Privacy

Nobody Peeks is operated by 2822879 Alberta Inc., an Alberta, Canada corporation ("we", "us"). The short version: we collect as little as a party game can get away with, we never keep the photo of your card, and we delete your game 30 days after the reveal.

We handle personal information under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and Alberta's Personal Information Protection Act (PIPA), and we honour access, correction, and deletion requests wherever you live.

What we collect

• What players type: the display name each player enters and their Team Boy or Team Girl prediction.
• The game itself: the room code, turn order, which cups were lifted, and, once the card is scanned, the locked-in result.
• A device key: a random key stored in your browser's local storage so your phone stays in the game if you refresh. We store only a scrambled (hashed) copy of it.
• Payment status: for paid games, Stripe tells us whether the payment went through, the amount, and a payment reference. Stripe collects your card details and email under its own privacy policy; we never see your card number.
• Basic technical logs: our host (Netlify) processes IP addresses and request logs to run the service and block abuse, such as rate limiting.

We don't ask for accounts, email addresses, or phone numbers to play, and we don't use advertising or tracking cookies.

The photo of your card

When the host scans the card, the phone takes up to three photos and sends them to us. We pass them to our AI provider, Anthropic, to read the result, then discard them. We never write the photos to storage, never show them on any screen, and never log what they contain.

Anthropic processes the photos under its commercial terms, which do not allow using them to train its models. Anthropic may retain API inputs for a limited period for safety and abuse monitoring, as described in its privacy policy.

How long we keep things

• Games, including names, predictions, and the result, are deleted automatically 30 days after the reveal.
• Paid games that haven't been played yet are kept for up to 6 months, so you can buy ahead.
• Practice rounds and games that were never paid for are deleted after 2 days (14 days if a bank payment is still processing).
• Payment records are kept by Stripe as required by law.
• If you use an instant refund, we keep a one-way hash of your checkout email and of Stripe's card fingerprint, so each customer gets one instant refund. The hash can't be turned back into your email or card details.
• If you open your referral link after a paid game, we keep your checkout email with your referral code, so we can send your monthly statements and pay you out, for as long as the program runs or until you ask us to close your code.

Want your game deleted sooner? Email hello@nobodypeeks.com with your room code.

Who we share data with

Only the services that make the game work: Netlify (hosting and storage), Stripe (payments), and Anthropic (reading the card). We don't sell personal information or share it for advertising.

These providers process information in the United States and other countries outside Canada, so it may be accessible to courts and authorities there under local law. We use them under contracts that require them to protect it.

Children

Nobody Peeks is meant to be set up by adults. It isn't directed at children under 13, and we don't knowingly collect their personal information.

Your rights and complaints

You can ask to access, correct, or delete your information, or ask how it's been handled, by emailing hello@nobodypeeks.com with "Privacy" in the subject line. Our Privacy Officer reads those emails. If you're not satisfied with our answer, you can complain to the Office of the Information and Privacy Commissioner of Alberta or the Office of the Privacy Commissioner of Canada.

Changes and contact

If we change this policy we'll update the date above.

Legal entity: 2822879 Alberta Inc., an Alberta, Canada corporation.
Email: hello@nobodypeeks.com.