Privacy Policy
Last updated
This policy explains what Parlay collects, why, who else handles it, and what you can do about it.
What we collect
Account. Your email address and, if you sign in with Google, your name and profile picture from Google. We do not store passwords: sign-in is by Google or by a one-time link sent to your email.
What you add. Games in your collection, house rules, game nights (title, proposed dates, games in the vote), votes and RSVPs, rulebook files you upload, and shelf photos you scan.
Guests. If you join a game night from an invite link without an account, we store only the display name you enter, in a cookie on your device and against that game night. No email, no phone number.
Usage. Pages viewed and features used, collected without cookies (see Analytics below), and error reports when something breaks.
Payments. If you subscribe, Stripe collects your card details directly. We store a Stripe customer reference and your plan, never your card number.
Why
To run the service you asked for; to enforce plan limits; to keep the service secure; to understand which features are used; to bill you; and to answer your messages. We do not sell your data and we do not use it for advertising.
Automated processing and AI
Rulebooks you upload and photos you scan are processed by automated systems, including AI models provided by Anthropic, to extract text and identify games. Uploaded photos have location and device metadata removed before they are stored. Search answers are retrieved from indexed text; no AI model is invoked when you search.
Who else handles your data
- Supabase (United States): database, authentication, file storage.
- Vercel (United States): hosting and delivery.
- Anthropic (United States): AI reading of uploaded rulebooks and shelf photos.
- Black Forest Labs (European Union): generating game icons, from game titles and genres only.
- Stripe (United States): payments.
- Sentry (United States): error reports.
- PostHog (United States): product analytics, without cookies.
- BoardGameGeek (United States): game data and box art, loaded from their image servers.
Each processes data only to provide its service to us, under its own privacy terms.
Analytics and cookies
We set cookies only to keep you signed in (account holders) or to remember your guest name (guests). Analytics runs in cookieless mode: it stores no cookie and no persistent identifier on your device. That is why we do not show a cookie banner.
How long we keep things
Account data for as long as your account exists, then deleted within 30 days of you deleting it. Guest names for the life of the game night. Error reports for 90 days. Backups expire on a rolling 30-day schedule.
Your rights
You can see and export everything we hold about you, and delete your account, from your profile. If you are in the EU, UK or California you also have rights to correct data, to object to or restrict processing, and to complain to your data protection authority. Email privacy@parlay.rocks to exercise any of them. We respond within 30 days.
Children
Parlay is not for children under 13 and we do not knowingly collect their data.
Changes
We will update this page and change the date at the top. Material changes will be announced to account holders by email or in the app.
Contact
[Legal entity name], privacy@parlay.rocks