1. Introduction
Built by Foundry, Inc., formerly known as Playpen Games, Inc. ("Foundry," "we," "us," or "our"), operates the Hearsay mobile application ("App"). This policy covers the room and gameplay data needed to run an invite-only game, information saved on your device, Family Pass purchases, support messages, analytics, and diagnostics. Hearsay has no account or sign-in.This Privacy Policy describes the personal information we collect, where it comes from, why we use it, when we disclose it, and the choices available to you.Controller and contact: Built by Foundry, Inc. (f/k/a Playpen Games, Inc.), 2261 Market Street, Suite 86046, San Francisco, California 94114, United States. For privacy requests, email privacy@builtbyfoundry.io. For general questions: support@builtbyfoundry.io2. Information We Collect
2.1 Rooms and Gameplay
The player names, room code, answers, guesses, and laugh votes needed to play with people you invite. Hearsay creates a temporary cryptographic identity for each connected room. Answer submissions are sealed to the host until reveal. The room relay then sends game state to the devices at that table. Hearsay does not store answer text in its database.2.2 Information on Your Device
Your display name, sound and haptic choices, last mode and pack, prompt history, and a local game shelf with player names, dates, rounds, and awards. This information stays in the App's storage on your device.2.3 Purchases
Available subscription products, transaction and receipt information, restoration results, and Family Pass entitlement status. Apple processes payment. We do not receive your full payment-card number.2.4 Usage and Diagnostics
A generated app identifier, device and app details, app lifecycle and screen events, pack and prompt identifiers, aggregated round outcomes, purchase-flow events, crash reports, performance information, and other diagnostics. Analytics events do not include player names or answer text. Hearsay disables session replay and touch autocapture.Sources of information: We receive information from you, automatically from your device and use of the App, and from any sign-in provider, marketplace, or other service you choose to connect, including the app store. The categories above describe what we collected during the preceding 12 months; we do not collect a category unless the App uses the related feature.3. How We Use Your Information
• Create an invite-only room and run the game across the devices at that table
• Save preferences and game-shelf summaries on your device
• Offer, verify, and restore Family Pass access
• Prevent room abuse, respond to support and safety reports, diagnose failures, and improve Hearsay4. Third-Party Service Providers
We disclose only the information reasonably needed to service providers and contractors that host, secure, analyze, support, or process purchases for the App. They process information under their agreements with us and their own legal obligations.Room Relay: Supabase creates short-lived rooms and relays game traffic between the invited devices. The room directory stores the code, channel, public keys, version numbers, and timestamps, but not player names or answer text. It also keeps one-way-hashed rate-limit keys to protect room creation and joining from abuse.Subscriptions: RevenueCat and Apple process product availability, purchase receipts, restoration, and Family Pass entitlement status.Analytics and Diagnostics: PostHog processes the limited product events and device and app details described above. Session replay and touch autocapture are disabled. Sentry processes crash, error, device, app, and sampled performance information with default personally identifying information disabled.Distribution: Apple App Store distributes the iOS App, and Expo supports signed builds and updates. They may process device, installation, update, and purchase information under their own policies.No sale or behavioral-advertising sharing: We do not sell personal information for money or share it for cross-context behavioral advertising. We have not done so during the preceding 12 months. We may disclose information if required by law, to protect people or the App, or as part of a merger, financing, or sale of the business, subject to appropriate safeguards.5. International Data Transfers
Foundry is based in the United States. We and our providers may process information in the United States and other countries where privacy laws may differ from those where you live.EEA/UK/Swiss users: Where required, we rely on an adequacy decision, approved standard contractual clauses, or another lawful transfer mechanism. You can ask about safeguards for a particular transfer by contacting privacy@builtbyfoundry.io.6. Data Retention and Deletion
We keep personal information only as long as reasonably needed for the purposes described here, including to provide the App, maintain security, resolve disputes, and meet legal or accounting duties. Retention depends on the type of information, whether your account is active, and applicable law. When it is no longer needed, we delete or de-identify it. Copies may remain temporarily in backups or where law requires retention.Local preferences and game-shelf summaries remain on your device until you remove them or uninstall the App. A room expires about 30 minutes after its host stops extending it, with a two-hour maximum lifetime, and expired room-directory rows are deleted by an hourly cleanup. A closed room row may remain for up to about 75 minutes. Stale one-way-hashed rate-limit keys are deleted after about one day. The App does not store answer text in the room database. Apple, RevenueCat, PostHog, Sentry, Supabase, and support providers keep information under their own retention rules and our agreements with them.7. Your Privacy Rights
Depending on where you live, you may ask to access, correct, delete, or receive a copy of personal information, or object to or restrict certain processing. You may withdraw consent at any time where processing relies on consent, without affecting earlier processing.Legal bases for processing
Legal bases: We process information as needed to provide the App and perform our contract with you; for legitimate interests such as security, support, product improvement, and fraud prevention; with consent where required; and to comply with law.EEA, UK, and Swiss users
You may also have rights to data portability and to complain to your local data protection authority. We may ask for information necessary to verify and complete your request.United States state privacy rights
Residents of California and certain other states may have rights to know, access, correct, delete, or obtain personal information and to receive information about categories of recipients. We do not discriminate against you for exercising a privacy right. Where applicable, you may use an authorized agent and may appeal our response by replying to it.How to Exercise Rights
Email privacy@builtbyfoundry.io with the App name, the email or account identifier you used (if any), and your request. You may also use an account-deletion control where the App provides that control. We will verify requests as reasonably necessary and respond within the time required by applicable law.Some information may be exempt from a request or retained where permitted by law. We may charge a reasonable fee or decline requests only where applicable law allows it.8. Children's Privacy
Hearsay is not directed to children under 13. We do not knowingly collect data from children under 13.Parents: If your child under 13 has provided information, contact privacy@builtbyfoundry.io. We will investigate and delete the information when required.Teens (13-17): Review this policy with a parent or guardian.9. Data Breach Notification
We maintain an incident-response process. If a security incident affects personal information, we will investigate, contain, and provide notices to regulators or affected people when and as required by applicable law.Report security concerns: privacy@builtbyfoundry.io10. Security
We use administrative, technical, and organizational safeguards designed to protect personal information, including access controls and protections offered by our hosting and authentication providers. No method of storage or transmission is completely secure.You should: Protect your device, credentials, and connected accounts and tell us promptly if you suspect unauthorized access.11. Updates to This Policy
We may update this policy as the App or law changes. The Last Updated date shows when it was revised. If a change materially affects how we use personal information, we will provide notice in the App, by email when available, or by another reasonable method before the change takes effect where required.