Privacy Policy.
Built for trust.

Data Controller & Scope of This Policy

NautParty (“NautParty”, “we”, “us”, or “our”) operates the NautParty web platform, including our primary domain (nautparty.com), our Safe Play room (play.nautparty.com and /safe-play), our 18+ After Dark room (afterdark.nautparty.com and /after-dark), Global Pulse (/pulse), and legacy compatibility routes (including /funnaut).

For the purposes of the Kenya Data Protection Act, 2019 (KDPA), the EU and UK General Data Protection Regulation (GDPR / UK GDPR), the UAE Federal Decree-Law No. 45 of 2021 (PDPL), and applicable US state privacy laws (including the California Consumer Privacy Act / CPRA), NautParty is the Data Controller (or “Business”) responsible for personal data processed through the service.

• Privacy & Data Protection Contact: privacy@nautparty.com
• General & Safety Inquiries: hello@nautparty.com

Information We Do Not Collect

To minimize privacy risk—especially around playful or intimate party prompts—NautParty is engineered so that we:

• Do not collect your email address, phone number, physical address, government ID, or payment card details.
• Do not use IP geolocation to tag your country in Global Pulse. Country selection is optional and 100% self-reported.
• Do not request browser permissions for your camera, microphone, precise GPS location, contacts, USB, or Google Topics API (blocked at the HTTP Permissions-Policy header level).
• Do not sell or share personal data with third-party data brokers or ad networks, and never run behavioral advertising or Google Signals profiling.

What Information We Process & How Each Feature Works

A. In-Browser Pass-the-Phone Games & Unsaved Drafts (Local Device Only)

When you play turn-based party games (such as Truth or Dare, EroDice, Spin the Bottle, Picolo, or Never Have I Ever), take the Innocence Test, or fill in prompts before saving a result, your player rosters, turn progress, and draft choices are kept in your browser’s localStorage or sessionStorage. They are not transmitted to our servers unless you explicitly choose to create a server-saved result, save a card, or publish a custom quiz.

B. Server-Saved Results & Scorecards (/results/{id})

When you complete Culture Pulse or a Jar Pack and click “See my free result”, your browser sends the following to our server to generate your profile and downloadable scorecard:

• Game & prompt identifiers and numerical ratings/choices for that round;
• Optional display nickname (up to 32 characters; defaults to “Player” if left blank);
• Optional self-reported country code (if you choose one from the dropdown; defaults to blank);
• Global Pulse opt-in boolean (whether you ticked the unchecked-by-default box to include your answers in anonymous community totals);
• Anonymous browser owner token (nautparty_browser): An HTTP-only, random 32-character token set in your browser cookies so our server recognizes your browser as the creator of that result. This lets you publish/unpublish comparison links or delete the result without needing a user account.

Private Bearer Links: Your result URL (/results/{id}) uses a cryptographic 32-character capability ID and is marked noindex, nofollow and Referrer-Policy: no-referrer. Anyone with that exact private URL can view the result, so keep your /results/{id} URL private and use the separate comparison link if you want to challenge a friend.

C. Reusable Friend & Partner Comparisons (/compare/{shareId})

Creating a result does not automatically make it comparable. A comparison link is created only if you explicitly tick the consent checkbox on your result page and click “Create reusable comparison link”.

• Our server generates a separate 24-character shareId. Someone with your /compare/{shareId} link cannot derive your private /results/{id} URL.
• When a friend opens your comparison link, they see your chosen nickname and the game prompts—not your answers. Once they submit their own answers, the server computes and displays the side-by-side comparison (exact matches, close picks, differences, and any 0 / 5 boundaries).
• The friend’s comparison submission is evaluated on the fly to render the match screen and is not stored as a new server record unless the friend chooses to create their own result.
• You can click “Stop sharing this comparison” or “Delete this result” at any time from the original browser, which immediately invalidates the comparison link.

Safe Play party editions

The dedicated Safe Play editions of Spin the Bottle, Truth or Dare, Know Me Quiz, and Never Have I Ever keep the current round only in page memory. They do not submit answers, save a result, or contribute to Global Pulse. Reloading the page clears the round.

D. Global Pulse & Country Trends (/pulse)

The Global Pulse dashboard is coming soon, but backend collection is active. When you create a Culture Pulse or jar result, you may explicitly opt in to contribute your answers to future combined community trends. Country is optional and self-reported. Your contribution is stored with your result before launch; no public trends are shown yet. Creating a result without opting in still saves the result, but excludes it from Pulse. The following safeguards apply:

• Strictly Opt-In: Only results where you actively checked “Include my answers in Global Pulse community trends when it launches” are considered.
• Latest-Per-Browser Deduplication: Only the most recent result per browser token per game is considered. If you later submit a result for the same game without opting in—or delete your result—your earlier contribution is excluded from future Pulse calculations.
• Minimum Cohort Suppression (k-Anonymity Threshold of 10): Neither cohort participation counts nor individual prompt rankings are displayed unless at least 10 distinct opted-in browsers match the selected view.

E. Downloadable Scorecards & Reusable QR Codes

Portrait and Story PNG scorecards are rendered directly in your browser using HTML5 Canvas. The QR code printed on downloaded cards links only to the public game pack (for example, /play/jars/romantic or /game/culture-pulse)—never to your private result ID, answers, or invitation token.

