Short version: you can play everything without an account, and then we store nothing about you. An account exists so that chat has a person behind it, and it keeps your name, friends and statistics. There is no advertising and no analytics either way.
Nothing personal is stored. A room holds the nickname and emoji you picked, your score, and the messages sent in that room, and the whole room is deleted automatically 6 hours after the last person stops playing. We do not archive it, back it up separately or use it for anything else.
Your nickname is whatever you type. If you would rather not be identifiable, type something that is not your name. Nothing checks it and nothing links it to you.
Some things are stored in your own browser and never sent to us: which room you are in and the key that proves it is you, the nickname and emoji you last used, your colour theme, whether sound is on, your music volume for the song game, anyone you have muted in chat, your best score in the game at the bottom of the home page, and which cards your group has already seen so next week's game feels fresh. Clearing your browser data removes all of it.
We set one cookie for the language you picked, so the site loads in it next time, and one for your session if you sign in. There are no advertising or tracking cookies, which is why there is no cookie banner to click away.
You can sign in with a code sent to your email, Google or Discord. Accounts are for people aged 16 and over: the sign-in screen asks you to confirm that before anything happens, and younger players can play every game as a guest.
Signing in with Google or Discord gives us your email address, and that company also sends the name and profile picture on your account. The game never uses or shows those: they stay in the sign-in record our authentication provider keeps, alongside your email. Signing in with a code gives us only the email address you typed, and the code is delivered by Resend, which sends the email for us and keeps a short delivery log of it.
We store:
Your email is held by our authentication provider so we can recognise you when you sign in again. It is never shown to other players and never used to contact you. There is no mailing list.
Your username, your emoji and your friend code. That is all. Not your email, not your statistics, not who your friends are.
Party chat lives inside the room and disappears with it. Direct messages between friends are stored until one of you deletes them by deleting your account. Links are automatically stripped from both. Nobody reads your messages unless somebody reports one, in which case that single message is copied into the report so it can be looked at.
At the bottom of the home page there is a small game you can play without joining a room or signing in. Playing it sends us nothing. Your best score is kept in your own browser, and that is the end of it.
Putting a score on the leaderboard is a separate, deliberate button. If you press it we store the score, the emoji you were running as, the course the run was played on, the time, and a name, but not a name you typed. You are handed one built from two fixed word lists that ship with the site, with a button to shuffle it, so the only names that can appear on that board are names we wrote. There is no account, session or IP address attached to any of it.
We do this because a public leaderboard is the most visible and longest-lived thing on the site, and a free text box on it would be an invitation we could not moderate.
Submitted scores are deleted after 30 days. The top 100 of all time are kept for as long as they hold their place, because deleting those would be deleting the leaderboard.
The song game plays Apple's own 30-second song previews. When a round starts, our server looks the song up in Apple's music search by its title and artist. Nothing about you is in that request.
Your phone then loads the clip, and after the round the album cover, directly from Apple, the way any page loads a file from another site. That tells Apple your internet address and that a preview was played. It does not tell Apple who you are, and we send Apple nothing else. What Apple does with it is covered by Apple's own privacy policy. Each round ends with a link to the song on Apple Music; following it is up to you.
The site runs on Vercel, and the database and sign-in are Supabase (Apple comes in only for the song game, as described above). Both keep short-lived technical logs that include IP addresses, as any web server does, and both act as processors for us under contract. We do not use Google Analytics or any other analytics product. The font is served from this site rather than from Google, so loading a page tells Google nothing.
Sign-in codes are emailed by Resend, which acts as a processor for us and sees only the address it delivers to and the email itself.
If you sign in with Google or Discord, that company knows you used your account to sign in here, as with any "sign in with" button. Their own privacy policy covers that; we receive only what is described above.
To stop somebody scripting thousands of empty rooms, we count how many a given internet address has created in the last few minutes. That count is held in memory for those few minutes and never written down, so nothing remains of it afterwards.
This site is not aimed at young children. Anyone can play as a guest, but accounts are for people aged 16 and over. The 🌶️ content pack is for adults only. It is off by default, has to be switched on deliberately with an age confirmation, and cannot be used in public rooms at all. Only a host who is signed in and has confirmed they are 18 or older can switch it on.
Go to your stats and choose Delete my account. Your profile, friends, messages and statistics are removed immediately and permanently. Reports you filed about other people are kept but no longer say who filed them, because a complaint about somebody else is not yours to erase.
One exception, stated plainly: if your account is banned when you delete it, we keep a one-way fingerprint of your email address so the ban still applies if you sign in again. It cannot be read back into an address and it is used for nothing else. Without it, deleting your account would be the quickest way to undo a ban.
Under the GDPR you can ask what we hold about you, ask for a copy, ask for it to be corrected or deleted, and complain to a supervisory authority. In the Netherlands that is the Autoriteit Persoonsgegevens. Deleting your account does most of this immediately; for anything else, including a report you want removed, email us.
Helder Games is run by Helder Labs. For privacy questions, data requests and abuse reports: info@helderlabs.com.
If this policy changes in a way that matters, this date changes with it. Last updated 16 October 2026.