Privacy
Updated October 10, 2026.
The main site, grimgatherings.com, offers free mysteries without signup or checkout. Your game is saved in your browser, not an online account. The separate test site may show unfinished account and purchase features.
Playing & browser storage
Host game progress is saved after a player is added. Player names, character assignments, votes and guest reconnect details are stored in the participating browsers. Opening an empty host setup does not save a room. Older locally saved story copies may remain until removed or browser data is cleared. Use a trusted device; anyone with access to its saved host game can inspect the story and solution.
The host sends clues and game updates to guests' devices using PeerJS/WebRTC. Guests receive their own character information and public evidence and votes, not the hidden solution before the reveal. A connection service helps devices find one another. When cellular routing or a restrictive network prevents a direct connection, Cloudflare Realtime TURN can relay the encrypted WebRTC channel using short-lived credentials issued by our Supabase Edge service. PeerJS, Cloudflare, Supabase, network providers and other participating devices may receive connection information, including IP addresses. This is not anonymous communication. Use nicknames rather than sensitive personal information.
Local game progress is not uploaded as an account gameplay history. Ending a game clears the active host save but does not delete saved mystery copies or other devices' browser data.
Older accounts, purchases & test-site features
These features are not offered in the current free main-site catalog. Hiding them does not erase existing accounts, purchases or records, and does not change an existing refund right. The following information applies to retained records or use of those features on the test site.
Accounts & older story records
Supabase provides email/password authentication and the community database. It processes account email, authentication credentials and sessions; signup and recovery emails use Resend. Login tokens are saved in this browser to maintain and refresh your session. Signing out removes this browser's current login session. Passwords are handled by the authentication service, not included in game packets.
Story creation, submissions and community publishing are no longer offered. Previously stored drafts, revision history, submissions and moderation records are not automatically deleted by this change. Previously saved device drafts and story copies may also remain in browser storage, but are no longer accessible through the site editor. Contact the owner about legacy records or deletion.
Signing out does not delete your account or cloud records. Local story deletion is not a request to delete an account or moderation history. For access, correction or deletion questions, email grimgatherings2026@gmail.com. There is no self-service account-deletion screen yet.
Payment & purchased-game records
PayPal hosts payment and card checkout. We do not receive or store full card numbers or security codes. PayPal processes your payment information under its own privacy policy, including any information you provide for guest-card checkout.
Our protected community database links your game account to the bundle purchase, amount, currency, PayPal order/capture references, payment status, purchase-terms consent and payment-event history. Server-verified completed payments determine access. Administrators can view payment records and account email for support and refunds. Refunds and reversals remove access from the affected purchase. These records are retained for account access, reconciliation, disputes and applicable recordkeeping; signing out is not deletion.
Premium phone rooms store the host account reference, player names, roles, actions, ballots and match state in a protected server database. Guests receive only their own private role and report, plus public game information; the host's room controls do not reveal other players' private cards or choices. Each phone stores a secret reconnect token locally; the server stores only its hash. Anyone with access to that phone's browser data can access its seat. Keep room codes within your group and do not share tokens. Rooms expire after 24 hours; expired records are deleted when a new premium room is created. Closing a room stops access immediately but does not immediately delete its record. Payment refunds or disputes suspend hosted-room access.
Optional pass-and-play match snapshots save in this browser under an account-specific key, not in cloud purchase history. They contain all roles and match state: use a trusted device. Signing out hides the playable session but leaves this browser's match save so it can resume after signing in. Discard saved pass-and-play match removes that local snapshot without removing ownership.
For older purchase or refund questions, email grimgatherings2026@gmail.com. Do not post receipts, account details or payment information in the public GitHub tracker. The current main site does not offer checkout.
External services
Support email goes to Gmail, a Google service. We use the information you send to respond to your request. Send only what is needed; never send passwords, tokens or card details. Do not post private requests in the public bug tracker.
The site no longer offers AI story generation or review and makes no story-assistant provider requests. AI keys and settings saved by an older version may remain in that browser until its site data is cleared. Clearing site data also removes local game progress and login sessions.
Cloudflare hosts the main site; GitHub Pages hosts the test site. Google Fonts supplies fonts. External links take you to services with their own policies. These services receive ordinary network request information.
Traffic monitoring
Grim Gatherings uses Cloudflare Web Analytics on its production domain to understand visits, page views, referring sites, device/browser categories and page performance. Reports are private to the website owner; there is no public visitor counter.
Cloudflare describes Web Analytics as cookie-free and says it does not track individual visitors. Visits and page views are not a count of unique people. Blocking, repeat visits and bot detection affect totals.
We do not add account emails, story contents, room codes, passwords or login tokens to custom analytics events. We do not use analytics to measure individual player behavior or story completion.