F. Legacy Saved Jar Cards & Custom Quizzes (Cloud Storage)

If you use our legacy “Save & Share Card” feature in Jars or create/answer a custom Compatibility Quiz (/quiz, /my-cards, /my-quizzes), the card ratings or quiz questions/submissions and your chosen display name may be stored in our cloud database (powered by Supabase) when online saving is configured and succeeds. The interface identifies device-only saves when online sharing is unavailable. Local copies are stored under funnaut_local_jar_sheets, funnaut_local_quizzes, and funnaut_local_submissions. Clearing local game data deletes these device-only copies; it does not delete cloud records. A local-only quiz does not have a working share link.

G. Legacy Invitations, Host Sign-In & Operational Telemetry

Signed-in hosts or players redeeming legacy single-use invite links (/invite/{token} or /login) have a session record stored on our server (access.json) containing a random person ID, display nickname, role (player or admin), invite metadata, and creation/last-seen timestamps.

Our internal usage log (events.jsonl) records only bounded operational counters (such as allowlisted public page paths and fixed game action names like reviewed, dice_roll, or quiz_completed). Our telemetry sanitizer actively strips free text, prompt answers, scores, and private capability URLs (/results/, /compare/, /invite/).

H. Security, Rate Limiting & Cloudflare Turnstile

To protect the service from automated spam and brute-force abuse, our server inspects the connecting IP address in short-lived server memory to enforce rate limits on public write actions (such as creating results, comparing, or logging in). When anti-bot protection is active, we use Cloudflare Turnstile on login, public pack joins, and result creation to verify that requests come from a real browser without showing intrusive puzzles.

After Dark (18+) & Sensitive Preference Data

Games in the After Dark (18+) room involve mature themes, relationship dynamics, and intimate preferences. Under data protection laws (including Section 44–45 of the Kenya Data Protection Act 2019, Article 9 of the EU/UK GDPR, and the CCPA/CPRA), information concerning a person’s sex life or intimate preferences may constitute special category or sensitive personal data when linked or linkable to an identifiable individual.

• Pseudonymous by Default: We never ask for your real name, email, or contact details, and we encourage you to use a playful nickname rather than your full name.
• Explicit Consent Lawful Basis: We only store your After Dark result on our server, generate a comparison link, or include your ratings in anonymous Global Pulse totals when you take an affirmative action (clicking to create a result, checking the comparison-sharing acknowledgment, or checking the Global Pulse opt-in box).
• Instant Withdrawal & Erasure: You may withdraw your consent at any time by clicking “Stop sharing this comparison” or “Delete this result” on your result page, or by emailing privacy@nautparty.com with the link you wish removed.

Purposes, Lawful Bases & Retention

Processors & International Data Transfers

NautParty uses a minimal set of infrastructure and security providers. Because players access NautParty globally, data may be processed in Kenya, the European Economic Area (EEA), the United States, or other countries where our providers maintain infrastructure:

• Truehost Cloud (Web & Application Hosting): Hosts the Node.js application and encrypted server-side data directory.
• Supabase, Inc. (Legacy Cloud Database): Stores legacy saved jar sheets and custom quizzes when you use those specific cloud-save features.
• Cloudflare, Inc. (Turnstile Anti-Bot Verification): Validates human interaction tokens on login, pack join, and result creation when enabled (Cloudflare Privacy Policy).
• Google LLC (Google Analytics 4 — Optional): Loaded only on Home and Safe Play if you click “Accept analytics” (Google Privacy Policy).

Where personal data is transferred outside Kenya, the EEA, the UK, or the UAE, we rely on user consent for optional features, necessity for providing the requested comparison/sharing service, and standard contractual safeguards implemented by our infrastructure providers.

Your Rights Under Kenya DPA, GDPR, UK GDPR, CCPA & UAE PDPL

Depending on where you live, you have the right to:

• Access & Portability: View your saved answers on your result page, download your scorecard PNG, or request a copy of data associated with your link.
• Correction / Rectification: Update your display nickname at any time or create a new result with updated choices.
• Erasure (“Right to be Forgotten”): Delete your stored result directly from your browser using the “Delete this result” button on /results/{id}, or email privacy@nautparty.com with the Result, Comparison, Card, or Quiz URL for server-side deletion.
• Withdraw Consent / Restrict Processing: Switch off a comparison link via “Stop sharing this comparison”, opt out of Global Pulse, or withdraw Google Analytics consent via Cookie settings.
• No Sale / No Automated Profiling: We do not sell personal information, share it for cross-context behavioral advertising, or make automated decisions with legal or similarly significant effects.
• Lodge a Complaint: If you believe your rights have been infringed, please contact us first at privacy@nautparty.com. You also have the right to lodge a complaint with the Office of the Data Protection Commissioner (ODPC) in Kenya (odpc.go.ke) or your local data protection supervisory authority in the EU, UK, UAE, or your home jurisdiction.

Minors, Age Boundaries & Policy Updates

NautParty does not knowingly collect personal information from children under 13 (or the minimum age of digital consent in your country). The After Dark room and all mature games are strictly restricted to adults aged 18 years or older. If we learn that a minor has submitted data to an 18+ feature, we will promptly delete it upon notification at privacy@nautparty.com.

When we make material changes to this Privacy Policy, we will update the “Effective & Last Updated” date at the top of this page.