Privacy Policy

1. Who we are

Fun Friday is operated from the United Kingdom. When this policy says “we”, “us” or “our”, it means the operator of Fun Friday, who is the data controller for the personal data described in this policy.

Contact: privacy@funfriday.work

2. What data we collect

• Account data — email address, display name, your chosen avatar, and the game points, level and achievements you earn when you create an account. Other players in the same game room, and members of your teams, can see your level, achievements and game totals (games played, wins, top-three finishes, games hosted) by tapping your name; nobody else can look them up. Other players in a game room also see the name of the team you play for, and a team owner or admin you are in a room with can add you to their team.
• Game data — your answers, scores, and session participation.
• Team data — team name, slug, member list, and invite activity.
• Billing data — none. Fun Friday is free during beta, so we do not ask for or hold payment details, and no card data reaches us or our payment processor.
• Usage data — pages visited, features used, and error logs (to improve the product).
• How you found us — when you create an account, the site that sent you (its address, without any search terms or query string), the first page you landed on, and any campaign tag in that link, so we know which channels bring people who go on to play. Kept with your account and deleted with it.
• Session recordings — if you accept analytics cookies, we record how you move through the app — pages and clicks — so we can see where people get stuck. Anything you type is masked, and the answers you give during a game are masked in the recording. This is off unless you accept analytics cookies.
• Feedback — what you write when you send feedback or report a problem in a game, the page you were on, and a screenshot if you choose to attach one. If you have accepted analytics cookies, we also note which session recording the report came from, so we can watch what went wrong. Screenshots can only be seen by our admins.
• Game ratings — the stars you give a game on its results page, so we know which games people enjoy.
• Guest data — display names entered to join a game session, and the points a guest would have earned in that room (kept with the session, so they can be moved to an account the guest creates within 24 hours). Not linked to any account unless the guest chooses to create one.

3. How we use your data

• To provide the service — running game sessions, tracking scores, managing teams.
• To send service announcements about changes to your plan or the beta, via Resend. You can turn these off in your settings.
• To send transactional emails (sign-up confirmation, password reset) via Resend.
• To diagnose errors and improve reliability.
• To send product updates if you opt in (you can unsubscribe at any time).

We do not sell your data. We do not use your data for advertising.

4. Legal basis (UK GDPR)

• Contract — processing needed to deliver the service you signed up for.
• Legitimate interests — error monitoring, fraud prevention, service improvement.
• Consent — marketing emails (you can withdraw consent at any time).

5. Data retention

• Account data is retained while your account is active. Deleting your account removes it and the data attached to it immediately — there is no grace period, and it cannot be undone. Your scores in past games stay part of those games’ results, under the name “Former player” with nothing linking them to you.
• The answers you type during a game are deleted 30 minutes after the session ends. Your score and position are kept; what you wrote is not.
• Scores, rankings and guest display names are deleted 90 days after the session ends, along with the session itself.
• Game history is available to view for as long as your team is on a paid plan, within the 90-day window above. On the free plan, past sessions are not available to view.
• Screenshots attached to feedback are deleted 90 days after they are sent. The written report is kept.
• Game ratings are kept to compare games over time. Deleting your account removes your name from your ratings; the star count stays, with nothing linking it to you.
• IP addresses recorded in our administrative audit log are removed after 90 days. The record of the action itself is kept.
• Billing records are kept for as long as HMRC can require them to be produced — at least five years after the 31 January submission deadline for the tax year they fall in.
• We keep encrypted backups of the database so it can be restored after a failure: daily copies for 35 days, weekly for 120 days and monthly for 400 days, each deleted automatically when it expires. Data deleted from the service stays in older backups until those expire. If we ever restore a backup, we first delete again everything that had been deleted since it was made, including deleted accounts, before the service uses it.

6. Your rights

Under UK GDPR you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate data.
• Delete your account and associated data.
• Object to or restrict processing.
• Data portability (export your data).

To exercise any right, email privacy@funfriday.work. We will respond within 30 days.

You may also lodge a complaint with the Information Commissioner's Office (ICO).

7. Cookies

We use cookies for:

• Essential — authentication session tokens (Supabase). Cannot be disabled.
• Analytics — product usage analytics (PostHog, EU-hosted) to understand how features are used and improve them. Off by default — set only if you choose “Accept all”. You can change your choice at any time via “Cookie settings” in the footer. Accepting also lets us remember, in your browser, the page you first arrived on, so it can be recorded if you create an account on a later visit; declining removes it.

We do not use advertising or tracking cookies.

8. Third-party services

• Supabase (EU) — database and authentication.
• Stripe — payment processing. Not in use during beta: no payment data is sent to Stripe. Stripe's privacy policy would apply to card data if we begin charging.
• PostHog (EU) — product analytics and session recordings, only where you have accepted analytics cookies.
• Resend — transactional email delivery, and delivery of messages you send us.
• Microsoft Azure (France Central) — application hosting.
• Cloudflare — DNS and DDoS protection.
• Google — Sign in with Google in the Google Meet add-on, only if you choose it (section 11).

9. Connected AI assistants

You can connect an AI assistant — ChatGPT, Claude, or any other client that speaks the Model Context Protocol — to your Fun Friday account, either by approving it on our consent screen or by creating an access token in Account → Security. Nothing is connected unless you connect it.

