Privacy policy

Who's responsible

Willie Rall, a sole proprietor based in South Africa, runs Allegedly and is responsible for the personal information described here: the “responsible party” under POPIA and the “controller” under the GDPR. Our Information Officer is Willie Rall, at hello@allegedly.chat.

Your chat never leaves your device

When you make a game, your browser reads the chat export on your own phone or computer. It counts messages, finds quotes and deals the questions right there. The chat file is never sent to us or to anyone else, and we keep no copy of it anywhere.

One exception, also on your device: if you share an export to Allegedly from your Android phone's share sheet, the file waits in your browser's storage until you open it. If you don't open it within 10 minutes, it is ignored and deleted the next time Allegedly opens.

What the game link carries

The game you post is inside the link itself: the questions you kept, the names in the game (or Friend A, Friend B… if you chose nicknames), the award winners and a few counts, compressed and encrypted. All of it sits after the # in the link, and browsers never send that part to a server, so it never reaches us or our host.

The key to open it is in the link too, so anyone with the link can open the game. That is why we ask you to share it only in the chat it came from. Scores travel the same way: a “beat me” link carries the game's leaderboard (names or guest nicknames, and scores).

Share cards (the images) show stats, never messages.

Anonymous counts

To learn whether the game works, the app counts a few moments: a chat was read, a game was made, shared, opened or finished, a score was posted, a player went on to make their own game, and Awards Night was offered or unlocked.

Each count carries only its name, a few numbers and yes/no facts (such as “10 questions”, “6 players” or “made from the sample chat”, with numbers from 100 up rounded), the app version and the country that Cloudflare sees the visit coming from. Never cookies, IDs of any kind, names, messages, chat titles, links or IP addresses. The app sends the counts in one small request to our own site when you leave or switch away from the page.

We keep the counts in Cloudflare Workers Analytics Engine for about three months. If your browser sends a Global Privacy Control signal, the app counts nothing at all, and nothing is counted in automated browsers either.

These counts cannot be linked to you, so they are not personal information. We keep them because we have a legitimate interest in knowing whether the game works and where it is played.

What stays on your device

Allegedly keeps a few things in your browser's own storage on your device. They are never sent to us, and they are not cookies:

• your sound and vibration settings;
• scores for games you have played (the Chain), including nicknames that guests typed, so a game remembers its leaderboard;
• which games' Awards Night you have opened (and, once payments are live, what you have bought), so it stays open;
• if you make games: a copy of the app's own files (a service worker), so it loads fast and works offline. Players who only open game links don't get it;
• a chat export you shared from your share sheet, until you open it (if you don't within 10 minutes, it is deleted the next time Allegedly opens).

You can delete all of it at any time by clearing this site's data in your browser's settings.

Payments

While we launch, nothing is for sale, so no payment details are collected at all.

When paid unlocks open, Paddle.com is our reseller and Merchant of Record. You pay Paddle, on Paddle's checkout page. Paddle collects your payment details, email address and country to take the payment, prevent fraud, send your receipt and meet tax rules, under its own privacy notice. We never see your card.

Paddle shares the order with us (what was bought, when, and the email address you gave Paddle) so we can help with questions and refunds. Our own server keeps only what an unlock needs: a short code worked out from the game that reveals nothing about it, and Paddle's transaction reference (and, for a Pass, a fingerprint of your Pass key, never the key itself). That lets the unlock work on every phone in the group and lets a refund undo it. We keep these records for as long as the unlock works, and delete yours if you ask (the unlock then stops working).

Hosting, and emails to us

Allegedly is hosted on Cloudflare. To deliver pages and keep the site safe, Cloudflare's network handles your IP address and basic browser details, as any web host must, under Cloudflare's privacy policy. Cloudflare may also ask your browser to report failed connections (Network Error Logging) so it can fix network problems. Our own code reads only the country; we don't store IP addresses and we keep no request logs.

If you email us, we use your address and message only to reply, and keep them only as long as we need to help you.

No selling, no ads, no trackers

We don't sell or rent personal information. There are no ads, and no third-party trackers, pixels or cookies: the site only loads files from its own address.

Where it is handled

We are in South Africa. Cloudflare and Paddle work worldwide, so the little they handle may be processed outside your country. They protect it with recognised safeguards, such as the EU's standard contractual clauses.

Your rights

Under POPIA and the GDPR you can ask us what personal information we hold about you, ask us to correct or delete it, object to how we use it, or ask for a copy. Because we hold almost nothing (we can't tie the counts to anyone), most requests will be about an email you sent us or something you bought. Email hello@allegedly.chat and we will reply within 30 days.

You can also complain to South Africa's Information Regulator, or to the data protection authority where you live (in the UK, the ICO). We'd be grateful for the chance to fix it first.

Children

Allegedly is meant for people aged 13 and over. It never asks for anyone's age or name, and it collects no personal information while you play. Under POPIA, a child's personal information (under 18) needs a parent's or guardian's consent, and in the EU the age for agreeing to online services is between 13 and 16, depending on the country. So younger players should use Allegedly with a parent's or guardian's OK, and buying is for adults or with their OK. If you think a child has sent us personal information (for example by email), tell us and we will delete it.

Changes

If this policy changes, we will update the date at the top, and if a change matters, we will say so on the site before it applies.

Contact

Privacy questions and requests: hello@allegedly.chat.