Privacy Policy | Fun Friday

1. Who we are

Fun Friday is operated from the United Kingdom.When this policy says “we”, “us” or “our”, it means the operator of Fun Friday, who is the data controller for the personal data described in this policy.

Contact: [email protected]

2. What data we collect

Account data — email address, display name, and avatar when you create an account.
Game data — your answers, scores, and session participation.
Team data — team name, slug, member list, and invite activity.
Billing data — none. Fun Friday is free during beta, so we do not ask for or hold payment details, and no card data reaches us or our payment processor.
Usage data — pages visited, features used, and error logs (to improve the product).
Session recordings — if you accept analytics cookies, we record how you move through the app — pages and clicks — so we can see where people get stuck. Anything you type is masked, and the answers you give during a game are masked in the recording. This is off unless you accept analytics cookies.
Guest data — display names entered to join a game session. Not linked to any account.

3. How we use your data

To provide the service — running game sessions, tracking scores, managing teams.
To send service announcements about changes to your plan or the beta, via Resend. You can turn these off in your settings.
To send transactional emails (sign-up confirmation, password reset) via Resend.
To diagnose errors and improve reliability.
To send product updates if you opt in (you can unsubscribe at any time).

We do not sell your data. We do not use your data for advertising.

4. Legal basis (UK GDPR)

Contract — processing needed to deliver the service you signed up for.
Legitimate interests — error monitoring, fraud prevention, service improvement.
Consent — marketing emails (you can withdraw consent at any time).

5. Data retention

Account data is retained while your account is active. Deleting your account removes it and the data attached to it immediately — there is no grace period, and it cannot be undone.
The answers you type during a game are deleted 30 minutes after the session ends. Your score and position are kept; what you wrote is not.
Scores, rankings and guest display names are deleted 90 days after the session ends, along with the session itself.
Game history is available to view for as long as your team is on a paid plan, within the 90-day window above. On the free plan, past sessions are not available to view.
IP addresses recorded in our administrative audit log are removed after 90 days. The record of the action itself is kept.
Billing records are kept for as long as HMRC can require them to be produced — at least five years after the 31 January submission deadline for the tax year they fall in.

6. Your rights

Under UK GDPR you have the right to:

Access the personal data we hold about you.
Correct inaccurate data.
Delete your account and associated data.
Object to or restrict processing.
Data portability (export your data).

To exercise any right, email [email protected]. We will respond within 30 days.

You may also lodge a complaint with the Information Commissioner's Office (ICO).

7. Cookies

We use cookies for:

Essential — authentication session tokens (Supabase). Cannot be disabled.
Analytics — product usage analytics (PostHog, EU-hosted) to understand how features are used and improve them. Off by default — set only if you choose “Accept all”. You can change your choice at any time via “Cookie settings” in the footer.

We do not use advertising or tracking cookies.

8. Third-party services

Supabase (EU) — database and authentication.
Stripe — payment processing. Not in use during beta: no payment data is sent to Stripe. Stripe's privacy policy would apply to card data if we begin charging.
PostHog (EU) — product analytics and session recordings, only where you have accepted analytics cookies.
Resend — transactional email delivery, and delivery of messages you send us.
Microsoft Azure (France Central) — application hosting.
Cloudflare — DNS and DDoS protection.

9. Connected AI assistants

You can connect an AI assistant — ChatGPT, Claude, or any other client that speaks the Model Context Protocol — to your Fun Friday account, either by approving it on our consent screen or by creating an access token in Account → Security. Nothing is connected unless you connect it.

What a connected assistant can read:the catalogue of games, your team’s name, member count, plan and how many games it has left this week, the sessions your team has played with their dates, player display names and scores, your team’s leaderboard, and the live state of a room you host, are in, or that belongs to your team. It cannot read the answers you type during a game, anyone’s email address, any billing detail, or anything belonging to a team you are not in.

What it can do: start a game and get a room code, and only if you explicitly allowed that when you connected it — it is off by default. No assistant can play a game: there is no way for one to submit an answer, cast a vote, guess or draw.

Who receives the data: the operator of the assistant you connect (for example OpenAI for ChatGPT, or Anthropic for Claude), because the answer is sent to them to be shown to you. Their privacy policy governs what they do with it once it arrives; we have no control over that, which is why the connection is yours to make and yours to end. Data is sent only in response to a request you made in that assistant — we never push anything to it.

What we store: which app you approved and whether you allowed it to start games, and, for an access token, a one-way hash of the token with the date it was last used. Tokens and approvals are deleted when you revoke them or delete your account.

Your control: disconnect an app or revoke a token at any time in Account → Security. It stops working immediately.

10. Changes to this policy

We may update this policy. Material changes will be communicated by email or by a notice on the platform. Continued use after notification constitutes acceptance.