Privacy notice

Who runs Showtime

Showtime is run by Martin Hughes. For questions about your data, email martin@hughes.lol.

What happens when you play

You choose a player name; a nickname is fine. We store it with your room, score, answers, response times and game statistics so everyone in the room sees the same game. Other players in your room can see your name, score and revealed results. Anyone with an unprotected room’s code may join its lobby. Add a password if you want to restrict entry.

Your browser stores your last player name and a room session so you can reconnect. The session contains a random access token. Keep it private: it represents your place in the room. We store a hash of that token on the room server. Room passwords are salted and hashed; we don’t store the original password.

Cloudflare handles the live room connection and Vercel serves the website. They receive technical information such as IP address, browser information and request details to deliver and protect the service. Room join limits use an IP address and attempt counters to reduce password guessing and abuse.

Optional analytics

Analytics is off until you allow it. If you opt in, Vercel Web Analytics records page visits and a limited set of events, such as successful joins, failed joins, selected packs, completed games and rematches. It also provides broad information about devices, browsers, referral sources and countries.

Our game events don’t include player names, room codes, passwords, session tokens, question text or answers. We remove query strings and fragments from page URLs before sending them. Vercel Web Analytics uses a short-lived, hashed visitor identifier rather than analytics cookies. See Vercel’s analytics privacy documentation for how it processes requests.

Cookie settings to turn analytics off or change your choice. Withdrawing consent stops future analytics events; it doesn’t remove statistics already counted.

Why we use this information

We use room and session information to provide the game you request (performance of that service). We use limited operational and security information to keep it reliable and prevent abuse. Optional analytics relies on your consent. If you email us, we use your message and email address to respond and deal with the issue you raised. We don’t use your email for marketing.

Solo practice

Practice does not create a multiplayer room or open a game WebSocket. An encrypted session token travels with requests to check answers and keep your progress. It is separate from your multiplayer name and room session. The practice API briefly counts requests by network address to limit repeated requests; it does not create a gameplay database. Practice uses essential in-memory state in the page; leaving or refreshing can end that session. Hosting providers may process the requests in operational logs as described above.

How long information stays

Room data is cleared after 24 hours without room activity, or when the last player explicitly leaves. That includes names, answers, scores, statistics, password hashes and reconnect credentials held by the room. Closing a tab keeps your place for a 30-second reconnect window. After that, your participant and reconnect credential are removed. If your connection silently stops responding, a heartbeat detects it before that window starts. A host can also remove a participant.

Your saved name stays in your browser until you clear it. Your room session is removed when you leave or when the app discovers it is no longer valid. Your analytics choice is valid for six months; after that we ask again. Clearing this site’s browser storage also removes these settings.

Vercel and Cloudflare retain operational records according to their service settings and retention policies. Analytics reports are held in Vercel under the project’s retention settings. Emails may be kept while we resolve a request and for any follow-up that is needed.

Who receives data

Vercel and Cloudflare process data to host and operate Showtime. Their services may process it outside the UK or your own country. Their privacy information describes the safeguards and transfer arrangements they use: Vercel and Cloudflare. We don’t sell player information or run advertising trackers.

Your choices and rights

You can play with essential storage only. Use a nickname, leave a room when you’re finished, and clear site storage on a shared device. If you organise a game for children, help them choose names that don’t reveal personal details.

You can ask for access, correction or deletion of personal information we hold, or raise an objection to its use. Some rights depend on the reason we hold it and your location. Email us with enough detail to identify the issue, but don’t send your room password or reconnect token. Once a room has expired, we may no longer have data that identifies its players.

If you’re in the UK, you can also complain to the Information Commissioner’s Office. You can contact your local data protection authority elsewhere.