reputable infrastructure providers with their own privacy and security commitments. We do not sell, rent, or share your data with anyone else.

Rooms are deleted on a schedule by an automated job, along with every player, card, and event inside them:

• Finished matches — deleted 24 hours after the match ends.
• Lobbies that never started — deleted after 6 hours.
• Games left running — deleted after 12 hours.

Once a room is deleted, the data is gone. There is no archive of past games.

During a match, our server asks football-data.org for the current score. The only thing sent is the match name (e.g. "Mexico vs South Africa") — nothing about you or your room.

If we offer paid upgrades (like the Tournament Pass), payment is handled entirely by Stripe. Your card number never touches our servers. The only thing we store is your random device ID, so the purchase unlocks on your device.

Depending on where you live (e.g. under the GDPR in Europe or the CCPA in California), you may have the right to access or delete data about you. In practice, the fastest path is to wait out the auto-deletion window above — we will also handle written requests once our contact information is listed below.

Pitchfaced is not directed at children under 13 (or the equivalent minimum age in your country), and the drinking mode is strictly for people of legal drinking age. We do not knowingly collect data from children.

If this policy changes, we'll update this page and the date at the top. Material changes will be called out on the site.