Privacy Policy

Messy Times is operated by Tom Bourlet, who is the data controller. For privacy questions or requests, email contact@messytimes.app.

Messy Times is an adults-only party-games service for people aged 18 or over who are also of legal drinking age where they live. The app keeps a simple acknowledgement on your device after you confirm that you meet this requirement. It does not ask for your date of birth or identity documents.

One Device games do not require an account. When you first use Multiplayer, Supabase creates an anonymous authentication identity so that the service can recognise your device and securely manage room actions. Messy Times does not provide conventional accounts, passwords, linked identities or public profiles.

Multiplayer processes your chosen display name, an anonymous user identifier, room membership and game information such as responses, votes, reactions, guesses and game state, depending on the game. Other people in your room can see the information needed to play.

Automated cleanup runs approximately every 15 minutes. It removes reactions older than ten minutes, expires rooms at their configured expiry or 24-hour cap, finalises associated game state and deletes rooms after a one-hour expiry grace period. Related participant and game records are removed with the room.

Anonymous Supabase authentication identities are separate from room data and are not deleted by room cleanup. There is currently no automatic deletion period for those identities. Messy Times does not claim that they are deleted after 180 days.

These items support settings, consent records, security and features you request. Clearing browser/app data or reinstalling can remove them. The Android app is configured not to back up its app data.

Analytics is off until you explicitly allow it. If allowed, PostHog receives a provider-generated anonymous installation identity and limited product events. On the website, Google Analytics receives page views with sanitised paths and limited events about moving from public guides into browser play, selecting games and starting games. Approved properties are fixed, coarse game, mode, source and interface-location values.

Messy Times does not deliberately send player names, room codes, Supabase identifiers, prompts, answers, votes, reactions, free text, Adult Content choices or advertising identifiers to either analytics provider. Private multiplayer paths are replaced with fixed route templates before a page view is sent to Google Analytics. Google Signals, advertising personalisation and remarketing are not enabled.

Messy Times uses PostHog Cloud EU, hosted in Frankfurt, and configures PostHog without GeoIP enrichment, person profiles, lifecycle and error autocapture, push capture or Session Replay. PostHog retention is determined by its service plan. Google applies the data-retention settings configured for the Messy Times Analytics property. Turning analytics off stops new optional analytics, clears PostHog’s pending queues and identity, revokes Google analytics storage and attempts to remove first-party Google Analytics cookies. It does not delete information already transmitted to either provider.

Sentry crash and error monitoring operates separately from optional product analytics when monitoring is configured. It helps Tom identify unexpected failures and keep Messy Times reliable. Diagnostic information can include an exception message and stack trace, a coarse error-area tag, timestamps, and technical information about the app, device, operating system, platform and release.

Messy Times uses Sentry’s European Union data-storage region. Sentry retention is plan-based: its standard Developer plan provides a 30-day event lookback. A temporary trial or a later paid plan may provide a longer lookback, but Messy Times does not rely on a temporary trial as its normal retention period.

Default personal information, screenshots, view hierarchy and performance tracing are disabled. Messy Times removes user, request and breadcrumb fields and does not set a Sentry user identity. An unexpected provider or library error message may still contain information relevant to diagnosing the failure.

These providers may process ordinary technical request information needed to operate their services, such as IP address, request time, browser/app and device information, and security logs. Tom has data-processing agreements in place with the providers that process personal information on his behalf. Provider security, support and subprocessor operations may involve processing outside the UK even where the primary project data-storage region is in the EU; where required, contractual or other legally recognised transfer safeguards apply. Messy Times does not currently use advertising, AdMob, payments or in-app purchases.

You can decline analytics without losing gameplay or public-site access. Change the choice in app Settings or through Analytics preferences in the public-site footer. You can edit a remembered display name before joining or creating a room.

To ask about access, deletion, correction, objection, restriction or another data-protection right, email contact@messytimes.app. Messy Times does not use registered accounts, so Tom may need limited information that can reasonably connect your request to relevant data—for example, an identifier or room detail that you still have. Do not send passwords, authentication tokens, sensitive information or more personal information than is needed.

Because identities and gameplay are anonymous and temporary, Tom may not always be able to identify data as yours. A request cannot be fulfilled for data that cannot reasonably and safely be matched to you. Your rights also depend on the circumstances and are not all absolute. You may complain to the UK Information Commissioner’s Office if you are unhappy with how your information is handled.

This policy may be updated when the service or its data handling changes. The effective date above will be updated when a revised policy takes effect.