How PartyPop handles your data

Who operates PartyPop

PartyPop is operated by Storm Ashton, an individual trading as PartyPop in the United Kingdom. PartyPop provides the game at partypop.online. For privacy questions, deletion requests or rights requests, email privacy@partypop.online.

Information we collect or create

• Room codes, display names, private session tokens, device-readiness results, game choices, scores, votes and card activity.
• Optional photos, short videos and video audio only when a player chooses to capture and then confirms upload.
• Reports about room media and the moderation actions taken by a host.
• Technical security data such as request time, IP address, browser information and service logs processed by our hosting provider.
• Administrator usernames, securely hashed passwords, login attempts and essential administrator session cookies.

Why we use it and our lawful bases

Room and game data is used to provide the game requested by players and hosts (performance of a contract or steps requested before it). Security, abuse prevention and basic service logs are used for PartyPop's legitimate interests in operating a safe, reliable service. Camera, microphone and motion access is requested only after an explanation and a user action; optional media is uploaded only after a separate confirmation. Where consent is the appropriate basis, it can be withdrawn by deleting the media or contacting us.

Who can see or receive data

Verified players in the same private room can see room names, game activity and uploaded room media while the room is active and in its read-only memory archive after the game. Media requests require a valid participant credential; knowing a media address alone does not grant access. Anyone a player deliberately gives a downloaded copy to may also see it. Hosts can moderate and delete room media. PartyPop uses Cloudflare Workers, D1 and R2 for hosting, structured data and media storage. Spotify's Scannables service receives the selected Spotify song identifier and normal request metadata only when a Spotify code is displayed. We do not currently use advertising or analytics services.

International transfers

Cloudflare and Spotify operate internationally, so data may be processed outside the UK. PartyPop relies on the provider's applicable contractual and legal transfer safeguards. Contact us if you want details relevant to a particular transfer.

Retention and automatic expiry

Each room photo or video is kept for no more than 7 days from upload, then physically deleted from media storage. The active lobby code may expire sooner without removing a participant's protected read-only archive. Room records and player display names are automatically removed within 30 days of their last activity. Private room identity remains on a participating device so the player can reopen recent memories; the player can forget that access on the device at any time. Administrator and published game content is retained while the service account remains active or until it is deleted.

Delete, report or request your data

Media can be permanently deleted by its subject, the player who captured it, or the room host. Any active room player can report media and the host can remove it. Closing a finished party keeps private, read-only memory access on that participating device until automatic expiry. “Forget on this device” removes only that device's saved access; “Delete my room data” removes the player's display name, game activity, reports and associated room media and revokes their archive credential. An administrator's permanent lobby deletion removes the room, history and all stored media immediately. For access, correction, deletion, restriction, objection, portability or withdrawal requests, email privacy@partypop.online with the room code, display name and approximate date. Do not send a session token or password.

Children and 18+ games

PartyPop can be accessed by children and teenagers even though they may not be the intended audience. Players under 18 should use only age-appropriate games with a parent or responsible adult. Party genres containing adult-only games require an 18+ confirmation from hosts and joining players. PartyPop treats likely access by under-18s as requiring UK Children's Code consideration, data minimisation, high-privacy defaults and a documented risk review; an age confirmation is not a substitute for age assurance where higher-risk use requires it.

Cookies and device storage

Essential storage protects administrator, host and participant sessions and remembers private room identity and recent archive access on the participating device. Non-essential cookies and services remain off until a clear positive choice is saved. Browsing is not treated as consent, and the Privacy & cookies control can change or withdraw the choice at any time.

Complaints

Please contact PartyPop first so we can investigate. You can also complain to the UK Information Commissioner's Office through ico.org.uk/make-a-complaint.