What a connected assistant can read: the catalogue of games, your team’s name, member count, plan and how many games it has left this week, the sessions your team has played with their dates, player display names and scores, your team’s leaderboard, and the live state of a room you host, are in, or that belongs to your team. It cannot read the answers you type during a game, anyone’s email address, any billing detail, or anything belonging to a team you are not in.

What it can do: start a game and get a room code, and only if you explicitly allowed that when you connected it — it is off by default. No assistant can play a game: there is no way for one to submit an answer, cast a vote, guess or draw.

Who receives the data: the operator of the assistant you connect (for example OpenAI for ChatGPT, or Anthropic for Claude), because the answer is sent to them to be shown to you. Their privacy policy governs what they do with it once it arrives; we have no control over that, which is why the connection is yours to make and yours to end. Data is sent only in response to a request you made in that assistant — we never push anything to it.

What we store: which app you approved and whether you allowed it to start games, and, for an access token, a one-way hash of the token with the date it was last used. Tokens and approvals are deleted when you revoke them or delete your account.

Your control: disconnect an app or revoke a token at any time in Account → Security. It stops working immediately.

10. Slack and Discord apps

A team owner or admin can connect a Slack workspace or a Discord server to their team, so that anyone there can start a game with /funfriday. Nothing is connected unless they connect it.

What we store: for Slack, the workspace’s ID and name and the access token Slack issues to the app; for Discord, the server’s ID and name and the Discord user ID of the person who linked it. We also store which Fun Friday team it is linked to and which team member connected it.

What we do not collect: we do not read messages, channel contents or member lists. When someone runs the command, Slack or Discord sends us that command, which we use only to open the game and reply with its room code and join link.

Deletion: a Slack connection is deleted when the app is uninstalled from Slack, the team is deleted, or the person who connected it deletes their account. A Discord connection is deleted when a team owner or admin unlinks it on the team settings page, when the team is deleted, or when the person who linked it deletes their account. You can also ask us to remove either by emailing privacy@funfriday.work.

11. Google Meet add-on

You can open Fun Friday inside a Google Meet call from Meet’s Activities panel. The game runs exactly as it does in your browser. You play as a guest under the display name you type, and the guest data described above applies, unless you sign in.

Signing in with Google inside Meet: if you choose Sign in with Google (Google’s One Tap prompt or button), Google shares your name, email address and profile picture with us, and nothing else. We use them only to sign you in to Fun Friday: to find your account by that email, or to create one if you have none, and we keep them as the account details described above. We never use Google data for advertising, never sell it, and do not share it except with the services in section 8 that run Fun Friday. Fun Friday’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Other ways to sign in inside Meet: Other ways opens Fun Friday in a small window, where you confirm with your Fun Friday account. We record that confirmation for at most two minutes, so that Meet can be signed in as you once, and delete it within a day.

Either way, the Fun Friday session is kept in your browser’s storage for Meet, separate from the rest of the site, until you sign out there. If you played as a guest first, your seat and points move to your account, as described above.

What Meet does not give us: the add-on asks Google for no access to your Google account, calendar or meetings. Meet does not give us your Google identity, the meeting’s code or ID, its participants, or anything said or shown in the call. The only thing passed through Meet is the room code the host shares to the call. If you choose to sign in, we process your account details as described above. Google’s own handling of the call is covered by Google’s privacy policy.

12. Zoom app

You can open Fun Friday inside a Zoom meeting from Zoom’s Apps panel. The game runs exactly as it does in your browser. You play as a guest under the display name you type, and the guest data described above applies, unless you sign in. Zoom tells the app your screen name so it can suggest it as your display name; it is only used if you keep it and join.

Linking the meeting to a game: when the host starts a game, Zoom gives the app an encrypted note of which meeting it is in. We use it to remember which Fun Friday room that meeting is playing, so everyone who opens the app in the same meeting lands in the same room. We store a one-way hash of the meeting’s ID, never the ID itself, with the room. It stops being used twelve hours after the game was last shared with the meeting and is deleted within the following hour; copies in our encrypted database backups expire on the schedule in section 5. Requests are rate-limited using a one-way hash of your Zoom user ID, kept only as long as the rate limit needs. If you sign in, what you do in the app is linked to your Fun Friday account, as it is anywhere else on the site.

Signing in inside Zoom: pressing Sign in opens Fun Friday in your own browser, where you confirm with your Fun Friday account. We record that confirmation for at most two minutes, so that the app can be signed in as you once, and delete it within a day. If you played as a guest first, your seat and points move to your account.

What we do not collect: the app asks Zoom only for permission to run in meetings (zoomapp:inmeeting). We do not receive or keep your Zoom account details or email address, the meeting’s participant list, its chat, recordings, audio or video, or anything said or shown in the meeting. Adding the app does not give us a Zoom access token to keep: the one Zoom issues at install is used once, to open the app for you, and discarded. Removing the app from Zoom deletes the rate-limit record above; the meeting link lapses on its own, and your games stay with your Fun Friday account, if you have one; deleting the account removes your name from them. Zoom’s own handling of the meeting is covered by Zoom’s privacy statement.

13. Changes to this policy

We may update this policy. Material changes will be communicated by email or by a notice on the platform. Continued use after notification constitutes acceptance.