Privacy Policy

Data collected

We may process account identity and authentication details, organization/class assignments, game decisions, votes, chat, scores, reports, technical logs, support requests, and billing records. We do not request Google passwords.

Purpose and legal bases

We process data to deliver games, authenticate users, secure the service, administer licenses and classrooms, respond to support, and meet legal obligations. For GDPR/UK GDPR, bases may include contract, legitimate interests, legal obligations and consent where required. Marketing and optional tracking require separate treatment.

Schools and roles

For school-directed student records, the school ordinarily determines educational purposes and J&P Global LLC processes the data on documented instructions under the School DPA; role allocation depends on actual facts and law. Teachers see only their assigned cohorts; school admins see only their institution; students see only permitted game data.

Rights and transfers

Subject to applicable law, individuals may request access, correction, deletion, portability, objection, restriction or withdrawal of consent. Schools coordinate student-record requests. International transfers from the EEA/UK require an appropriate mechanism (such as applicable SCCs/UK addendum), assessments and safeguards where necessary. Privacy requests: [email protected].

Retention and security

Data is retained only for documented business, educational, security and legal purposes, with configurable school deletion/export schedules. We use access controls, encryption in transit, logging and incident response. We do not sell student data or use it for behavioral advertising.

Google user data

We request only the basic Google sign-in scopes (openid, email and profile). We use your email address to identify your account and check whether you have access, and your name and photo to show you to other players in the games you join. We do not use Google user data for advertising, we do not sell it, and we do not share it with third parties except the service providers listed below that run the platform. Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

You can withdraw consent for Google sign-in at any time from your Google Account permissions.

Service providers

These subprocessors run the platform, each bound by its own data protection terms:

• Supabase: authentication and database (United States).
• DigitalOcean: application hosting (United States).
• Cloudflare: domain name service and network security.
• Resend: delivery of sign-in and service emails.
• Google: Google sign-in, when you choose it.
• PayPal: card and PayPal payments, when you choose it.
• Sepay: matching bank transfers (VietQR) to orders, when you choose it.

Other players in your game room see your display name, avatar or photo, role, decisions, chat messages and scores.